By Yaren Usul
A Continuity of Operations Plan (COOP) is a necessity for every organization. Think of it like walking into a store without checking your wallet, crossing your fingers, hoping you brought enough cash. You get to the register and realize you don’t have enough cash on you to purchase your dinner for tonight. Now, if you’d had a COOP in place, you’d have options: a credit card in the same wallet as a backup, a reliable friend down the street you could call to cover the difference, or some emergency cash stashed in your car’s glove box compartment.
A COOP gives organizations a guided alternate route when faced with risks or disasters, to continue following the principles of cybersecurity: confidentiality, integrity and availability (CIA triad). Without one, there’s no credit card in the wallet, no friend down the street, no cash in the glove compartment. Just an unplanned scramble when it matters most. In healthcare, especially, this is crucial.
5 Core Ingredients for a Strong Continuity of Operations Plan
- Clear Roles and Responsibilities: A strong COOP assigns roles and responsibilities to individuals in a cross-disciplinary setting. Having this laid out ahead of time dissipates the finger-pointing that can occur in a time of crisis. It clearly defines each member’s role in the plan and what operations of the plan they are responsible for carrying out. Without this, tasks can go unnoticed. It can be difficult to identify points of contact and their tasks in the middle of a crisis. To prepare for the worst, you should also have secondary points of contact in case the primary contact is unavailable.
- Identify What’s Truly Mission-Essential: What IT systems must stay online for the organization to continue serving your customers or patients? Think about these questions when considering if something is mission essential: if this function is unavailable, would this cause patient safety/care issues, would it pose a risk to our staff, would customers lose trust in the organization? Don’t take the “we will find out when it happens” approach — that’s a definite recipe for disaster.
- Redundant, Reliable Data Backups: In preparation for a potential disaster or attack, it is crucial and a best practice to always have backups of important data and infrastructure. Whether that is on-site backups, off-site backups or cloud-based backups, your data should not be stored in one place and one place only. This can help mitigate the risk of losing data indefinitely. It can also help with your recovery time because losing data could be irreversible. These are only a few considerations, but they get the conversation started. Without this, you are also at risk of violating privacy rights, which can lead to monetary fines, public distrust and government sanctions.
- Defined Recovery Time Objective (RTO): You are not likely to always be prepared to fight against a threat. Sometimes you will have to recover after the fact. In that case, ask: “What is your recovery time objective? How fast do you want to return to your functions?” Having pre-defined steps on how to recover critical IT systems can help improve your recovery time. It shows a proactive approach to your customers and patients, that you value the CIA principles.
- A Communication Plan That Doesn’t Rely on Business as Usual: The simplest step — and the easiest to overlook — is having a communication plan. In a crisis, you might not have access to your normal means of communication with your internal team or vendors. If your primary communication system is at risk, it might not be feasible to continue with that system. Having another mode of communication can ensure smoother operation and decrease chaos.
Keep Your COOP Accessible and Adaptable
Including these “ingredients” in your COOP can help ensure a smoother process. Have this plan handy with both a digital and a hard copy. You’ll want to have backup options in place because having a COOP that you can’t access when you need it defeats the entire purpose. Ensure your organization is prepared for different types of risk and disasters. They can come in many forms: cyber-attacks, natural disasters, insider threats, etc. Your plan should be flexible and adaptable for any type. Organizations are strongest when they have prepared and diligent offensive and defensive strategies. To continue serving your customers and patients, take the time now to prepare ahead.
Related: Read part one of this month’s Biomed 101 on clinical systems cybersecurity, What HTM Professionals Should Prepare for Next.
