tion is likely to be affected by local disruptions — somewhere —
on a very regular basis.
“There are events happening almost constantly at any time in
different parts of the world, whether a bombing in Jakarta or an
uprising in Egypt or an earthquake in Japan,” says Michael Shea,
executive vice president for IT at International SOS, a company
that provides medical and security services to travelers and has
operations in 70 countries. With so many locations — many of
them in emerging markets and other politically or economically
unstable areas — operating through a crisis is business as usual.
“We have to activate one of our business continuity plans about
every three to four weeks,” Shea says.
Even if you have few operations in unstable areas, it’s wise to
consider what events could disrupt your overseas operations, affect
your overseas data or threaten your overseas employees. A well-thought-out foreign policy should be part of every CIO’s toolkit. But
how can you effectively prepare for whatever disasters the world
might throw at you? Here are some ideas that might help.
Don’t Plan for Everything Everywhere
In omnia paratus —“Ready for anything!” This might seem like
a good approach to protecting your I T operations from all perils
overseas. And indeed, some IT leaders take the position that,
since there’s no way to predict what might happen next in any
geographic location, the best strategy is to be ready to meet absolutely any threat anywhere it may arise.
There’s only one problem with this approach: It’s impossible
to do. “Trying to prepare for everything every where leads you
down one of two paths, neither of which is good,” says Dan
Blum, an analyst at Gartner. “One path is saying that whatever
you’re doing will have to be good enough, since you can’t know
everything. The other is the path of being too paranoid and
exhausting yourself chasing phantoms, and no organization can
do that for very long. CIOs or chief information security officers
who attempt to create and maintain the same very high level of
preparedness everywhere will find their credibility eroding and
their influence declining over time.”
On the other hand, it can be very hard to see even a short
distance into the future. Consider Orange Business Services, the
How to Create
A Valid Threat Matrix
In South Africa, phone lines often fail because people desperate for
money pull them apart to sell the copper wire. In the Philippines, electrical fires are a frequent problem. There’s no doubt that knowing the likelihood
of a particular threat in a particular location is key to business continuity
planning. But is there a useful way to take all the various factors into account?
International SOS, which provides medical and security services to travelers in 70 countries, comes as close as humanly possible by creating a specific
risk matrix for every one of its locations. “We look at about 50 different categories of events, and for each we rate the possibility of it happening from 1
to 5,” explains Jonathan Bar, general manager of global infrastructure.
business communication arm of one of Europe’s largest mobile
providers. The company has four major support centers in Egypt.
One day last winter, Paul Joyce, senior vice president of international customer service and operations, paid a routine site visit
to the company’s facility near Cairo. With protests sweeping
through nearby Tunisia, Joyce asked the company’s local staffers
whether they anticipated civil unrest in Egypt as well.
IT executives obtain this information by working directly with local em-
ployees. They’re asked how many times a given event has taken place in
their location during the previous year, five years, 10 years and 100 years.
Once you take such a long view, some recent startling events become slight-
ly less surprising. “You’d have to go back to the 1970s and the presidency of
Anwar Sadat, but there was rioting in Egypt then,” Bar says. “That was only
about 30 years ago, so it could happen again.”
Once you have a threat matrix established for a particular location,
it’s easier to plan for the likeliest disruptions. In Thailand, for instance,
depending on how you count, there have been 20 attempted or success-
ful coups in the past 100 years. During the most recent attempt, the local
International SOS office was surrounded by tanks.
“So we adjust our planning for Thailand with the view that the odds of
civil unrest are very high,” Bar says. “When it comes to tornadoes there,
we’re not overly concerned.”
— MInDA ZETlIn
