Are IT Business Continuity Plans Ready for COVID-19?

The COVID-19 pandemic is prompting many colleges and universities to abruptly and comprehensively adopt online learning, remote work, and other activities to help contain and prevent potential outbreaks. Now is the time to initiate IT business continuity (BC) plans, which were created to ensure that institutions would be able to operate mission-critical activities and operations during emergencies. EDUCAUSE data on the maturity of higher education IT BC plans¹ can help institutions better understand their readiness and try to act swiftly to address gaps.

This research summary is one of a series of reports outlining higher education's readiness to adapt to COVID-19.

Glass Half Full or Half Empty?

Higher education is only partially prepared to continue critical operations during this pandemic. According to our data, only 42% of institutions have a formal IT business continuity plan that includes the policies, resources, and procedures necessary to enable the continuation or speedy recovery of vital technology infrastructure and systems and of normal business operations following a natural or human-induced disaster. Fewer than 50% of institutions have implemented any one of the forty-six best practices that constitute EDUCAUSE's business continuity maturity index.² This glass is not full, but it is not empty either, because at least some institutions have implemented each of the best practices.

Glass Half Full: Communications and Accountability

Forty-five percent of institutions have designated a role or team responsibility to lead IT business continuity, and 44% have an IT BC plan that includes communications processes. Of these institutions, almost all of them have informed the leaders and operational teams of their IT business continuity responsibilities. Between 40% and 50% of institutions also have communications plans alerting leadership and affected users of the initiation and ongoing status of business continuity operations (see table 1). Although some institutions are well prepared to initiate their IT BC plans, many institutions lacking in this area should consider at least developing an ad hoc communications and accountability plan for COVID-19 based on the best practices EDUCAUSE outlines and recommends in the business continuity and disaster recovery resources [https://www.educause.edu/focus-areas-and-initiatives/policy-and-security/cybersecurity-program/resources/information-security-guide/business-continuity-and-disaster-recovery].

Table 1. Most widespread IT business continuity best practices

Glass Half Empty: BC Administration, Development, and Testing

Even institutions with IT business continuity plans might find they aren't sufficient. Few institutions have progressed beyond simply documenting business continuity processes, and many have failed to test or adequately fund plans. Only at 34% of colleges and universities do institutional leaders place a high priority on IT business continuity and planning. Perhaps most worrisome, only 31% of institutional business continuity plans integrate IT throughout the plan (see table 2). When the COVID-19 pandemic finally passes, institutions with IT BC plans should leverage the crisis to review, assess, and update their plans, lobby for adequate funds to implement their plans, and execute an emergency response test event for their plan. 

Table 2. IT business continuity best practices adopted at 30–39% of colleges and universities

Down to the Dregs: Integration, Rehearsal and Training

Only about one in four institutions have integrated their IT BC plans with academic (23%) or other business units' business continuity plans (see table 3). This could be due to lack of cross-unit coordination, or it might indicate that few academic or business units even have BC plans. Both spell trouble for a swift and seamless adoption of online learning, remote working, or other IT-dependent responses to COVID-19.

Of the institutions with IT BC plans, only about half of them have rehearsed them, even within the IT team responsible for supporting IT BC. Only one in five institutions (18%) engage in training regimens for those who will play critical roles in the IT BC process, and a similarly low proportion (22%) conduct training based on lessons learned from live drills or simulated events. As the current COVID-19 pandemic unfolds, institutions without integrated IT BC plans should make sure that IT has a seat at the table with academic and other business units to coordinate response efforts and take careful notes about wins, missteps, and other lessons learned for future training programs.

Table 3. Least common IT business continuity best practices

The need for IT business continuity is just a concept…until it's a reality. The majority of institutions have not spent sufficient time preparing for how to use information technology to continue mission-critical operations and activities. The COVID-19 pandemic is presenting higher education with a host of unprecedented challenges. Our efforts here draw upon current EDUCAUSE Core Data Service data to help higher education leaders and employees anticipate potential problems as they move their entire set of course offerings online and prepare to support students, staff, and faculty to learn, teach, conduct research, and work remotely.

EDUCAUSE will continue to monitor higher education and technology related issues during the course of the COVID-19 pandemic. For additional resources, please visit the EDUCAUSE COVID-19 web page.

Notes

1. EDUCAUSE data in this report are taken from the 326 institutions that completed the IT BC maturity index in the 2019 Core Data Service. ↩
2. This report focuses on thirty-eight of the IT BC maturity index items that pertain to supporting COVID-19. The eight items not included here address business continuity practices related to IT application and system availability. ↩

Susan Grajek is Vice President of Communities and Research at EDUCAUSE.

D. Christopher Brooks is Director of Research at EDUCAUSE.