Buildings intact, workforce gone: the scenario continuity plans skipped

The week

In the week of February 24, 2020, US stock markets fell sharply as the virus spread in Italy, South Korea and Iran, recording their worst week since the 2008 financial crisis. Investors were not reacting to anything that had yet happened in American offices or hospitals. They were pricing in what might.

The news from abroad had turned in the days just before. Over the weekend of February 22 and 23, Italian authorities sealed off a group of towns in Lombardy and Veneto after a cluster of cases with no clear link to China. South Korea raised its infectious disease alert to the highest level as cases linked to a church in Daegu climbed. Iran reported a growing outbreak centered on the city of Qom.

The market response built through the week. On Thursday, February 27, the Dow Jones Industrial Average fell nearly 1,200 points, then the largest one-day point drop in its history. By Friday the Dow was down more than 12 percent for the week and the S&P 500 about 11.5 percent. The yield on the 10-year Treasury note fell to a record low as investors moved into safer assets. That Friday afternoon, the chair of the Federal Reserve, Jerome Powell, issued a short statement saying the Fed was monitoring developments and would act as appropriate.

On February 25, a senior official at the Centers for Disease Control and Prevention, the federal agency responsible for protecting public health, said publicly that community spread in the United States was expected. Community spread means the virus passing between people locally, including people who have not traveled and have no known contact with an infected person. It is the point at which tracing each case back to its source stops working. Businesses, schools and families, she said, should begin preparing for disruption.

The official was Dr. Nancy Messonnier, director of the CDC’s National Center for Immunization and Respiratory Diseases. She described the kinds of community measures that might be needed. For businesses, they included replacing in-person meetings with video or phone calls and expanding telework. For schools, they included splitting classes into smaller groups or moving to internet-based learning. For communities, they included postponing or cancelling large gatherings. Every one of those measures assumes buildings stay open while people stay away from them. That is the scenario most continuity plans had not been written for.

The next day, February 26, a case in California with no known travel history or contact with a known case was reported. That was exactly the pattern the official had described, suggesting the virus was already spreading locally.

The same day, the White House put Vice President Mike Pence in charge of the federal response. On February 28, the World Health Organization raised its assessment of the global risk to “very high”. On February 29, Washington State reported the first death from the virus in the United States, and officials began investigating an outbreak at a long-term care facility in Kirkland, near Seattle.

Inside many banks, health systems and government agencies, a familiar binder came off the shelf that week: the business continuity plan. A continuity plan is an organization’s playbook for keeping essential work going when something goes badly wrong. It says which activities must continue, who does them, where, and with what. Regulators in finance, healthcare and government expect these plans to exist and to be tested.

Many organizations began reviewing their pandemic and business continuity plans that week, often for the first time in years. What a lot of them found was a plan written for a different kind of emergency. The plans were good at dealing with the loss of a building. They were much weaker on the case that was about to matter, in which the building is fine but the people, the suppliers and the normal ways of working are not.

Most business continuity plans in regulated organizations were built around a familiar scenario. A building becomes unavailable because of fire, flood or power loss, and staff relocate or work from home for a few days. The plan’s job is to get people to another desk and the computers to another data center as quickly as possible.

A pandemic does not fit that model. It removes no building, yet it can remove a large share of the workforce, affect every supplier at the same moment and require the whole organization to work remotely for months.

The gap divides into four parts. Three are losses that plans rarely modeled: the loss of people, the loss of suppliers and the loss of the usual tools. The fourth explains why the gaps went unnoticed: how plans were tested.

What a continuity plan is, and the assumption hiding inside it

Every continuity plan rests on a picture of what might go wrong. That picture, often called a scenario, shapes everything else: which resources are protected, which backups are bought, which drills are run.

For decades the dominant picture was a damaged or inaccessible site. The response was to build redundancy in places: a second data center that can take over if the first fails, known as failover; a recovery office with spare desks; arrangements for staff to log in from home for a short period. These are sensible investments. They are also all answers to a “where” question.

Where the site assumption came from

Each regulated sector had its own continuity framework, and each mentioned pandemics somewhere. Broker-dealers must keep a business continuity plan under FINRA Rule 4370 and review it every year. The rule lists elements the plan must cover, including alternate locations for employees and the impact of a disruption on critical counterparties.

Banks and credit unions are examined against the FFIEC Business Continuity Management booklet, revised in November 2019. Hospitals and sixteen other provider types participating in Medicare and Medicaid follow the CMS emergency preparedness rule, issued in 2016. It requires an all-hazards risk assessment, an emergency plan, policies and procedures, a communication plan, and a training and testing program. HIPAA adds a separate contingency plan standard for electronic health information, covering backups, disaster recovery and emergency-mode operation.

Federal agencies plan under Federal Continuity Directive 1, issued in 2017, which centers on mission essential functions, alternate sites and devolution. Devolution means transferring those functions to staff in another location when the primary team cannot perform them. The Telework Enhancement Act of 2010 already required agencies to build telework into their continuity plans. State and local governments drew on FEMA’s continuity guidance for non-federal entities.

So the frameworks did not ignore pandemics. The gap lay in what organizations built and rehearsed under them. Alternate sites, failover and devolution are tangible, auditable and easy to test in a day. A plan for losing a third of a team for two months is harder to write, harder to test and produces nothing an auditor can photograph.

Recovery targets measured systems, not work

Continuity programs usually express their goals as recovery time objectives and recovery point objectives. The first is how quickly a system must be back. The second is how much recent data the organization can afford to lose. Both describe technology.

There was rarely an equivalent target for people: how many qualified staff a process needs, and for how long the organization can run below that number. Without that target, nobody measured the gap, and an unmeasured gap does not get a budget.

A pandemic asks “who” and “with what” instead. A restaurant shows the difference. A kitchen fire is a site problem: you send the staff to cook in the sister restaurant across town. A flu outbreak among the chefs is a people problem: you have both kitchens and nobody to cook in either. A plan built for the first will be of little help in the second.

A sound plan has to answer both kinds of question.

The loss of people

Site-based plans assume the staff are fine and the place is not. In a pandemic, the reverse is true. Absence comes from illness, caring responsibilities and school closures, and it is uneven.

A small team running a critical process can be badly depleted while the rest of the organization is largely unaffected. Examples include wire operations at a bank, the team that sends large-value electronic payments for customers; pharmacy informatics at a hospital, the specialists who maintain the systems that manage medication orders and dosing; and payment file transmission at an agency, the people who send the files that tell a bank to pay benefits or suppliers. If three of the four people in any of those teams are out at once, the organization can be in serious trouble even if every other employee is at work.

How absence actually arrives

Absence in an outbreak does not arrive evenly. It is correlated. People who share an office, a shift or a break room tend to be exposed together, so illness clusters inside the same teams. The teams hit hardest are often the ones that work most closely together, which are frequently the specialist teams with the fewest backups. Quarantine rules for close contacts remove healthy staff alongside sick ones. School closures remove parents of young children in a single day, and that group is not spread evenly across job types either.

The usual mitigation is to split teams into groups that never share space, sometimes called A and B teams. The trade-off is real. Splitting halves the exposure but also halves the capacity available on any given day. It adds handoffs between groups, and every handoff is a place where work can be dropped or done twice. Organizations that split teams needed written handoff routines and a shared log as well as two rosters.

Different organizations, different bottlenecks

The loss of people played out very differently by sector. In a health system, administrative staff could largely go home, but clinical work could not. The binding constraint was clinicians at the bedside, and the plan had to cover redeployment, emergency credentialing and the licensing flexibility that state and federal authorities later granted.

In a bank, branch staff and back-office operations faced different problems. Branches could reduce hours or move to drive-through service. Payment operations could not slip, because wires and payment files run against fixed daily cut-off times set by the payment systems themselves. A wire team that misses its window cannot catch up the next morning without consequences for customers.

In a public agency, the hard deadlines were often statutory. Benefit payments, court filings and tax processing run to dates set in law. Telework eligibility, duty stations and schedules may be governed by collective bargaining agreements, so changing who works where can involve labor relations as well as technology. A county may also depend on a small number of staff with specific legal authority, such as the power to sign certain orders, which cannot simply be delegated to whoever is available.

A simple measure of depth

One way to make depth visible is a bench ratio for each critical process: the number of people who have performed it recently, divided by the minimum needed to run it. A ratio of one means any absence stops the process or breaks its controls. A ratio of three means the team can lose a third of its people and keep going.

The number is crude, but it is cheap to collect, easy to compare across departments and hard to argue with. Reported quarterly, it shows leadership where cross-training money will buy the most resilience, and whether last year’s spending moved the ratio at all.

Thin staffing erodes separation of duties

When teams shrink, controls that rely on different people doing different steps come under strain. The person who enters a payment may also end up approving it, or the administrator who grants system access may also review it. Each of those shortcuts feels reasonable on the day. Together they remove the checks that catch errors and fraud.

A plan should therefore name, for each critical process, the minimum number of people needed to keep its controls intact, which may be higher than the number needed to do the work. Where that minimum cannot be met, the plan should say what compensating review applies and who performs it.

Plan around processes and named people

The planning unit therefore has to be the critical process and the named people who can perform it. For each process, a plan should record three things:

• the minimum number of qualified staff needed to keep it running;
• the people currently able to do the work;
• the backups who have actually performed it within the last year.

The word “actually” matters. A backup who attended a training session two years ago is not the same as one who ran the process last quarter. Where the list of qualified people is one or two names long, cross-training needs a budget line and a deadline.

Turn names into real capacity

Documentation completes the picture. Procedures written so that someone outside the team can follow them, and access rights granted to backups in advance, turn a list of names into real capacity. Access rights are the system permissions a person needs to do a job. A trained backup who cannot log in to the payments system on the day is not much use, and granting that access in a hurry, under pressure, is exactly when mistakes and control failures happen.

Plans should also say which tasks can be paused, so that scarce staff are spent on what matters. Deciding in advance that, for example, routine internal reports can stop for a month is much easier than making that call in the middle of a crisis.

Many organizations discovered that critical knowledge sat with one or two people because those people had never been unavailable at the same time. The risk stays invisible for as long as everyone remains available.

The loss of suppliers

Continuity plans usually assume that if one supplier fails, another can step in. A pandemic hits all suppliers together, including the alternates.

Offshore service centers faced their own lockdowns, sometimes with less notice than US operations. Call center vendors, managed service providers and hardware suppliers were stretched at the same moment, and laptops and webcams were scarce within weeks. A managed service provider is an outside firm that runs part of an organization’s technology on its behalf, such as its networks, servers or help desk.

What the offshore lockdowns looked like

The supplier shock arrived about a month after this week. On March 24, 2020, India announced a nationwide lockdown that took effect at midnight, with only a few hours’ notice. The main Philippine island of Luzon had entered an enhanced community quarantine a week earlier. Both countries host large service centers that run customer support, claims processing, software maintenance and back-office work for US banks, insurers, health systems and their vendors.

A practical obstacle surfaced at once. Many service contracts required that client data be handled only inside secure facilities, with controls such as clean desks, no phones on the floor and monitored access. Sending agents home broke those terms. Clients had to decide, often within days, whether to approve home working, accept degraded service or bring the work back. Each choice carried its own risk, and few had been considered in advance.

What to ask suppliers for

Generic continuity documents answer the wrong question. A more useful request asks each critical supplier for a small set of facts:

• the cities and countries where the people delivering each service work;
• which of those people can work from home, with the equipment and approvals already in place;
• which subcontractors support the service, and where their people work;
• the minimum service level the supplier commits to in a prolonged disruption;
• how and when the supplier will notify clients that service is degrading.

Answers to those questions can be compared across suppliers and refreshed each year, which a filed continuity plan cannot.

What the contracts actually said

Most supplier contracts addressed continuity in three ways, and each proved weaker than it looked. A clause requiring the supplier to maintain and test a continuity plan rarely gave the client a right to see test results or to judge whether the plan was adequate. A force majeure clause, which excuses performance when events beyond a party’s control intervene, could relieve the supplier of its obligations at exactly the moment the client needed them. Service level credits compensated for missed targets with small fee reductions that did nothing to restore service.

Stronger contracts specify what the supplier must do in a defined scenario: which services continue, at what minimum level, from where, and with how much notice to the client. They give the client the right to participate in or review tests. They also require notice when the supplier moves work to a new location or subcontractor. For banks, the federal banking agencies’ expectations for third-party risk management already pointed in this direction. For health systems, business associate agreements under HIPAA focus on protecting data and say little about continuity, so continuity terms have to be added separately.

Concentration that cannot be diversified away

Some dependencies have no practical alternate. A community bank usually has one core processor. A health system has one electronic health record platform. An agency may run its benefits system on a single vendor’s software. Switching providers takes months or years, so a second source cannot be held in reserve.

For those dependencies, the right question shifts from who else could do this to how the organization would operate while the provider is degraded. That means manual procedures, paper downtime forms in a hospital, and pre-written messages to customers and citizens. It also means knowing whether the provider’s own staff are concentrated in places that could close together.

Ask suppliers the right question

The practical question for each critical supplier is what it would do if its own staff could not reach their sites, and whether its plan depends on the same constrained resources as yours. If your plan relies on buying more laptops, and your supplier’s plan relies on buying more laptops, you are both competing for the same scarce stock.

Few organizations had asked, and fewer had contractual rights to an answer. Supplier continuity plans were often filed as documents rather than tested as commitments. A plan in a filing cabinet is a promise; a plan that has been exercised is evidence.

Look behind your suppliers

Fourth parties, the suppliers of a supplier, sat outside most programs entirely, even when a single offshore site supported several of an organization’s vendors at once. Three different vendors, each reviewed separately and each rated low risk, can all depend on the same service center in the same city. A local lockdown would hit all three at once.

Mapping where critical vendors’ people actually work, by city and country, shows correlations that vendor-by-vendor reviews miss. The output can be as simple as a map with pins on it. The value is in seeing the clusters.

The loss of the usual tools

Remote access in early 2020 was sized for a minority of staff working remotely on a given day. VPN concentrators, licenses for remote desktop and collaboration tools, and help desk capacity were all set for that assumption.

A short explanation of the technology helps. A VPN, or virtual private network, is a secure tunnel that lets a laptop at home connect to the office network as if it were plugged in at a desk. A VPN concentrator is the piece of equipment at the office end that all those tunnels pass through. It can handle only so much traffic at once. Software licenses work in a similar way: many tools are paid for per user, and an organization licensed for a few hundred remote users cannot simply switch on several thousand.

Moving most of the workforce home at once multiplied demand on each. The help desk, which normally fields a manageable stream of password resets and printer problems, suddenly faced thousands of people setting up at kitchen tables.

Capacity choices that were security choices

The quickest fixes for remote access capacity carried security trade-offs. Many VPNs were configured to send all of a remote user’s traffic back through the office, so that it passed the same security inspection as traffic from a desk. That full tunnel meant video calls and software updates also crowded the VPN. Split tunneling, which sends only corporate traffic through the tunnel and everything else directly to the internet, relieved the load but moved that traffic outside the organization’s monitoring.

The VPN appliances themselves were a target. Serious vulnerabilities in widely used remote access products from Pulse Secure and Citrix had been disclosed in 2019, and attackers were already exploiting unpatched devices. In March 2020 the federal Cybersecurity and Infrastructure Security Agency issued an alert on enterprise VPN security, urging organizations to patch, add multi-factor authentication and expect more phishing aimed at remote workers. An organization that expanded remote access quickly without patching first was widening the very door attackers were trying.

Each of these choices deserved a recorded decision: what was changed, the risk accepted, who accepted it and when it would be reviewed. Emergency changes made without that record tend to become permanent configuration nobody remembers choosing.

Work that does not travel

Some roles also depended on equipment or paper that could not easily leave the office: check scanners, secure printers, wet-ink signatures, and specialized clinical or case management workstations. A wet-ink signature is a physical signature on paper, still required for some documents and approvals.

For each, someone had to decide whether to redesign the process, move the equipment or keep a small on-site team, and what control changes each choice required. Moving a check scanner to an employee’s home, for example, raises questions about who else in the household might see customer checks and how scanned items are secured.

Workarounds that create new obligations

When the approved tools did not reach home, staff found their own. Personal email, consumer messaging apps and home printers filled gaps. In several regulated settings, those workarounds create obligations of their own. Broker-dealers must preserve business communications, whatever channel carries them. Health information sent by text or personal email is still protected health information under HIPAA. Agencies must keep federal and state records under records laws regardless of the device used.

The continuity plan is the right place to settle these questions in advance. It should say which channels are approved for which kinds of work, how records are captured, and what staff should do when the approved tool fails. Otherwise each employee decides, and the organization learns what they decided much later.

Make remote capacity part of the plan

Remote capacity therefore belongs in the continuity plan, with its own owner and test. That covers license headroom, network capacity, a supply of managed devices and clear policies for handling regulated data at home, including printing, disposal and the use of personal equipment. Managed devices are laptops and phones that the organization controls and can secure, update and wipe remotely, as opposed to an employee’s personal computer.

How plans were tested

Continuity tests are usually short and site-based: fail over a data center, relocate a team for a day. Neither kind of test would have revealed the three losses above. A test can only find the problems it is designed to look for.

What examiners and surveyors expect to see

Each sector’s overseers ask for evidence of testing, and the form differs. Bank examiners using the FFIEC booklet look for a testing program tied to the institution’s risk assessment, with results reported to the board and issues tracked to closure. FINRA expects broker-dealers to review and update their plans every year. Under the CMS emergency preparedness rule, providers must run exercises on a set schedule, with inpatient providers testing more often than outpatient ones, and must document what they learned.

Federal agencies run test, training and exercise programs under their continuity directives. Many public bodies use FEMA’s Homeland Security Exercise and Evaluation Program, which sets out a method for designing exercises, writing after-action reports and tracking improvement plans.

In every sector, the weak point tends to be the same. Exercises produce after-action findings, but the findings are not tracked to completion, so the same gaps appear in the next exercise. An improvement plan with owners, dates and a status reported to leadership is the evidence that a test changed something.

The guest list matters as much as the scenario. A people-loss exercise needs human resources, to speak to leave, pay and redeployment rules. It needs legal or compliance, to judge which controls may be adapted and how. It needs communications, and at least one critical supplier. An exercise run by the continuity team alone tends to confirm the continuity team’s assumptions.

A credible program tests at least one scenario each year that removes people rather than places, for weeks rather than days, across the supplier base as well as the organization.

The tabletop exercise

Such tests need not be elaborate. A tabletop exercise is a structured discussion in which the people responsible for a process talk through how they would respond to a scenario, step by step, around a table rather than in live systems. It is cheap, quick and surprisingly revealing.

A tabletop can ask each critical process owner who would do the work if the team were halved for a month, and which supplier they would call if the main provider stopped answering. Those two questions surface most of the gaps in an afternoon. The output should be a short list of single points of failure, each with an owner and a date. A single point of failure is any one person, system or supplier whose loss would stop a critical process on its own.

Test for weeks, not days

Tests should also run long enough to expose fatigue. Remote operations that work for two days can fail over six weeks, as overtime builds, informal workarounds harden into practice and supervisors lose sight of who is doing what.

A scenario that steps forward in time, asking what has changed after one week and after one month, catches those second-order effects that a single-day exercise never reaches. In a county benefits office, for instance, a day-one discussion might conclude that two staff can cover payment file transmission from home. Stepping forward a month raises different questions: are those two people now working every weekend, has anyone checked their work, and what happens when one of them falls ill too?

Was a pandemic even plannable

The strongest objection to this argument is that no organization can plan for every scenario. Continuity budgets are finite, and a plan for each specific cause, whether pandemic, hurricane, cyberattack or power failure, multiplies documents that nobody reads.

The objection is right about causes and wrong about effects. The number of ways an organization can lose capacity is small: it loses a place, its people, its suppliers or its tools. A plan built around those four losses covers many causes at once. A ransomware attack removes tools. A regional disaster can remove people and suppliers together. The pandemic exposed plans that had prepared well for one loss and barely at all for the other three.

There is a fair limit to the argument too. Planning for loss of people does not create people. Some constraints, such as the number of experienced specialists in a market, can only be eased slowly, through hiring and cross-training over years. A plan can reveal those constraints and prioritize around them, but it cannot remove them in a week.

Who pays when a critical process stops

An untested continuity plan is paid for by the people at the end of the process, by the examiners who review it and by the small teams who keep it running.

• Customers and citizens. When a critical process stops, the consequences land on people: payments that do not arrive, medications that are delayed, benefits that are late.
• Regulators. Banking, healthcare and government regulators expect organizations to keep essential services running and to show that their plans have been tested against realistic scenarios.
• Staff. Small expert teams carry the weight when backups are thin. Burnout in a critical team is an operational risk as well as a welfare concern.
• Cost. Cross-training, spare licenses and supplier testing cost money in calm times. Their absence costs far more in a crisis, when the same capacity must be bought in a hurry from a market everyone else is also buying from.
• Reputation. People remember which bank answered the phone, which hospital kept its pharmacy running and which agency paid on time when things were hard. Those memories outlast the crisis itself.

The cost line is the one most likely to lose an internal argument, so it is worth framing carefully. Spare licenses, cross-training time and supplier testing look like waste in any efficiency review, because in a normal year they are unused. The better comparison is with insurance. Organizations should decide how long each critical service can tolerate disruption, then fund the capacity needed to stay inside that tolerance. Spare capacity justified that way is a deliberate purchase, and can be defended as one when the next budget round comes.

There is also a governance point. A board that approves a continuity plan once a year, without asking what scenario it was built for, is approving an answer without knowing the question. The most useful thing a director can do is ask which kinds of disruption the plan has never been tested against, and whether management is comfortable with that list. In early 2020, for many organizations, a pandemic would have been near the top of it.

The resilient organization, and the shortcuts that fail

A resilient organization tends to have:

• a list of critical processes, each with a minimum staffing level and named, recently practiced backups;
• procedures that someone outside the team can follow, and access already granted to backups;
• a decision, made in advance, about which work can pause;
• a map of where critical suppliers and their own suppliers actually do their work;
• remote capacity treated as a planned resource with an owner, not an assumption;
• at least one yearly exercise that removes people for weeks, not buildings for a day.

The shortcuts that fail are familiar:

• Planning for places only. Investing in backup sites while leaving key processes dependent on a handful of individuals.
• Paper backups. Listing people as backups who have never actually done the work, or who lack access to the systems.
• Trusting supplier documents. Accepting a vendor’s continuity plan without asking how it would cope if its own staff were sent home.
• Testing the easy scenario. Running the same short data center failover every year because it reliably passes.
• Stopping at day one. Exercises that end before fatigue, workarounds and loss of oversight have had time to appear.

Testing the plan against the loss of people

1. What are our ten most critical processes, and how many qualified people can perform each one today?
2. Have our listed backups actually performed the work in the last year, and do they already have the system access to do it?
3. For each critical supplier, what would it do if its own staff could not reach their sites, and have we ever tested that?
4. How many staff could work remotely at the same moment before our remote access, licenses or help desk ran out of capacity?
5. When did we last test a scenario that removes people rather than a building, and for how long did it run?

The week of February 24 gave many organizations a short window to look at their plans with fresh eyes. The ones that asked “who” and “with what”, rather than only “where”, were better placed for what came next.

With hindsight

The window turned out to be very short. Within three weeks of this point, most office-based staff in banks, health system administration and government agencies were working from home.

The organizations that coped best were not necessarily those with the thickest continuity binders. They were the ones that had already invested in cloud-based collaboration, laptops rather than desktops and modern remote access. Cloud-based tools run on large providers’ infrastructure rather than inside an organization’s own building, so they could absorb a sudden jump in users far more easily. Laptops could simply go home with their owners; desktops tied to an office desk could not. By contrast, organizations relying on VPN capacity sized for a few found themselves rationing access and scrambling for equipment at the same time as everyone else.

One finding has held up especially well. Small specialist teams, rather than networks, were often the hardest constraint to relieve, because capacity could be bought and expertise could not. An organization could add network bandwidth or software licenses within days. It could not conjure up another experienced wire operator or pharmacy informatics specialist on short notice.

The workarounds left a long tail. As staff used personal phones and messaging apps to keep business moving, broker-dealers in particular lost track of communications they were required to preserve. From late 2021 the SEC and the Commodity Futures Trading Commission brought a long series of cases against financial firms for failing to keep such off-channel communications. Penalties ran well over a billion dollars in total, and many firms had to retrain staff and overhaul their monitoring. Not every lapse began in 2020, but remote work made the problem far larger and far harder to ignore.

Regulators have since broadened their expectations sector by sector. For hospitals, CMS, the Centers for Medicare & Medicaid Services, had added emerging infectious diseases to its all-hazards emergency preparedness guidance in February 2019. “All-hazards” means planning for a wide range of emergencies rather than one specific event. In March 2021 CMS expanded that guidance with pandemic considerations for staffing, surge capacity and supplies.

Bank supervisors moved toward operational resilience. Operational resilience shifts the focus from whether a system can be recovered to whether a service can keep reaching customers whatever goes wrong, which is much closer to the people-centered thinking the pandemic demanded. In March 2021 the Basel Committee on Banking Supervision published principles for operational resilience. UK regulators finalized rules the same month that required firms to identify their important business services and set tolerances for disruption. The European Union’s Digital Operational Resilience Act began to apply in January 2025.

Later events confirmed that the pandemic was one example of a wider pattern rather than a one-off. In February 2024 a ransomware attack on Change Healthcare, a major claims and payment processor, disrupted claims and pharmacy processing for providers across the country for weeks. Hospital buildings were intact and staff were at work, but a shared supplier was gone. In July 2024 a faulty CrowdStrike software update crashed Windows computers worldwide, which Microsoft estimated at about 8.5 million devices, disrupting hospitals, banks and emergency call centers. The usual tools were gone for hours or days while the buildings and people were fine.

Remote capacity itself became contested. Many organizations kept hybrid working after the emergency ended. In January 2025 a presidential memorandum directed federal agencies to return employees to in-person work. Whatever the merits of that policy, continuity planners should note one effect: remote access that is no longer used daily tends to lose capacity, licenses and practiced users. Organizations that reduce remote work, whether by policy or by habit, need to decide deliberately how much of that capability to keep warm for the next disruption.

Scenario-based, people-centric testing is now a more standard part of continuity programs, though many organizations still test the easy scenarios more often than the hard ones, which leaves the losses most likely to hurt them the least rehearsed.