Continuity plans sport a new look

Business continuity often conjures images of fully redundant systems housed at a remote government facility. Federal data centers housing standby systems are still part of that picture, but agencies can now tap other options that supplement and, in some cases, partially replace traditional measures.

Specifically, telework programs, already established at many agencies, and newer trends such as cloud computing and bring your own device (BYOD) can contribute to agencies’ continuity-of-operations (COOP) plans.

Collectively, those initiatives paint a somewhat complicated picture of business continuity. But here’s the upside: Their applicability to COOP presents an opportunity to boost efficiency and trim costs, as long as agencies take care to adapt those nontraditional approaches to the demands of business continuity. Why it matters

Cloud computing, telework and BYOD offer agencies more than flexibility and the potential to save money. They also boost resiliency. By delivering services remotely, for example, cloud computing providers offer a hedge against local disruptions. They also take on the infrastructure and backup chores that agencies would otherwise have to handle, so there’s an opportunity to trim COOP expenditures as well.

Last year, the Energy Department’s Idaho National Laboratory (INL) migrated from an in-house messaging and collaboration system to Google Apps for Government. Denise Stephens, the lab’s CIO, cited business continuity as one of the benefits of the transition.

Previously, INL developed its own contingencies, operating a backup site for its messaging and collaboration system and replicating storage. Stephens said the backup site remains in use for other systems, but the lab was able to free up infrastructure when it adopted Google Apps.

“We were able to release storage and capacity that our previous messaging system required for the backup capability,” Stephens said. “I think that is definitely a benefit that comes with cloud solutions.”

She sees the potential for savings but noted that hard numbers aren’t yet available because the Google Apps deployment is only in its first year. Furthermore, her IT organization is considering adopting additional software-as-a-service (SaaS) solutions as they mature.

“As more and more cloud [solutions] are implemented, it reduces the footprint of what you need to keep in the way of business continuity capabilities,” she said.

John Lambeth, CIO at QinetiQ North America, said cloud services let agencies avoid the capital costs associated with redundant data centers. “The cloud service provider has made the capital investment in multiple facilities to create that high-availability service,” he said.

While cloud computing supports the availability of systems, telework and BYOD address the human aspect of business continuity. Employees equipped to work remotely using government-supplied gear or their own devices can keep working even when federal offices have to close for weather and other disruptive events. Telework and BYOD also feed into cloud initiatives as government- or employee-owned devices become on-ramps to remotely hosted services.

The fundamentals

The Telework Enhancement Act of 2010 calls for agencies to make telework part of their COOP plans. But the melding of telework and COOP actually began years earlier, said Dayna Fellows, president of WorkLife Performance, a telework consulting firm in Bethesda, Md. She said telework and COOP started out in different places in the 1980s: Telework focused on a changing workforce and work/life issues, while business continuity concerned itself with the government’s increasing dependence on computer systems. The 2001 terrorist attacks, however, caused the infrastructures for telework and COOP to begin blending, Fellows said. Since then, they have become more integrated.

“When you sign up to be a teleworker, you are effectively committing to be part of the agency’s COOP strategy,” she said.

Research supports Fellows’ observation. In the Office of Personnel Management’s “2012 Status of Telework in the Federal Government” report, 75 of the 87 responding agencies said their COOP strategies address telework.

Agencies say they benefit from bringing the two programs together. Seventy-one percent of the organizations the Mobile Work Exchange surveyed last year for its annual Telework Week report said their business continuity had improved because of telework, up from 52 percent in 2011. Ninety-four percent of the respondents to the 2012 survey were in the federal sector.

Cindy Auten, general manager of the Mobile Work Exchange (formerly the Telework Exchange), said telework’s business continuity aspect has broadened in the past few years. When the Telework Exchange launched in 2005, discussions about business continuity would start with the onset of winter and focus on preparing for snowstorms. Agencies now concern themselves with incidents that can happen year-round and make sure their plans are constantly updated, Auten said.

Officials at the Centers for Disease Control and Prevention are among those who are combining telework and COOP.

“CDC is very actively engaged in teleworking, and we do use that as part of our business continuity,” said Rodney Murray, CDC’s deputy for technical operations.

He said the agency uses the same basic infrastructure for COOP as it does for daily telework operations: Remote employees access email and other systems via virtual private networks (VPNs) in both situations. Such dual use helps agencies prepare for trouble, said Tom Simmons, area vice president for the U.S. public sector at Citrix Systems. He said employees with a high degree of familiarity with working remotely will maintain their productivity levels when events call for unscheduled telework.

Routine use of telework, Simmons added, has “a very positive impact on the ability to implement and effectively utilize a COOP plan.”

BYOD policies can also bolster COOP plans and reduce costs by substituting employee-owned for government-furnished equipment. Furthermore, BYOD can supplement telework programs because a personal device can fill the gap if an employee needs to work remotely but has left a government-supplied laptop at the office.

Simmons said he has yet to find an agency that identifies COOP upfront as a key objective of a telework or BYOD program. But that position changes when agencies start to consider the financial implications of a mobility plan.

“When we get to the point of doing the [return on investment] and cost justification...continuity of operations absolutely is an important consideration as they look to justify cost and expand the validity of the use case,” Simmons said.

Justifications for cloud investment, meanwhile, also cite COOP. INL’s adoption of SaaS-based messaging and collaboration included business continuity as part of the business case, Stephens said.

The story is similar at the Interior Department, which adopted Google Apps last year. “Business continuity and cost savings are a significant requirement and consideration as the Department of the Interior develops its IT acquisition plans,” said Lawrence Gross, Interior’s deputy CIO.

He added that cloud-based solutions save money and provide an elasticity that is lacking in traditional IT procurement and deployment. “The elasticity offers the ability and flexibility to respond to a myriad of business continuity challenges,” Gross said.

The hurdles

Among the pitfalls an agency might encounter is the failure to fully account for the difference between daily operations and the demands of COOP.

Lambeth said agencies should consider the scalability of their infrastructure and assess whether they need to adjust the technologies that support business continuity objectives. For instance, an organization might base its authentication and connectivity infrastructure on the assumption that no more than 10 percent of the workforce will telework on a given day. But what happens if half the workforce wants to report for duty remotely during inclement weather? Can a VPN that serves 100 users on a typical day support 600 during peak demand?

Industry and government executives say agencies must periodically test their infrastructure to determine whether it is COOP-worthy. They might do that by conducting broad telework tests or by concentrating on specific elements. CDC, for instance, routinely tests its service desk’s COOP plan. If service desk employees can’t get to the office, they access the necessary systems remotely, and CDC routes calls to their homes.

“We test that once a year,” Murray said. “We have all staff work from home to make sure it works.”