Cybersecurity Education, Research and Practice Cybersecurity Education, Contingency Planning Amidst a Pandemic Contingency Planning Amidst a Pandemic

Abstract Proper prior planning prevents pitifully poor performance: The purpose of this research is to address mitigation approaches - disaster recovery, contingency planning, and business continuity planning - and their benefits as they relate to university operations during a worldwide pandemic predicated by the novel coronavirus (COVID-19). The most relevant approach pertaining to the University’s needs and its response to the coronavirus pandemic will be determined and evaluated in detail.


INTRODUCTION
The purpose of this research is to address mitigation approaches -disaster recovery, contingency planning, and continuity planning -and their benefits as they relate to university operations during a worldwide pandemic predicated by the Novel Coronavirus . Components of a contingency plan will be discussed. A linear programming model will be created to quantify the value of a university's contingency plan as it seeks to mitigate risk from the spread of illness while focusing on meeting the academic needs of its students.

Incident
Faced with unprecedented challenges given the imminent onslaught of the Novel Coronavirus (COVID-19) global pandemic, many universities found themselves vastly unprepared to effectively respond to the multitude of challenges they faced when tasked to protect faculty, staff, and students from contracting the virus or spreading it at a time when little was known about its transmission and long-term effects on human health. During the course of a one-week period, students across the country found their email inboxes flooded with information from their respective university with a notice of a two-week campus closure, soon followed by a notice of the University's closure until further notice with an immediate need for all on-campus courses to be transitioned to remote location. Such an abrupt notice left some instructors and professors with the overwhelming responsibility to adapt their course work from a traditional classroom or blended approach to a strictly online delivery format.
Many instructors and professors were vastly unprepared for the challenge. Information and communications technology (ICT) and e-learning software programs soon became vital. Many remote-proctored testing platforms and their support staff alike became overwhelmed with the rapidly increasing number of users. One proctored testing platform in particular, Respondus Lockdown Browser, saw its demand in the number of proctored exams it supported increase more than ten times the rate as compared to the same time period of the previous year (Doffman, Z., 2020).
Due diligence should be taken to mitigate the risk of the faculty, staff, and students becoming infected with the Coronavirus. Various measures of due diligence include wearing a face covering, practicing social distancing by keeping a six foot distance from others, and encouraging frequent handwashing. Although draconian, the most effective way to avoid infecting others or to avoid being infected oneself is to stay home, avoid coming to campus, and to avoid going to one's office, as was the situation throughout March, April, and May 2020 when campuses closed to students and faculty alike. The approach is beneficial in the short-term, yet unsustainable in the long-term. Given the unprecedented impact of the Coronavirus pandemic, the University, a regional university located in the southeastern United States, acted swiftly to ensure the safety and health of their faculty, staff, and students.

MITIGATION APPROACHES
The following section outlines three mitigation approaches used when faced with a devastating event. The approaches include disaster recovery, contingency planning, and continuity planning. Each of the approaches will be discussed in detail and the most relevant approach pertaining to the University's needs and its response to the Coronavirus pandemic will be determined.

Disaster Recovery
Disaster recovery is a reactive strategy used to alleviate issues brought about by a catastrophe. The strategy's aim is to remove obstacles in an effort to urgently resume normal business operations. The events orchestrated by university officials in March 2020 were an immediate response to the pandemic's widely unknown and not readily understood risk, yet more importantly, its extraordinary threat. University officials engaged in disaster recovery as there was no contingency plan in place to implement given the unique and unknown impact of the Coronavirus.
Given the immediate onslaught of infection rate of the Coronavirus, organizations worldwide had to immediately respond to the novel virus in an unparalleled manner. Within a day of learning of the pandemic, email inboxes were flooded with notes from the management teams and CEOs of organizations ensuring their customers of the organization's stringent approach to guaranteeing the health and safety of their customers in addition to the organization's personnel as a result of their new safety measures. Such a response is one example of disaster recovery, with an aim to protect the company against residual effects of a significant negative event (Rouse, M., 2012).
Within the first week of the global pandemic, students were barraged with emails from the University. The initial email received during spring break in March 2020 was to inform students that campus would be closed for a two-week period in an effort to monitor the virus's progress and transmission among the general population. Subsequently, classes would be cancelled for the two-week period. It could also be postulated that the two-week period was to allow for an unofficial 14-day quarantine period of students returning from spring break as the Center for Disease Control (CDC) had recommended (When to Quarantine, 2020). Subsequent emails followed during the two-week period of campus closure advising students of health and safety measures and precautions to take as a means not only to protect themselves, but also to protect others.
Shortly before the two-week campus closure came to an end, students received an email from the University informing of the University's decision to continue campus closure for the remainder of the spring semester (Florida Department of Education, 2020). The University employed disaster recovery methods to ensure students would continue to receive a high quality education throughout the end of the spring semester. Effective immediately, all on-campus courses would be delivered by remote instruction via an already established online educational platform. The sudden change in instructional delivery method led to increased stress level and abrupt adaptation of coursework by some professors, particularly those not accustomed to offering online classes. Some assignments were removed completely from the students' course load because of the assignment's activity delivery and objectives not aligning with the online-only instruction method.
Students living in resident halls soon found themselves with an order to vacate immediately. Little notice, coupled with potentially limited funds to move, or optional housing outside of campus, made the element of leaving even more daunting. Students with no other living arrangement alternative could fill out an exemption form to be permitted on a case-by-case basis. Students with limited technology resources other than what had been provided by the University would be forced to find alternative means to allow them to continue their studies online in an off-campus environment.

Contingency Planning
Commonly referred to as "Plan B", a contingency plan is a proactive strategy which takes into account actions that would be undertaken should an unforeseen event occur. Steps to a successful contingency plan include identifying and prioritizing resources, determining key risks, drafting the contingency plan, sharing the plan, and revisiting the plan to ensure continuous relevance. A common argument for not creating a contingency plan is the lack of time managers have to allot to develop such a plan (Hughes, K., 2018, n.p.). One could argue that given the small probability that the plan would be used, it may not be necessary to have committed the time and resources toward establishing something that may never come to fruition; yet if a contingency plan were needed yet not established, it could cost the organization untold financial loss, if not bankruptcy, in the event of a catastrophe. In such a situation, the Girl Scout motto "Be prepared" comes to mind (Traditions, 2020, n.p.). The cost benefit analysis favors benefit given the financial ruin that could result if a plan were not in place to be acted upon in the event of an emergency. As one might say, it's better to have it and not need it, than to need it and not have it. This philosophy can prove useful to nearly all facets of business as in life.
According to a study performed by the Security Executive Council, the cost to an organization for every hour of downtime is anywhere from $51,000 to $1 million, depending on the industry segment (Correia, D., 2018). While the range is wide, the condition remains, no organization desires to lose money, especially from failing to be prepared.
The extra allocation of financial resources to be used toward additional Respondus Lockdown Browser and ITC licenses could be viewed as a waste of funds by some university officials. However, if the intention of the contingency planning initiative is to be prepared should an abrupt disruption in on-campus learning occur, universities will be better prepared to set forth their contingency plan into action without a lapse in critical timing to be used for students' education. Failure to do so would deprive a university's greatest resourceits students.
While a specific pandemic plan was not available the University has well developed and practiced plans to deal with natural disasters such as hurricanes. The contingency plan on closing the University would be implemented immediately after the decision to cancel on-campus learning were to occur. The plan would provide to all university faculty an effective and efficient guide to smoothly transition their on-campus course to a remote instruction format in addition to other critical undertakings to be addressed upon implementation of the plan.
The University having employed a disaster recovery plan immediately addressed the abrupt interruptions caused by the shutdown. The swift action taken by the University allowed faculty and students to limit their exposure risk while allowing students to complete the spring semester. The University employing a contingency plan is paramount to ensuring it maintains operational status without disruption during a crisis, such as the global Coronavirus pandemic. The old U.S. military adage of the Seven Ps comes to mind: Proper prior planning prevents pitifully poor performance (Brick, T., 2005).

Continuity Planning
Continuity planning identifies an organization's risk exposure and seeks to provide methods to mitigate any negative effects should a vulnerability be compromised. It answers the question "What if?" (Correia, D., 2018). Business continuity planning should be a strategy that the organization seeks to continuously improve upon to remove any known weaknesses. Doing so creates a strategic barrier to protect the organization from threat. The Security Executive Council (SEC) provides a Business Continuity Program (BCP) checklist which provides organizations with an outline to create a business continuity program or plan and to help organizations enhance their existing BCP. Components of the checklist include establishing a plan, assessment of the plan, preparedness to implement the plan, response to implement the plan, and recovery of any damages and records (Business Continuity Program [BCP] Checklist, 2017).
Purposes of establishing a continuity plan include if a catastrophe damages the integrity of an organization's image, operations, or physical structure. Continuity plans must be designed to ensure long-term operational objectives are carried out while the plan is concurrently supported by plans of action to maintain business operations are carried out despite any threats the organization may experience (Correia, D., 2018). For the purpose of this research, it has been established that the primary need of the University is to develop a contingency plan as the need especially relates to the Coronavirus.

CONTINGENCY PLANNING STRATEGY
The following section examines in detail the benefits of a simple linear programming model and its usefulness to help solve real-world problems. A linear programming model will be formulated to determine a contingency plan to safely reopen the University to students in the fall semester. The linear programming model will determine the number of students to attend classes via remote instruction versus the number of students to attend classes on campus while adhering to the social distancing requirement of students being seated six feet apart in an effort to maximize capacity of students per classroom.

Linear Programming Model
A linear programming model has been developed to analyze constraints, limitations, and requirements to provide an assessment of the University's needs. The model seeks to maximize the linear objective function to linear constraints with a goal of finding the optimal coefficient of each variable. If an optimal variable does not exist, two possible determinants will result: The problem shall either be determined to be unbounded with a minimum of -∞ (negative infinity), or the problem shall be determined to be infeasible where x does not satisfy all constraints (Shamir, R., 1992).

Proposition
A linear programming model has been designed to determine the number of students to attend the University's classes via remote instruction versus the number of students to attend classes on campus. The goal of the model is to determine if the University should reopen the campus in the fall. To determine if the decision would be economically viable, the model seeks to determine the number of students to attend remote instruction classes compared to the number of students to attend on-campus classes in an effort to maximize capacity of students per classroom. The model seeks to create a contingency plan that would prove to benefit the University. For the purpose of this study, best estimates were gathered while any discussions with key university personnel are fictitious. Figures used for the linear programming model were gathered from a variety of sources to determine the most accurate values. Where no figures were offered, estimates were established.

Model Components
After consulting with multiple senior staff members of the University, percentages of students to attend classes in the fall have been estimated. Senior staff members have taken into account student preference with the majority of cohort's preference to be attending class on campus. Despite the technologically savvy nature of most students, the overwhelming majority would prefer to attend classes in an on-campus setting. It has been determined that the estimated capacity of students to attend classes in the fall via remote instruction should be 20% of all enrolled students while the estimated capacity of students to attend classes in the fall via on-campus classes should be 80% of all enrolled students, all the while adhering to social distancing guidelines.
The director of the Student Health Services department in conjunction with the director of the Finance and Administration department both agree that each student should be issued one face mask free of charge. As of the time of this paper's writing, the University has 12,872 students currently enrolled Quick Stats, 2020. The data used in the linear programming model are rounded to the nearest whole value were needed. For example, the number of necessary face masks are rounded up to 13,000 because of the most economical offering provided by the manufacturer is issued by each 1,000-unit increments. Each lot of 1,000 triple layer university-logo face mask has a wholesale price of $2,500.
The director of the Information Technology department has determined that the University would need to invest in widespread use of a virtual testing and proctoring service at a cost of $39.60 per student per semester. The provided service is in an effort to allow for greater integrity measures to be taken while students take exams virtually in lieu of being proctored on campus. The cost per student was determined by the following computation. Each student is estimated to take four classes per semester x two exams per class x $4.95 virtual testing and proctoring service per exam. The IT director has estimated that $350,000 will need to be allotted for the service.
After further discussion with the director of the Information Technology department, it has been determined that more students using remote instruction technology could lead to a potential crash of the University's current servers due to the overwhelmingly increased demand. The director estimates that an additional $500,000 needs to be budgeted to allow for increased remote instruction technology. The funds would be used to purchase more servers and greater digital storage capacities.
University officials have been working to determine the best seating layout to accommodate the maximum capacity of students per classroom while adhering to the CDC's social distancing guidelines. University officials have calculated that a maximum number of available seats of all classrooms on campus at any one time is 26,950 seats. The was found using the following calculation. The campus has 77 classrooms available at any one time with an average of 35 seats per classroom. For any class being offered on a Monday/Wednesday or Tuesday/Thursday schedule, ten sections can be accommodated. The calculated total is then divided by two to account for a day's capacity instead of the entire week's (two day) total capacity.
Additionally, after consulting with the Facilities and Operations director, an additional $150,000 in the custodial budget will need to be allocated to increase sanitizing efforts throughout the campus upon students' return. The estimated cost was found by noting the need for 10 additional cleaning service personnel working full-time at 40 hours per week at a rate of $15 per hour. The additional cleaning service personnel would be hired on a temporarily basis because of the pandemic for the four months of the fall semester. The additional personnel may be needed in the following spring semester, but the need has yet to be determined. The total calculation is then divided by 6,500 which is half of the total number of enrolled students.

Case Framework
The following section provides in detail components of the values used in the linear programming model with a goal of determining a contingency plan to reopen the University in the fall. The model seeks to maximize the capacity of classroom seats available to allow for the most students to be offered on-campus classes. The greatest obstacle in achieving the maximum capacity is the University's strict adherence to the CDC's social distancing guideline of individuals need to remain six feet apart from one another.

Background
The University is a regional university located in the southeastern United States. It has developed a task force whose mission is to develop a contingency plan to safeguard the continued health and safety of its students, faculty, and staff while also ensuring the financial stability of the University. Members of the task force seek to determine the maximum number of classroom seats available to accommodate students attending on-campus classes at any one time while ensuring the seats are six feet apart per CDC guidelines. University officials have a goal of having only 20% of classes be offered via remote instruction. Officials understand students' desire to attend classes on campus, therefore, they have a substantial goal of offering 80% of classes on campus.

Resource Requirements
Following the recommendation of CDC guidelines, the University is requiring that all students wear a face covering while on campus, when in classrooms, in shared office spaces, and when social distancing is not possible. As a result, the University will be providing one face mask free of charge to every student. The estimated number of enrolled students for the Fall 2020 semester is 12,872. However, university officials suggest that 13,000 face masks be ordered to ensure extra face masks are available if needed.
Due to the increased number of exams being taken via remote instruction, students are taking exams without the presence of a proctor. Officials saw the need to use a virtual testing and proctoring service to assist students in maintaining integrity. At a cost of $39.60 per student, a budget of $350,000 has been allocated for the additional service.
As a result of more students being enrolled in virtual classes, an increased demand in servers and digital storage capacity has occurred. The IT director has seen several servers crash since the beginning of the pandemic due to the vast increase in use. The director has estimated that $500,000 be allocated to purchase 20 additional servers and digital storage.
University officials understand students' desire to attend on-campus classes. The majority of students have overwhelmingly expressed their frustration in not being able to attend on-campus classes as they believe that the classroom proves to be better for their educational process than attending classes remotely. Officials have estimated that each on-campus student will attend four classes per week while a maximum of 26,950 classroom seats has been calculated to be available at any one time to maximize capacity while also adhering to social distancing guidelines.
To accommodate the increased need to thoroughly clean and increase sanitizing efforts of all buildings on campus, additional cleaning service personnel will need to be hired. At a rate of $14.77 per hour, it is estimated that ten cleaning service personnel will be needed for the fall semester. The Facilities and Operations director has estimated an additional $150,000 will need to be allotted to accommodate the additional personnel.

Problem Statement
The University Coronavirus Task Force would like to have a simple linear programming model developed to determine the number of students to attend virtual classes and the number of students to attend on-campus classes in an effort to maximize capacity of classroom seats to accommodate students attending oncampus classes. The director of the Finance and Administration department want to ensure that all requirements produce positive results. 14.77X2 ≤ 150,000 Cleaning service requirement 7.

Findings
The above information was inputted into an Excel spreadsheet and assessed using Excel Solver to perform a what-if analysis. Running Solver provided outputs from which the following recommendations have been made. Table 1 provides the linear programming model with all requirements and resulting outputs.
Exactly 13,000 students were accounted for given university officials' request to round the enrolled number of students from 12,872 to 13,000. Although 13,000 face masks were budgeted, only 6,738 face masks will need to be ordered to ensure that every student attending on-campus classes will be issued one university-logo face mask. At a wholesale price of $2.50 per mask, the total cost of the 6,738 face masks required to provide one face mask to every student is $16,844. Despite an estimated expense of $350,000 being allotted for virtual testing and proctoring services, only $247,995 will be needed to fulfill the requirement. The $500,000 expense estimated for additional servers and other distance technology proved to be much greater than the $125,250 needed to fulfill the requirement. As estimated, exactly 26,950 classroom seats will ensure that all on-campus classes will be used to allow each classroom to be used at maximum capacity. Lastly, while $150,000 was estimated to be used to hire additional cleaning service personnel, only $99,513 is needed to fulfill the requirement.
The model proves that the 80/20 goal of 20% of students to take classes via remote instruction was too aggressive compared with the actual output of 6,263 students, 48%, who will actually be required to take classes via remote instruction. The model further proves that the goal of 80% of students to be permitted to have on-campus classes proved to be too aggressive. The actual output of the model indicates that only 6,738 students, 52%, will be permitted to attend on-campus classes. The 80/20 goal outputs result in 3,640 students, 28%, who will not be satisfied that virtual classes is their only option to attend the University in the fall.
It should be noted that the key determinant in the proposed contingency plan is the number of classroom seats available to accommodate the maximum capacity of students to attend on-campus classes. If the right-hand side value of the constraint, 26,950 seats, changes, the outputs of both the X1 and X2 variables change. Any right-hand side value less than 16,647 produces a model with an unfeasible solution. A right-hand side value of 16,647 will produce outputs for both the number of classes via remote instruction and the number of classes oncampus results in values that are close to being inverse from the goal of 20% and 80%, respectively. In an effort to further analyze the social distancing requirement, manipulations to the right-hand side value were made to determine the linear programming model's sensitivity to changes in the value. A table of various right-hand side value inputs with each value's respective X1 and X2 resulting outputs was created. The model was rerun varying the seats available between a range of 10,000 to 30,000 seats in increments of 5,000. The model produced outputs of 10,500 to 5,500 students to attend virtual classes via remote instruction. The same manipulations produced outputs of 2,500 to 7,500 students to attend on-campus classes. Figure 1 is a graphical depiction of the inputs of available classroom seats with the resulting outputs of the number of students to attend virtual classes and on-campus classes.

KEY TAKEAWAYS
The linear programming model has provided output values for each of the constraints with an objective function to maximize capacity of students to attend on-campus classes. The following information provides a summation of the model's findings.
After analyzing the outputs for each of the resource requirements, the contingency plan will cost the University $489,602. Although the cost may seem extensive, it is worth noting that the estimates gathered to prepare the budget totaled $1,313,000. In theory, the University will need to spend only 37.29% of its budgeted estimates, resulting in a projected cost savings of 62.71%, $823,398, of its initial calculations.
The cost components of the plan are as follows. Satisfying the requirement of each student to attend on-campus classes to be provided one face mask at no charge, 6,738 face masks are needed resulting in a total cost of $16,844. At a cost of $39.60 per student the virtual testing and proctoring service will cost the University $247,995 to provide services to the 6,263 students that will attend classes via remote instruction. In an effort to keep up with the increased technological demands imposed on university servers by students taking classes via remote instruction, the University will need to purchase 20 additional servers at an actual cost of $125,250. Lastly, to increase cleaning and sanitizing efforts of all building on campus once students return to attend on-campus classes, an additional ten cleaning service personnel will need to be hired at a total cost of $99,513 for the fall semester.
The key determinant of the linear programming model is the social distancing requirement. Changing other requirements does not have a strong bearing on the model's feasibility, yet by changing the social distancing requirement's right-hand side value either too small or too large will result in an infeasible solution while also drastically changing the resulting output values of the X1 and X2 decision variables. All other constraints do not have the same degree of sensitivity when changing their respective right-hand side values.
As previously noted, 28% of students will not be satisfied because they will not be permitted to attend on-campus classes due to seating limitations. One issue the University faces is how to improve the students' satisfaction to taking classes via remote instruction. One solution would be to provide students taking virtual classes with a simple and effective method, free of charge, to take virtually proctored exams. Providing the virtual testing proctoring service will allow such students with an easy and effective solution to take the exams while not adding an additional burden to students' expenses as most virtual proctoring services are costly and paid per use by students.
Another solution to improve the satisfaction of students taking virtual classes would be to increase the number of servers for student use. Doing so should help mitigate hindrances from slow university technological components which could allow for greater efficiency for students when taking classes via remote instruction. The increased server usage would help ensure students have ample digital storage solutions to store their academic work safely and effectively.

CONCLUSION
Taking action during an emergency such as the one brought about by the global Coronavirus pandemic has required organizations to attain one, if not all three, plan(s) of action: disaster recovery, contingency planning, and continuity planning. Each strategy is beneficial, yet having a contingency plan prepared before the need to implement arises could prove invaluable for the financial health and permanence of the organization. Using a linear programming model can assist contingency managers with determining the correct quantity of resources needed to optimize each resource's benefit. Despite the contingency plan's added cost to the University's budget, failing to have a plan could prove disastrous to the efficiency and effectiveness of university operations, while potentially losing students due to their dissatisfaction of the University's response to an emergency such as a pandemic.