Should monitoring run during a disaster or business continuity event?

Monitoring continues but with adjusted baselines and softened alerts. During a hurricane, pandemic, or office closure, the goal of monitoring shifts from productivity scoring to operational visibility — who has connectivity, what work is moving, where the team needs help. Performance reviews against monitoring data during a crisis is bad practice.

How does monitoring support business continuity planning?

Two ways. Before the event, baseline data reveals what normal looks like — a prerequisite for noticing what's broken during the event. During the event, real-time dashboards show which functions are still operating and which are not. After the event, the data documents what worked for the next BCP revision.

What happens when the office is suddenly all remote?

Modern monitoring agents work the same on remote devices as office devices. The transition is invisible to the data. The complication is policy — most monitoring announcements were written for hybrid scenarios, and a sudden 100 percent remote shift requires re-disclosure and updated retention rules.

What about access during a security incident?

Security incidents require the inverse pattern — tighter access logging, full activity capture, and longer retention on affected systems. Monitoring data becomes forensic evidence and incident response input. The data that's routine during normal operations becomes legally significant during an active incident.

Operations • May 21, 2026

Monitoring During Business Continuity & Disasters: A Playbook

Q: Should productivity targets stay the same during a crisis?

No. Crisis baselines should adjust to reflect reality. A team operating at 60 percent of normal capacity during a regional natural disaster has succeeded, not failed. Pre-crisis targets enforced during a crisis lose the team.

Hurricanes, regional power failures, pandemics, fires, floods, civil unrest, and the more mundane kind of "the building's flooded, work from home this week." Monitoring data is uniquely valuable during these events — and uniquely dangerous if misused. Here's how to do it right.

Monitoring during business continuity and disaster events is the practice of using workforce monitoring data to maintain operational visibility, support remote-everyone transitions, and document continuity for compliance — all while loosening performance enforcement during the period when employees are dealing with real-world disruption. The right posture during a crisis is fundamentally different from the right posture during normal operations.

Three Uses, Three Time Windows

Before the event — baseline data. A monitoring program running during normal operations produces the baseline that makes the disrupted state legible. Without baseline data, you don't know whether the team is at 40 percent of normal or 80 percent during the disruption.

During the event — operational visibility. Real-time dashboards show which functions are still operating, which are blocked, who has connectivity, and where capacity needs to redirect. This is the highest-value use of monitoring data — full stop.

After the event — BCP iteration. Post-event analysis of what worked and what didn't is the input to the next revision of the business continuity plan. The data captures things people don't remember three months later.

Crisis-Aware Baselines

The most important rule during any disaster or BCP event: productivity baselines adjust to the situation. A team operating at 60 percent of normal capacity during a regional natural disaster has succeeded, not failed.

Pre-crisis targets enforced during a crisis lose the team. Several lessons from the 2020-2024 pandemic-era monitoring deployments:

Companies that froze performance enforcement against monitoring data during disruption retained staff at higher rates
Companies that used pandemic-era monitoring data in subsequent performance reviews faced higher attrition and class-action exposure
Visibility-first framing ("are we okay?") outperformed enforcement-first framing ("are people working?") for both engagement and operational continuity

The Remote-Everyone Transition

When the office closes for any reason — natural disaster, public health, infrastructure failure — the workforce shifts to 100 percent remote within hours. Three monitoring implications:

Technical: modern monitoring agents work the same on remote devices as office devices. The transition is invisible to the data layer. Productivity monitoring on a laptop at someone's kitchen table captures the same signals it does on the same laptop at the office.

Policy: most monitoring announcements were written for a hybrid scenario. A sudden 100 percent remote shift requires re-disclosure and may require updated retention rules under regulations that treat home-network activity differently.

Network: employees on home internet may produce different data patterns — slower file access, more local-cached work, more disconnect-reconnect cycles. Alert thresholds should soften during the transition period.

What Operational Visibility Looks Like

The crisis dashboard most companies wish they had during an event includes:

Connectivity map: who's online, who's offline, last-seen timestamp per employee
Function coverage: which roles have someone available, which don't
Customer-facing channels: are support queues moving, are sales calls happening
Critical system access: are people getting to the systems they need

Most existing monitoring dashboards can be reconfigured into this view in under an hour — but it has to be done in advance, not during the event.

Security Incidents Are the Inverse Case

One category of disaster runs the opposite pattern: active security incidents. Where natural disasters call for softer monitoring, active breach or insider-threat incidents call for tighter monitoring.

During a security incident:

Activity capture rates increase on affected systems
Screenshot intervals shorten on involved employees
Retention extends from default to forensically-required windows
Access logs become legally significant evidence

See our companion guide on CISO insider threat monitoring for the security-incident pattern.

Compliance Reporting After Events

Regulated industries face post-event reporting obligations. Banking regulators ask whether trading desks remained operational. Healthcare regulators ask whether patient-data handling continued correctly. Cyber insurance carriers ask whether controls held.

Monitoring data documents the answer. Access logs, function coverage records, and operational continuity dashboards all become input to the post-event reports. Audit-grade monitoring records reduce post-event compliance work substantially.

A Monitoring-Enabled BCP

The BCP component that monitoring uniquely enables:

Baseline section: what normal operation looks like, by function, with current monitoring data
Visibility plan: which dashboards become the operating picture during an event
Threshold adjustments: what alerts soften, what alerts strengthen, what alerts disable entirely
Disclosure: what employees are told about monitoring during an event
Post-event review: what data is captured for the after-action report

Most BCPs lack the visibility section entirely. The ones that have it run smoother events.

The Ethical Posture

During a crisis, the ethics of monitoring become more demanding, not less. People are dealing with personal disruption — evacuations, family illness, property damage. The data they generate is dirtier and the human context is heavier.

Three guardrails worth committing to in writing before any event:

Monitoring data from crisis periods is excluded from performance reviews for 12 months
Activity from personal devices used as work fallback during an event is not collected
The crisis monitoring dashboard is available to the team, not just to management

What to Do This Week

Read your company's BCP and check whether it includes a visibility plan using your monitoring data. If it doesn't, draft one — three pages is enough. Then run a 30-minute tabletop exercise: pretend the office is unusable starting Monday. Can your monitoring dashboards tell you within an hour whether the company is operating? If not, fix that before the actual event.