Work Area Recovery: Keeping Staff Working Through Disruption

Work area recovery is the part of business continuity that gives your people somewhere to work when your office cannot be used. Among business continuity services in Malaysia, it is the one that deals with staff rather than systems. A disaster recovery plan can bring your applications back, but the teams who use them still need desks, phones and a secure network to carry on.

This guide covers when you need it, dedicated and shared seats, what a recovery site should provide, and how to invoke and test it, with a checklist you can use to assess any provider.

What Work Area Recovery Is

Work area recovery, also called workplace recovery, is a pre-arranged and equipped office at a separate location where named staff relocate when their usual premises are unavailable. It normally covers workstations, connectivity, telephony, printing and a connection to your own systems.

It sits alongside disaster recovery rather than inside it. Disaster recovery restores IT systems and data. Work area recovery restores the place people work from. Our guide to how backup, disaster recovery and business continuity differ sets out where each one starts and stops. Most continuity plans need both, often invoked together.

When an Organisation Needs Work Area Recovery

Work area recovery covers disruptions where the office is unusable or unreachable, even if your systems are unaffected:

1. Flooding: Flash floods can close access roads, so staff may be unable to reach an office that is itself dry.
2. Utility failure: An extended power or network outage at the building, beyond what its own backup supply covers.
3. Building incidents: Fire, a structural fault, a gas leak, or a police or Bomba cordon that closes the premises or the surrounding area.
4. Contamination: An incident that closes the office for cleaning before staff can return.

To decide whether you need it, take each critical function from your business impact analysis and ask what happens if the people who run it cannot use the building for a day, a week and a month. Where the answer depends on working from controlled premises, that function is a candidate for work area recovery.

Why home working does not always replace it

Remote working covers many roles during a disruption. Some functions still need a controlled office:

• Work that your own security policy, a regulator or a client contract restricts to controlled premises.
• Roles that depend on specialised equipment, such as multi-screen dealing desks, recorded lines, contact centre telephony, secure printers or document scanners.
• Teams that need to work in one room during an incident, such as the crisis management team.
• Disruptions that reach staff homes as well as the office. A regional flood or power outage can cut home connectivity and road access on the same day.

Dedicated vs Shared Work Area Recovery Seats

Whether your seats are dedicated or shared decides how certain you can be that a seat is there when you call for it.

Dedicated seats are reserved for one organisation. They can be set up in advance with your builds, extensions and printers, and are available on invocation without competing with anyone else.

Shared seats come from a pool that several subscribers can draw on, under the provider’s allocation rules. The main risk is a regional event: a flood or outage that affects your office may affect other subscribers on the same day, and they may invoke at the same time. Before relying on shared seats, ask how many subscribers share the pool, how many seats can be claimed at once, whether allocation is guaranteed or first come, first served, and how long you can occupy the seats once invoked.

Many organisations combine the two: dedicated seats for the functions that must restart first, and shared seats for the teams that follow.

How Work Area Recovery Fits Into Business Continuity Services in Malaysia

Work area recovery is one continuity strategy among several, and it is sized from the business impact analysis rather than from headcount. For each function that needs on-site staff, set three things:

1. Minimum staff: The smallest team that can deliver the function at an acceptable level.
2. Build-up over time: How many seats the function needs on the first day, after the first few days, and if the disruption runs for weeks.
3. Seat type: Dedicated or shared, decided by how quickly the function’s recovery time objective requires it to be working again.

Bank Negara Malaysia’s policy document on Business Continuity Management, issued on 19 December 2022, requires the financial institutions it covers to establish an alternate site and a recovery site that can be used if their premises, infrastructure or systems supporting critical business functions become unavailable. The Securities Commission Malaysia’s Guiding Principles on Business Continuity cover recovery strategies, communications, and testing for capital market entities.

What a Work Area Recovery Site Should Provide

Use these points to assess a provider’s site or your own second office.

1. Location: Far enough from your office that the same flood, outage or cordon is unlikely to affect both, and reachable by staff. Ask what alternative exists if the recovery site is affected.
2. Workstations and equipment: Desks, PCs or thin clients that can run your applications, plus the screens, headsets, printers and scanners the assigned roles need.
3. Connectivity: Network links to your production or disaster recovery systems, internet access through more than one carrier, and secure access to your applications.
4. Telephony: The ability to redirect your published numbers and contact centre lines to the recovery site.
5. Physical security: Controlled entry, visitor records and CCTV, so sensitive work continues to the standard your own office applies.
6. Power: Backup power so the site keeps operating if the grid supply fails.
7. Facilities: A room for the crisis management team, rest areas, and operating hours that match your functions, including round-the-clock access if you run shifts.
8. On-site support: Technical staff who can help set up seats and resolve problems during an invocation.

How to Invoke Work Area Recovery

Write each step of an invocation into your continuity plan before it is needed.

1. Declare: A named person with the authority to invoke, and a deputy for out-of-hours incidents, contacts the provider through its agreed invocation procedure.
2. Notify: Relocating staff are told where to go and when, through a call tree or a notification system that records who has acknowledged.
3. Travel and access: Staff carry identification, and the provider already holds your list of authorised personnel, so entry is not delayed at the door.
4. Set up: Your IT team or the provider’s support staff confirm that applications, phones and printers work before the full team arrives.
5. Operate and review: Issues are logged as they arise, and the crisis management team decides when to return to the office or extend the stay.

How to Include Work Area Recovery in Business Continuity Testing

Three tests cover a work area recovery arrangement, in increasing order of realism:

1. Notification test: Send the relocation call-out to the staff on the list and measure how many acknowledge, and how quickly.
2. Seat activation test: Your IT team attends the recovery site, brings up the configured seats, and confirms application access, phone redirection and printing.
3. Relocation exercise: Staff from a critical function travel to the site and work a full business day from it, on live or simulated work.

Measure the time from declaration to the first productive seat, and record every failure with an owner and a retest date. Test at least once a year, and again after any change to the relocating staff, your systems or the recovery site.

Work Area Recovery Checklist

• Critical functions that need on-site staff identified from the business impact analysis
• Minimum seats per function agreed, with the build-up over days and weeks
• Seat type chosen for each function: dedicated or shared
• For shared seats: number of subscribers per pool, allocation rules and maximum occupation period confirmed
• Home working assessed and ruled out for functions that need controlled premises
• Recovery site located away from your office, reachable by staff, with an alternative if it is affected
• Workstations, screens and peripherals matched to the assigned roles
• Network links to production or disaster recovery systems tested from the site
• Published numbers and contact centre lines able to be redirected
• Physical security and access control at the standard your own office applies
• Backup power, operating hours and on-site support that fit your functions
• Named authority to invoke, with an out-of-hours deputy
• Staff notification method that records acknowledgements
• Authorised staff list lodged with the provider and kept current
• Notification test, seat activation test and relocation exercise scheduled at least annually
• Test results, owners and retest dates recorded

Where We Fit

At Strateq, we have provided data centre and business continuity services since 1989, and we are one of Malaysia’s pioneer data centre providers. We provide more than 300 business continuity seats, available as dedicated or shared work area recovery, so seat type can be matched to each function’s recovery objective.

Our business continuity consulting covers business impact analysis, business continuity plan (BCP) strategy and development, and BCP testing and maintenance, carried out by CBCP-certified consultants. That work sets how many seats you need, which functions take them first, and whether the arrangement holds up in a test.

For the notification step, our SMART SMS service is a web-based system for sending SMS messages to your staff before a recovery exercise or when a disaster is declared, with tracking of who has responded. Use the checklist above to review your current arrangement, and read our framework guide to business continuity planning in Malaysia for the planning stages that come before it.