3] Improving the process should be part of the plan. In 2002, Texas Children’s Hospital suffered through a virus scare for several days where faulty antivirus software made it appear that thousands of the hospital’s computers were infected with a virus. The hospital’s IT staff quarantined the affected computers, limiting access to critical patient data. Given the life-and-death importance of IT to a hospital, clinical staff moved to manual processes to keep patients safe. They found that the established downtime procedures worked well for the first couple of days, but the longer the trouble dragged on, the more time-consuming it became to recover. The clinical staff learned some valuable lessons during this incident. "It prompted them to review business-continuity procedures and develop new, manual processes as a result," says David Finn, VP and CIO, privacy officer and information security officer. Schedules are now printed on hard copy for the current day and the next couple of days to reduce reliance on IT systems.

4] Coordination should stay with IT. IT should provide templates, review the plans and coordinate overall processes to ensure that each unit has done its due diligence. Eastman Chemical CIO Jerry Hale, Kraus and Swartz provide templates for each function that describe what components to include and how specific to be in the documentation. At Texas Children’s Hospital, IT is developing templates that will standardize the process of business continuity, outline practices and establish a monitoring process to ensure plans are updated as needed. (For sample templates, visit the online version of this story at www.cio.com/100105.)

5] Test business-continuity plans just as you would test technical disaster recovery. "We get the group of business owners in a room, present a scenario, and then walk through the business-continuity process," says Hale. Kraus uses scenario-based testing to make sure the plan covers all the necessary elements. He gets information on potential scenarios from colleagues, by participating in external disaster-related activities, and from federal and government agencies responsible for disaster preparedness and planning. This year Kraus plans to run a business-continuity drill that will involve relocating staff from different subsets of Intelsat to the backup facility, and then restarting the business.