Over the past two years, public health authorities have been warning that a pandemic of avian flu, commonly known as “bird flu,” is a real possibility. Because pandemics are fundamentally different from the types of disasters commonly envisioned in business continuity plans, most IT organizations do not have adequate preparedness for this threat.
This Research Byte is a summary of our report, IT Preparedness for an Avian Flu Pandemic, which outlines the ways in which pandemics are different from other types of natural disasters. It also lays out three planning scenarios and suggests specific actions that IT risk managers should consider to prepare for a potential pandemic of bird flu.
Background on the Threat
A pandemic is an epidemic affecting a wide geographical area and a large proportion of the population. The trigger for a pandemic is human-to-human transmission of a contagious disease. In the case of avian flu, the 200 human infections as of May 1, 2006 have been the result of contact with infected birds. However, public health officials fear that if the primary virus that causes avian flu (H5N1) mutates into a form that can spread between humans, a pandemic will begin. At the time of this writing there is a single case in Indonesia that may involve spread of the disease between eight family members, seven of whom have died, but it is too soon to tell whether human transmission is involved.
An influenza pandemic could have a major impact on business and society as a whole. The Spanish influenza pandemic in 1918 infected approximately 20-40% of the worldwide population, with over 50 million deaths worldwide and over 675,000 in the U.S. between September 1918 and April 1919. Due to the availability of vaccines, the Asian flu pandemic of 1957 had less of an impact than the 1918 event, although over 69,000 people in the U.S. died. There have been several lesser influenza pandemics since then.
The World Health Organization in its planning scenarios for an avian flu pandemic uses what it calls a “relatively conservative estimate” of between two million to 7.4 million deaths worldwide.
Currently there is no commercially available vaccine to protect humans against avian flu, although vaccine development efforts are underway. Even when a vaccine is available, supplies may not be adequate to inoculate all of the population in affected areas. Therefore, the major strategies to combat an outbreak are early identification and treatment of those infected, and limiting public contact to avoid the spread of the disease. These measures include quarantines and limits on public transportation and congregation in infected areas—all of which will be disruptive to normal business operations.
Pandemics Present Special Challenges for IT Risk Managers
Most large organizations and many smaller ones have comprehensive business continuity plans that provide contingency plans in the event of natural or man-made disasters, such as hurricanes, floods, earthquakes, or long-term power outages. In recent years, risk managers have refined those plans to take into account additional issues surrounding general or targeted terrorist attacks.
Although most business continuity plans do a good job of planning for these types of disasters, they are generally not adequate to deal with the entirely different type of threat that is posed by a pandemic. Figure 1 illustrates the primary differences between the threat of a natural disaster and the threat of a pandemic.
Our full report, IT Preparedness for an Avian Flu Pandemic, analyzes in detail each of the characteristics in Figure 1 and their implications for business continuity planning. It also outlines the ways in which pandemics are different from other types of natural disasters. It also lays out three planning scenarios and suggests specific actions that IT risk managers should consider to prepare for a potential pandemic.
The increased awareness of the possibility of a pandemic through media coverage of the avian flu should lead IT management to better understand the differences in its effect on the business and on IT versus other types of business interruptions. Depending on the size and type of the business, its geographic distribution, and personnel intensity, these effects may be amplified or reduced.
While we may hope there will be no pandemic, many of the recommendations in the full report will be worthwhile whether or not a pandemic takes place. The actions needed to prepare for a pandemic will make the business continuation plan more robust and better able to respond to a variety of threats.
June, 2006
This Research Byte is a summary of our article, IT Preparedness for an Avian Flu Pandemic, which can be purchased from at the following link: https://avasant.com/report/it-preparedness-for-an-avian-flu-pandemic-2006/