Guiding Principles for Business Continuity Planning

As the effects of COVID-19 continue to reverberate across sectors and around the world, businesses are taking a closer look at their business continuity plans (BCPs). Businesses that already had a plan in place are evaluating potential improvements; while those that lacked an adequate plan are focused on creating or updating one to help handle the current crisis and become better prepared for the next major business-disrupting event. With this renewed focus on BCPs, Salesforce Architects are front-and-center, playing a central crisis management role either within their own companies or in working with customers and clients.

Defining what needs to be done to keep the business operational — the essence of a BCP — doesn’t have to be overly complex. In fact, a simple plan that’s clearly laid out can work better and need fewer updates than an exhaustive plan that attempts to cover every possible contingency with all details spelled out. Simply put, a good BCP lets everyone know what’s actually needed to keep moving forward from a people perspective, while the technical and data related aspects are covered in a disaster recovery (DR) plan.

At Salesforce, we created the BCP that has helped us navigate the pandemic with three guiding principles in mind:

1. Stabilize our own business first
2. Make sure our customers are up and running
3. Ensure that our teams have what they need to be productive

Organizing a plan around these principles can be an effective way to jumpstart development of a new BCP or fill in gaps in your existing BCP. In a crisis, we have a responsibility to one another. Having a plan not only helps us meet those responsibilities it also eases stress levels when they start to rise.

Let’s take a look at each principle, and see how you can get started.

Phase 1: Stabilize your own business (Put on your own mask before assisting others)

You can’t help customers and partners if your own business is not functioning. So, it’s imperative that you get your own organization and teams sorted out first. Your BCP should reflect this imperative. At a basic level, you’ll need to define the chain of command and who will fill in for whom when needed. The plan should cover executives, product leads, technical leads, directors of HR and finance, program managers, and key individual contributors — anyone whose decision-making is central to your operations. If you have an Ops model that defines the people in your organization, their roles, who they work with and so on, you can use that model as a starting point for this part of your BCP. Remember that this doesn’t have to be complex; you can use custom objects in your Salesforce org if you want to, or you can start with a simple spreadsheet, your existing PTO plan, and a phone tree.

Next, think about the types of events or situations that will trigger an activation of the BCP or some part of it. Triggers can be simple; for example, a particular team lead being out for an extended period of time. Or, they can be based on aggregate metrics, such as the absence of team members above a set threshold. Triggers for COVID-19 and similar scenarios could cover percentages of teams working remotely.

No matter what triggers you define, you must be able to track them easily. A plan won’t do much good if it’s not activated when needed because the triggers were unclear. Lastly, keep in mind that a BCP cannot be effective if it is inaccurate or out of date. Once you’ve created your plan, set up a process to ensure that it is maintained. Support what you build. This includes, to the extent that it’s possible, testing your plan as you would with a failover or DR plan. If, during normal operations, a team lead goes on PTO and things start to fall apart, check the BCP and make sure it covers that lead’s absence. Organizations rightly test their DR and failover plans on the tech side, but it’s just as important to test on the people and organization side.

Phase 1 Next Steps

• Check out our NEW! BCP Quick Start (with simple guidance for getting started on building a BCP and simple templates for some common BCP resources)
• Define the team that will create and support your BCP. For larger organizations, you’ll likely want to include a representative from each major product group or business division.
• Start drafting your BCP and establish a shared folder or repository for it.
• Make sure phone numbers and email addresses are current.
• Review triggers for activating your plan and check that they are clearly defined.
• Test your plan. Walk through simulations or scenarios related to your triggers, as you would with a failover or disaster recovery plan.
• Set up a regular cadence for reviewing and updating the plan, including contact information, triggers, and any responsibilities that may have changed within your organization.
• Check out an example BCP from Ready.gov.
• Learn more about the ways Salesforce maintains system availability and performance.

Phase 2: Keep your customers up and running

Once you have a plan for enabling your organization to regain its footing, you can turn your attention to your customers. Here you’ll want to work with account executives, solutions engineers, and others in a similar role within your company to understand what your customers will need to handle a widespread crisis, including what specifically they will need from your organization. Capacity planning plays an important role in this part of your BCP. Think through how you’ll handle substantial increases — or decreases — in demand that may stem from unanticipated, industry-wide changes. Along these same lines, make sure your BCP accounts for any additional resources or break-glass procedures that Site Reliability Engineering (SRE) and support teams may need to respond effectively.

Communication with customers is vital, particularly when circumstances are changing rapidly. Include, as part of your BCP, provisions for setting up and maintaining solid communication channels with your customers. Consider assigning a senior director, VP, or other executive to key accounts to keep customers apprised of your plans, help them understand the options available to them, and alleviate some of the excess load that your account executives may have to carry. This is not just about ensuring escalation paths are well-defined, it’s also about continuing to build trusted relationships with customers. Taking it one step further, determine if you have the ability and the capacity to help your customers keep the lines of communication open with their own customers. In a crisis management scenario, your customers may need all the assistance your teams can feasibly provide.

Depending on the size of your organization, you may want to plan for regular meetings between internal support teams and customer-facing teams. Getting these groups together in the same room (virtual or real) will enable them to connect the dots by sharing their unique perspectives. Account executives can provide a heads-up on what customers are calling for or likely to need, while internal teams can provide updates on the current state of operations, important product updates, planned outages, and so on.

Phase 2 Next Steps

• Talk with your front-line product support teams to identify critical paths that will need to be remain clear to keep customers operative.
• Plan now for maintaining lines of communication with your customers and think about how you’ll communicate with customers in a crisis.
• Identify your key internal- and customer-facing teams and sketch out the who, how, when, and where they will meet.
• Make plans for maintaining customer relationships under changing or adverse conditions.

Phase 3: Ensure your teams have what they need to be productive

Having a plan that addresses the basic operational needs of your organization and its ability to serve customers is an essential first step. The next step is to move beyond stabilizing the situation and back towards more normal levels of operation. Restoring your teams’ productivity may be the most technologically oriented area of your BCP, yet is also likely the one that requires the greatest levels of humanity and careful consideration.

From a technical perspective, you’ll need your plan to cover new infrastructure and hardware needs that are likely to arise. The goal is to make sure your teams are not blocked due to technical issues. For COVID-19, that meant supporting a sudden shift to teams working from home. Additional laptops, enabling secure remote access to networks and systems, and scaling the resources needed to provide that access were among the top priorities for many companies. Similarly, if your teams’ ability to deliver depends on vendors, your BCP could include reaching out to those vendors to assess their ability to remain available. For large enterprises, a follow-the-sun support model can be significant advantage in maintaining continuity, particularly for a crisis localized to one geographic area.

From a human perspective, however, it is important to recognize that the events that have triggered your BCP — whether it be a natural disaster, global pandemic, or some other crisis — are likely having a significant personal impact on individual team members. The objective here is not to monitor productivity or enforce predetermined standards, but rather to ensure that people have the tools and resources they need. Stress and anxiety are natural reactions in crisis situations, so make plans to check on the well-being of your staff.

As you plan, prioritize empathy over making judgments. At Dell, for example, teams are encouraged two wrap-up meetings five to ten minutes early so that members can check-in with their families. “We’re also encouraging regular, informal check-ins via video. By keeping our teams supported and connected, we know we’ll come out of this stronger in the future,” says Stephen Brown, a Vice President at Dell Commerce Services. That sentiment is echoed and amplified by Jody Kohner, SVP of Employee Engagement at Salesforce. She notes, “Our employees put a lot of faith in us, and they’re looking to us to help us through this very tumultuous period. We are very motivated to do that because not only is that the right thing to do, but also because we know that when they are healthy and they are well, they will be able to take care of our customers.”

Phase 3 Next Steps

• Review provisioning pipelines and support systems for working remotely.
• Talk to your key vendors about their continuity plans.
• Review your internal technology and product Disaster Recovery plans, and ensure they’re being tested. For more information, check out Build a Disaster Recovery Plan on Trailhead.
• Think through potential changes to daily workflows — adding a morning stand-up meeting, for example — that can reduce isolation and stress.
• Provide teams with practical guidance for staying connected when working remotely.
• Learn more about collaborating with distributed teams and managing remote workers on Trailhead.

What You Can Do Now

1. Add our Business Continuity Planning episode to your TrailheaDX Agenda
2. Send us your questions about business continuity & BCPs: sforce.co/TDX20ASK
3. And tune in and get answers during our Ask the Experts special episode