Technology Infrastructure Credit: metamorworks/Shutterstock.com.
|

"WFH" ("work from home") has entered the lexicon in the wake of the COVID-19 pandemic as more organizations mandate remote work conditions for all or nearly all of their workforce. Despite the obvious challenges associated with WFH conditions, organizations with strong virtual technology infrastructure—including secure enterprise tools, videoconferencing capabilities, workforce collaboration tools and mobile applications—are best positioned to handle, without significant degradation in performance or compliance risk, the needs of a fully remote workforce.

There is no-one-size-fits-all approach to leveraging technology, as every organization has its own unique facts and circumstances. Understanding these elements is crucial in implementing mindful technology solutions to support a remote workforce. Below we outline a few best practices for navigating WFH considerations.

|

Infrastructure and User Access Metrics

A key first step is for the organization to understand how its remote workforce is accessing business applications in the WFH environment. Except for businesses that operated with a remote workforce pre-COVID-19, most organizations build technology infrastructure assuming that only a small portion of their workforce will access certain business applications remotely at the same time.

Not surprisingly, pricing for many cloud-hosted business applications is based upon the customer's expected number of simultaneous users, with defined allowances if the customer exceeds simultaneous user limits. These agreements can be problematic if the vendor imposes hard caps on usage in excess of contract limitations and require formal written amendment and/or prepayment of additional fees to increase usage. Larger businesses may have the option for their subscription fees for cloud-hosted applications to true-up at a later date if the business goes over the license metric, but smaller businesses often do not get the benefit of this true-up feature and thus can be exposed to unexpected subscription fee increases and/or face claims of copyright violations for unlicensed use.

To the extent licensure issues are identified in vendor agreements, the organization should consider proactively engaging vendors to avoid unexpected fee(s) and/or interference in performance. Further, consider asking vendors to waive incremental licensure costs for an agreed upon period and/or in exchange for extending the committed term of the contract.

Organizations who fail to proactive identify these types of limitations may find out the hard way that they cannot handle their entire workforce accessing their systems remotely. Proactive collection and analysis of data regarding application usage, time frames of peaks and valleys in usage, and which applications are generating the most user support/troubleshooting requests can help ensure that the organization is deploying resources in the most effective way. Organizations should also be mindful to ensure to have on-premise infrastructure necessary to support increased application usage, which may require running hybrid on-premise and hosted configuration for certain applications. It may also be beneficial to reallocate resources (both technical resources and IT support team members) from on-premise services to support remote users and/or modify IT operating controls to better enable emergent support issues with the WFH workforce.

|

Service Level Commitments

One key impact of the WFH environment involves the organization's relationships with its IT service providers. Current business conditions have created serious challenges for IT service providers. Potential non-performance by IT service providers can have significant consequences for service providers and customers, especially for service providers who are involved in securing customer data and business applications and for engagements that involve onsite personnel.

Most IT vendor agreements identify basic support and service level commitments, and may address application availability (i.e., 99.5% uptime) and technical support (i.e., critical support tickets worked within 1 hour of notification). To the extent an organization identifies performance issues with a particular IT vendor, proactive communication with the vendor should be prioritized, which may include seeking an increased allocation of the vendor's resources to meet individual business needs. For example, in the event current service level commitments are insufficient to meet anticipated user demand, the vendor may offer alternative service levels with nominal increased cost.

In addition, many IT vendor agreements provide for service level credits and/or termination rights in the event support and/or service level commitments are not met. Organizations that have contracts with IT service providers (and IT service providers themselves) should carefully review any force majeure type provisions in their contracts. Although force majeure provisions in IT vendor agreements may not specifically contemplate a global pandemic such as COVID-19, these provisions are often drafted broadly and based on events beyond a party's control, and may excuse non-performance under the agreement and/or allocate risks and costs differently when such an event occurs. If a business has concluded that it has solid legal ground upon which to seek service level credits and/or terminate an IT vendor agreement, now may be the time to pursue those remedies, if not move to a new solution or IT vendor altogether.

|

Cybersecurity

While issues in accessing technologies can impact the employee's ability to effectively and/or timely complete work-related tasks, potentially more concerning are issues related to employees transmitting, storing and/or accessing sensitive business files, trade secrets and personal data through insecure mechanisms, such as saving business files on personal devices. Loss and/or disclosure of this type of sensitive information could result in loss of competitive advantages, increased legal exposure for mishandling of third-party information, and create additional costs for the organization, so cybersecurity must be emphasized. Members of the organization's workforce can be made aware of cyber risks and provided training and guidance on technology that they are expected to use in the WFH environment, hopefully leading to better security practices in the future.

Now may also be a great time for organizations to conduct reviews of the information security and privacy practices of their vendors and confirm that vendors comply with organization policies and expectations. It is also worthwhile to reconsider best practices that to help maintain application security; many of these can be done easily through the settings function of the application. . Best practices can often be implemented through the settings function of the application, such as upgrading to the most recent version of the application; mandating strong passwords and/or leveraging single sign on functionality; and for videoconference technologies, moderating meetings and requiring all attendees to identify themselves at the beginning of a meeting.

|

Conclusions

An opportunity now exists for organizations and employees to come together to leverage existing and developing technologies to meet the needs of the WFH environment. Such efforts may include the following recommendations:

  • Understand application licensing metrics and compare against usage statistics, including proactive engagement with vendors to mitigate/avoid unexpected cost increases.
  • Redeploy resources (both technology and IT personnel) to reflect current needs.
  • Review SLAs with IT service providers and seek appropriate service level remedies.
  • Emphasize and train workforce on cybersecurity best practices.
  • Conduct application and vendor cybersecurity due diligence on an ongoing basis, and mitigate all known risks.

 

Tony S. Caldwell, an associate at Snell & Wilmer, LLP, focuses on commercial transactions and contracting matters, including issues related to sales, licensing, manufacturing, supply chain, data use, privacy and security, resellers, collaborations, mergers and acquisitions, and technology transfers. R. Lee Fraley is a partner at the firm, where he offers clients a unique blend of intellectual property counseling, IP rights enforcement and defense, and solution-focused negotiation of IP-related transactions and acquisitions. Special thanks to Snell & Wilmer's Chief Information Officer, Ken Orgeron, and Chief Privacy Officer, Maureen Babcock, for their input.