Lessons learned is a good place to begin

Many organisations were simply not ready for the effect of last year’s flooding, and this was a clear example of how the public sector can improve its risk management.
At BT, as part of the critical national infrastructure, we have commitments and regulatory requirements towards supporting government and local authorities to prepare for an emergency.

We had certain plans in place, but what was clear was that none had been tested to this scale ­ many organisations had simply been through academic exercises.
We all learned a lot of lessons. One of the most important was about mobilisation plans, where we needed to look at the affected datacentres, or call centres, or offices.

In a disaster, people normally think of it in a central location. But the floods were across such a broad area that you could not just say to someone “go to work in an office 10 miles away”, because those offices were flooded as well.

For BT it was about mobilisation on a much larger scale and to deal with that. For instance, how do we mobilise teams to replace equipment and keep services running?

We have a very resilient infrastructure, so we could route our systems and services and calls to different parts of the country because of the way they have been built. But we still had to ensure that we could provide services at a point from those flooded locations, because we didn’t want to find that stations and service centres were unusable at a massive cost to us.

Gloucestershire County Council said it did not anticipate the problem because the area had not been touched by flooding since 1946. In the end it had to turn off its entire IT infrastructure.

It’s about understanding the impact and planning on a larger scale ­ the unexpected really can happen, and in this case it actually did.

As a result of the floods, a number of public sector organisations are looking at how and where they locate their offices and looking at things such as remote working.
It may not be their normal modus operandi, but in dire circumstances they can operate in this way.

Councils are also making greater investment in business continuity and disaster recovery, which means they spend time thinking about the broader aspects and issues that affect them and adequate investment.

Public sector organisations need to ask what have they done differently since the floods. Can they hand-on-heart say they have given their best duty of care towards local citizens?

Ray Stanton is global head of BT’s business continuity, security and governance practice. This article is taken from a transcript of an interview with Stanton in a Computing web seminar “Managing risk: The challenges for the public sector”.

Visit: www.computing.co.uk/webseminars