Higher education laboratories: A disaster recovery and business continuity planning guide

Research and teaching are critical to the missions of all higher education institutions, whether the college or university itself conducts high levels of research activity (R1) or not. As a result, all colleges and universities maintain laboratories in furtherance of their respective missions. These labs are typically funded by some combination of government sources, private foundations, corporations in the private sector, internal university grants, professional associations and university donors.

University laboratories often comprise some of the most expensive and modern infrastructure on campus. Construction costs alone can run northward of $1,000 per square foot. For example, according to data from architectural firm Cushman & Wakefield, a BSL3 lab costs nearly $1,500 per square foot to construct.

Construction isn't the only expense. Labs incur higher costs than other buildings on campus because of the specialized systems they require, such as:

• Sophisticated research equipment
• Higher heating, ventilation and air conditioning (HVAC) equipment requirements
• Electrical systems to support increased power demand
• Specialized plumbing
• Biohazardous waste disposal receptacles and systems
• Corrosion- and chemical-resistant furniture

Between the breadth of types of work performed in laboratory settings and the inclusion of specialized systems, university labs require a unique approach to business continuity and disaster planning. The costs of operations, classes of materials involved and the unpredictable paths that research and experimentation can follow create environments where greater attention must be paid to both physical and digital infrastructure maintenance as well as safety for all students and personnel involved.

This guide is designed to help lab managers and principal investigators (PIs) fortify protections for personnel, equipment and research with best-practice strategies to develop customized business continuity plans that keep labs prepared for adverse events to minimize the impact of disruption. Beyond plan development, business continuity software stands out as a key tool for mitigating the risk of interruption, one that provides the flexibility, scalability and robustness required to secure lab data and support a unified approach to operational resilience.

Why university labs have more comprehensive business continuity needs

There are a few central reasons why developing both a BCM strategy and a codified business continuity plan (BCP) for higher education laboratories requires a more extensive approach.

University labs are highly infrastructure-dependent

Many university labs must remain open around the clock to successfully perform various experiments or research studies. To support this, they rely on uninterrupted access to many complex support services, including continuous climate control, special waste management, hazardous materials emergency response, utilities, transportation and delivery networks, core support facilities and IT systems.

The list of dependencies is long — but as any laboratory manager or PI will tell you, a breakdown in any one service can cause serious disruption to ongoing research, leading to irreparable damage to costly equipment, infrastructure and unique collections of samples and specimens derived under conditions that may be impossible to recreate, if at all.

Lab dependencies introduce business continuity risks

For university labs, the list of disruption risks is nearly as long as the list of dependencies. Departmental emergency response planning may already account for typical risks such as loss of electrical power, fire and flooding, but many labs likely haven't adequately factored in seemingly unrelated yet relevant threats like global supply-chain disruptions and the growing incidence of cyberattacks.

The latter poses a particularly significant threat to university labs. The average cost of a data breach in the higher education and training sector was $3.65 million in 2023. The mean time to identify a breach was 204 days and it took on average an additional 73 days to contain a breach, according to the Ponemon Institute's 2023 Cost of a Data Breach report.

Protecting the critical assets and invaluable intellectual property the modern university lab contains requires more than generic emergency response measures. It demands highly site-specific business continuity planning protocols.

College laboratory business continuity planning in a nutshell

A BCP is a set of actions and processes — laid out in a document — to help an organization maintain continuous operation during an unplanned disruption. The planning process helps the organization prepare for and recover from disruption, ensuring that critical functions are maintained or quickly resumed after an incident.

Business continuity planning involves five stages:

1. Conducting a risk assessment: This often involves performing a business impact analysis (BIA), a systematic identification and evaluation of both the dependencies that can potentially cause disruptions and the potential consequences of disruptions to critical business processes.
2. Designing recovery solutions: BIA findings help organizations understand vulnerabilities so they can develop strategies to control identified and evaluated risks.
3. Implementing the solutions: Once recovery solutions are identified, they are proactively operationalized to enable the organization to minimize downtime during normal operation and continue operating and recover quickly after a disruption.
4. Regularly testing the solutions: However, solutions must be rigorously and repeatedly tested to confirm their viability. The inputs that go into a contingency plan change over time, affecting the performance of the plan. Regular testing — at least once per year — is essential to keep recovery solutions current.
5. Communicating the solutions: Lab managers and principal investigators shouldn't be the only people involved in testing recovery solutions. All staff should be trained in preparedness measures and provided with appropriate documentation.

How to get started with lab business continuity planning

Business continuity planning can seem overwhelming at first, especially for facilities as complex as higher education laboratories. But like any logistically complicated process, all it takes is organization, diligence and consistency.

Gather basic business continuity planning resources

According to best practices, the first thing your college or university should do is to gather and assess your lab’s current business continuity and disaster preparedness resources in three easy steps:

1. Assemble a team of stakeholders: This team will help develop the business continuity plan and be your first point of contact when updates are needed or when the plan's contents need to be communicated to lab staff.
2. Compile current contact information: This goes for everyone who works in or supports the lab — not just employees, but students, postdoctoral researchers and support staff. This information may be available in the university directory, but you don't want to be searching for names and numbers during an emergency. Cloud-based business continuity software is a practical option for keeping your contact list current and accessible at all times.
3. Consult the university's emergency management department: These departments typically maintain detailed response plans for fire, flooding and severe weather events. It's also worth checking whether the broader department housing the lab has its own emergency plan, which can provide useful context as you develop your BCP.

Define the lab's essential functions

Part of the business continuity planning process involves defining the essential functions the laboratory performs. The goal of business continuity is to develop a system — a business continuity management system, or BCMS — for both the prevention of and effective recovery from potential threats that would inhibit essential functions.

In colleges and universities, each division or major administrative unit supports the overarching institutional mission: to create, preserve and disseminate knowledge. Business continuity planning focuses on these essential functions.

Examples of essential functions in the college and university setting include hiring, grant management, regulatory compliance, payroll and public safety. Within the laboratory itself, essential functions typically include continuous sample refrigeration, automated environmental monitoring, specialized waste neutralization and secure data backup.

With those examples in mind, consider which lab functions support the core mission of the university and identify the dependencies associated with each. Resources are finite, so business continuity planning is ultimately an exercise in prioritization. Assigning a priority level to each identified function is a useful way to structure that exercise:

For each function, note whether it is vital to lab operations and assign it a priority level using the definitions above.

Also consider the support functions the lab depends on and how critical each one is. Typical lab support functions include:

• Basic utility inputs: electricity, heating and cooling, potable water and sewage
• Telecommunications and IT
• Specialized utilities
• Procurement, transportation and receiving and delivery networks
• Material supplier operations
• Service and maintenance on sophisticated equipment
• Special waste management services
• Emergency response services

Conduct a risk assessment of the lab

Once essential functions are defined, the next step is conducting a risk assessment for all potential threats and their impacts on the lab.

Lab managers and principal investigators already have a working knowledge of hazardous agents, processes and equipment, as these categories of chemical, biological and physical hazards are typically identified for health and safety compliance purposes. In addition to these, the following also represent significant and escalating risks to critical lab functions:

• Power outages
• Network failures
• Third-party service provider outages
• Cybersecurity incidents, including data breaches
• Ransomware attacks
• Fires
• Flooding
• Software or hardware failures
• Unauthorized access
• Other threats attributable to human error

Consider a scenario in which a tornado devastates the surrounding campus. The lab may be unharmed, but students, faculty and support staff are unable to access it for several days. What would be needed to prevent a major disruption to research or the loss of valuable work?

That question highlights an important distinction in business continuity planning: preparing to (a) maintain active research and (b) preserve and protect equipment and research materials are related but separate planning challenges.

For each contingency, consider key staff resources, vital equipment and critical research material, using the questions below as YOUR guide.

For students, faculty and other researchers:

• Who has the experience, skills and authority to lead next steps in a crisis?
• Who elsewhere on campus will need to be contacted within the first few days to resume essential functions?
• Who in the wider community will need to be contacted within the first few days to resume essential functions?
• Which external vendors will need to be contacted?
• Are there other stakeholders who should be notified after a disruptive event?

For vital equipment:

• Do you have a complete equipment inventory, including key features, model numbers, costs, suppliers and supplier contact information?
• What are the key utility requirements for each piece of equipment?
• What would be the consequences of losing each piece of equipment, and which are truly vital to essential lab functions?
• Does each critical piece of equipment have backup emergency power?
• Do you have a contingency plan in place for each? When was each plan last tested and updated?
• Do you have duplicate copies of drawings, diagrams, plans or specifications for unique equipment in case reconstruction is needed?
• Do you have a contingency plan for loss of the HVAC system?

For vital research material:

• Does the lab have duplicate samples of novel compounds, specimens or other irreplaceable materials?
• Are irreplaceable specimens distributed across multiple sites?
• Have you identified alternate suppliers as backup to primary sources?
• Have you considered increasing inventory of critical supplies to reduce reliance on just-in-time procurement?
• How long of an interruption to critical supplies would cause irreparable damage to research?
• What are your procedures for data storage and management?
• What are your contingencies if lab notebooks or computers are lost or stolen?

Contingencies to plan for in the higher ed lab setting

Not every disruption can be anticipated. But planning for likely contingencies is both practical and achievable.

A fire at the lab is a foreseeable risk, and likely one for which you've already planned in collaboration with Campus Public Safety, Emergency Management and possibly the local fire department. Business continuity planning picks up where immediate crisis response leaves off, addressing contingencies such as:

• The lab is inaccessible for several days
• Available staff is significantly reduced
• The facility is destroyed

The same applies to other potential risks — such as a cyberattack, IT interruption or power outage — each of which raises a distinct set of questions whose answers form the basis of the business continuity plan:

• What is the mechanism for contacting staff and providing regular updates?
• Which activities can be conducted daily to limit the effects of the disruption?
• What is the current daily inventory of critical supplies?
• Is the lab responsible for the delivery of critical supplies?
• How can lab activities be scaled back while maintaining critical functions?
• Is staff cross-trained to perform activities outside their primary responsibilities?
• Have you considered relocating personnel and research to continue projects off-site?
• What plans exist today that would support reconstituting operations elsewhere if the facility were lost?

How business continuity software can help

Operational safety planning is a requirement for nearly every type of laboratory facility, but business continuity planning software may not yet be commonplace in these settings. However, given the complexity required to keep a modern lab adequately prepared for disruptions or damage, it should be.

Business continuity software streamlines and automates the planning process, facilitating engagement and collaboration across all stakeholders. When compared to managing a business continuity management system (BCMS) without a digital solution, manual processes are far more resource-intensive and inefficient. They also produce less effective products, as so much of contingency planning relies on input from others, meaning a lower level of engagement from stakeholders directly translates into the formation of a weaker plan.

Digital business continuity software supports the key workflows that make planning more manageable and outputs more effective, such as:

• Performing BIAs to determine critical business functions
• Conducting risk and impact assessments for critical functions
• Conducting after-action reviews and creating improvement actions
• Scheduling exercises and reporting on recovery strategy outcomes
• Reviewing procedures and implementing lessons learned from exercises and incidents
• Critical incident management, including reporting events, escalating based on severity, notifying essential staff and stakeholders and managing resolution to return to normal operations
• Dispatching incident response teams as per business continuity plans and procedures

However, not all business continuity software solutions are created equal. Many solutions available for the higher education space offer limited functionality, supporting only certain aspects of business continuity rather than the full lifecycle.

When evaluating options, look for business continuity management software that delivers:

• A unified resilience workspace that integrates all activities and data — BIAs, dependency mapping, exercises and recovery strategies — into a single source of truth
• Staff engagement tools that help personnel understand risks, the potential impact of disruptions and their roles and responsibilities within the continuity program
• Automated exercises that facilitate continuous improvement through lessons learned and insights to refine strategies over time
• Streamlined approvals and real-time notifications to enhance operational efficiency, improve coordination and reduce response times

Modern research and teaching labs represent multimillion-dollar investments by universities, donors, government agencies and the private sector. Yet both the infrastructure on which they depend and the intellectual property they generate face a growing range of threats.

A best-practice business continuity plan is the foundation for protecting personnel and assets and ensuring operations can resume quickly after an incident. Advanced business continuity solutions like Noggin give lab managers and principal investigators the tools to efficiently identify risks, design and test recovery strategies and provide stakeholders with confidence that their investments are protected.

The results are conclusive — your laboratory’s resilience posture only benefits from stronger business continuity planning. Request a demo to see how Noggin can help support your BCP program.