Are IT Business Continuity Plans Ready for COVID-19?

The COVID-19 pandemic is prompting many colleges and universities to abruptly and comprehensively adopt online learning, remote work, and other activities to help contain and prevent potential outbreaks. Now is the time to initiate IT business continuity (BC) plans, which were created to ensure that institutions would be able to operate mission-critical activities and operations during emergencies. EDUCAUSE data on the maturity of higher education IT BC plans¹ can help institutions better understand their readiness and try to act swiftly to address gaps.

This research summary is one of a series of reports outlining higher education's readiness to adapt to COVID-19.

Glass Half Full or Half Empty?

Higher education is only partially prepared to continue critical operations during this pandemic. According to our data, only 42% of institutions have a formal IT business continuity plan that includes the policies, resources, and procedures necessary to enable the continuation or speedy recovery of vital technology infrastructure and systems and of normal business operations following a natural or human-induced disaster. Fewer than 50% of institutions have implemented any one of the forty-six best practices that constitute EDUCAUSE's business continuity maturity index.² This glass is not full, but it is not empty either, because at least some institutions have implemented each of the best practices.

Glass Half Full: Communications and Accountability

Forty-five percent of institutions have designated a role or team responsibility to lead IT business continuity, and 44% have an IT BC plan that includes communications processes. Of these institutions, almost all of them have informed the leaders and operational teams of their IT business continuity responsibilities. Between 40% and 50% of institutions also have communications plans alerting leadership and affected users of the initiation and ongoing status of business continuity operations (see table 1). Although some institutions are well prepared to initiate their IT BC plans, many institutions lacking in this area should consider at least developing an ad hoc communications and accountability plan for COVID-19 based on the best practices EDUCAUSE outlines and recommends in the business continuity and disaster recovery resources [https://www.educause.edu/focus-areas-and-initiatives/policy-and-security/cybersecurity-program/resources/information-security-guide/business-continuity-and-disaster-recovery].

Table 1. Most widespread IT business continuity best practices

IT Business Continuity Best Practice	Percentage of Institutions with Practice in Place
Our IT BC plan includes processes for alerting affected users to the issue.	48%
Our IT BC plan includes processes for alerting affected users to the status, progress, and completion of the recovery effort.	46%
Our institution's IT BC plan assigns clear responsibility/accountability to a designated person or team(s) to lead the continuity process.	45%
Our IT BC plan includes a process for the operational personnel to communicate the status, progress, and completion of the task back to leadership under the structure of the plan.	44%
Our institution's IT BC plan includes a communications plan to alert operational personnel to the initiation of the continuity process.	44%
Our IT BC plan includes a process for alerting affected users to the cause and solution of the issue.	42%
Our institution's IT BC plan has been communicated to the designated leadership person or team(s) responsible for successfully carrying out the BC plan.	41%
Our institution's IT BC plan has been communicated to the designated operational person or team(s) responsible for carrying out the BC plan.	40%
Our IT BC plan provides clarity around the priority of continuity across services, technologies, and business units.	40%
Our institution's IT BC plan includes a communications plan to alert leadership to the initiation of the BC plan.	40%

Glass Half Empty: BC Administration, Development, and Testing

Even institutions with IT business continuity plans might find they aren't sufficient. Few institutions have progressed beyond simply documenting business continuity processes, and many have failed to test or adequately fund plans. Only at 34% of colleges and universities do institutional leaders place a high priority on IT business continuity and planning. Perhaps most worrisome, only 31% of institutional business continuity plans integrate IT throughout the plan (see table 2). When the COVID-19 pandemic finally passes, institutions with IT BC plans should leverage the crisis to review, assess, and update their plans, lobby for adequate funds to implement their plans, and execute an emergency response test event for their plan. 

Table 2. IT business continuity best practices adopted at 30–39% of colleges and universities

IT Business Continuity Best Practice	Percentage of Institutions with Practice in Place
Our IT BC recovery initiation plans are communicated to affected internal people/departments in coordination with a designated communications resource/person.	39%
Our institution collects and uses input from multiple internal stakeholders (e.g., business units, colleges, distributed and/or remote IT staff) when making decisions about our IT BC plan.	37%
Our institution's senior leadership is aware of our IT BC plan, including but not limited to costs, implications, timelines, and priorities of the continuity process.	36%
Our institution's senior leadership places high priority on IT BC and planning.	34%
Our IT BC testing plans are reevaluated based on lessons learned following a testing event.	34%
Our IT BC plan identifies alternatives to prevent dependence on key personnel.	33%
Our IT BC plan is updated as needed following lessons learned from enacting the IT BC plan, live drills, or testing.	33%
Our institution has a process in place for regularly scheduled reviewing, assessing, and updating of our IT BC plan.	33%
Our institution has the resources necessary to carry out our IT BC plan.	33%
Our institution has appropriately allocated staff to carry out our IT BC plan.	33%
Our IT BC plan was developed to integrate with our institutional BC plan.	32%
Our institution assesses the feasibility of our current IT BC plan based on current resources.	32%
Our institution's senior leadership provides emergency or contingency funds for IT BC.	31%
Our institutional BC plan integrates IT throughout the plan.	31%
Our IT BC plan identifies alternatives to be implemented with existing resources (e.g., operational teams have access to third-party resources).	31%
Our IT plan was developed in coordination with our institution's governance, risk, and compliance unit(s).	31%
Our institution collects and uses input from external stakeholders (e.g., vendors, service-level and maintenance agreements) when making decisions about our IT BC plan.	30%
Our IT BC recovery initiation plans are communicated to affected external stakeholders in coordination with a designated communications resource/person.	30%

Down to the Dregs: Integration, Rehearsal and Training

Only about one in four institutions have integrated their IT BC plans with academic (23%) or other business units' business continuity plans (see table 3). This could be due to lack of cross-unit coordination, or it might indicate that few academic or business units even have BC plans. Both spell trouble for a swift and seamless adoption of online learning, remote working, or other IT-dependent responses to COVID-19.

Of the institutions with IT BC plans, only about half of them have rehearsed them, even within the IT team responsible for supporting IT BC. Only one in five institutions (18%) engage in training regimens for those who will play critical roles in the IT BC process, and a similarly low proportion (22%) conduct training based on lessons learned from live drills or simulated events. As the current COVID-19 pandemic unfolds, institutions without integrated IT BC plans should make sure that IT has a seat at the table with academic and other business units to coordinate response efforts and take careful notes about wins, missteps, and other lessons learned for future training programs.

Table 3. Least common IT business continuity best practices

IT Business Continuity Best Practice	Percentage of Institutions with Practice in Place
Our institution's senior leadership provides resources (operating funds) for IT BC.	27%
Our IT BC plan integrates with other business units' BC plans.	25%
Our IT BC plan integrates with academic units' BC plans.	23%
Our institution conducts training based on lessons learned or an after-action report following a drill or simulation.	22%
Our institution conducts regularly scheduled tabletop exercises attended by the entire IT BC team, including those in leadership roles.	21%
Our institution's IT BC plans have been externally validated or assessed (e.g., similar institutions, auditors).	21%
Our institution conducts regularly scheduled tabletop exercises for the operational IT BC staff only (excluding or not specifically inviting leadership).	20%
Our institution conducts regularly scheduled simulations or functional exercises involving the operational IT BC staff only (excluding or not specifically inviting leadership).	19%
Our institution provides IT BC training with onboarding for those individuals who will play a role in the IT BC process.	18%
Our institution conducts regularly scheduled simulations or functional exercises involving the entire IT BC team, including those in leadership roles.	17%

The need for IT business continuity is just a concept…until it's a reality. The majority of institutions have not spent sufficient time preparing for how to use information technology to continue mission-critical operations and activities. The COVID-19 pandemic is presenting higher education with a host of unprecedented challenges. Our efforts here draw upon current EDUCAUSE Core Data Service data to help higher education leaders and employees anticipate potential problems as they move their entire set of course offerings online and prepare to support students, staff, and faculty to learn, teach, conduct research, and work remotely.

EDUCAUSE will continue to monitor higher education and technology related issues during the course of the COVID-19 pandemic. For additional resources, please visit the EDUCAUSE COVID-19 web page.

Notes

1. EDUCAUSE data in this report are taken from the 326 institutions that completed the IT BC maturity index in the 2019 Core Data Service. ↩
2. This report focuses on thirty-eight of the IT BC maturity index items that pertain to supporting COVID-19. The eight items not included here address business continuity practices related to IT application and system availability. ↩

---

Susan Grajek is Vice President of Communities and Research at EDUCAUSE.

D. Christopher Brooks is Director of Research at EDUCAUSE.