Is remote working causing you to question your business continuity plan?

Is remote working really a business continuity option?

With the rise in staff not attending offices regularly, many companies are considering this as an option within their business continuity plans.

If you start to see significant percentages of your staff working remotely, how do you develop a business continuity plan that considers an impact on their workplace? How can you be sure they are following OH&S procedures or security policies, or experience an internet outage at home? Fires, power failures or loss of connectivity all loom larger when you have a dispersed workforce without the usual IT and other support available close by.

Take a step beyond the full-time or regular remote working scenario and consider how some businesses are now considering using remote working as a business continuity solution in the event of a disaster. Allowing staff to work remotely for the duration of the disaster appears seamless enough, but what happens to those staff who evacuated without their IT equipment? How do you route your call centre phones to individuals at home or in coffee shops without reducing your quality of service?

Nick Scholefield, Chief Information Officer at Interactive, has spent a lot of time over the last year considering the risks and opportunities of enabling a remote workforce and says it is not always the panacea that many people feel it is. “Working from home is a great opportunity for people to be flexible with their business activities. Incorporating time to pick up kids from schools, attend extra education or simply reduce commute times, all are benefits for both the employee and the business, but they also need to be considered in the context of business risk.” His concerns revolve specifically around data and security breaches.

Data is a critical asset for your business

A study from McAfee found that at least 20% of all information stored in a remote storage or cloud service was classified as sensitive or commercially critical. Given many of these services do not provide encryption or elevated security as standard, businesses may find themselves at significant risk relying on these services to support their remote working community.

Given the demand for cloud storage is only accelerating it is likely your company is enabling this functionality. While doing so gives your staff the ability to work literally anywhere there is an internet connection and still have access to their critical files. The lower security level of these services means that you are now holding your company’s most critical data in a location that is a regular target for attacks.

We all remember in 2019 when Facebook disclosed the records of approximately 420 million users and CapitalOne lost 100 million records in a targeted attack by a former AWS employee – these examples seem extreme but many other attacks have shown the paucity of data held in the cloud. It is rare for a company to possess the necessary skills and talent to effectively maintain and control the information that they have placed in the cloud to enable their staff to work remotely.

Where to for risk management?

For Scholefield, it is a combination of elements that make his business continuity plan effective and appropriate for the company. “Organisations still need to have a suitable site for their staff to go in the event of an incident. The site should have IT hardware, telephones and appropriate spaces for the team to collaborate, work and respond to the crisis in a safe and appropriate way. Further, you cannot afford to rely on your primary data centre which may be located at the disaster site. Having an appropriate disaster recovery store for your data is an absolute necessity,” states Scholefield. A trend born out of the pandemic has been serviced office allowing for the flexibility of having a secured and equipped environment without the cost of an expensive CBD site.

No matter what your business continuity plan state, the most important thing you can do is test your plan. Testing enables your team to evaluate it, refine it and update it for changes in your business so it works when a disaster does occur.