What are the best practices for managing IT outsourcing vendors during a crisis?

One of my mentors said to me "Sha, make friends before you need them because when you need a friend it's usually too late to make a friend". To ensure good communication during a crisis you have to establish good relationships and channels with all your outsourcing partners before hand because during a crisis it's too late to try to establish them. Secondly, doing practice major incidents is really important to work out the kinks in the processes and communication channels. The worst time to figure out that you don't have the number for the critical person at a outsourcing partner is during a major incident. Training and repetition make a team unified and the processes smooth and effective.

Have crisis-specific Communication Protocols established before hand. For example, during a pandemic, you might have protocols for health and safety updates, while during a cyberattack, you may have protocols for data breach notifications. Establish clear escalation procedures in case issues cannot be resolved at the operational level. These procedures should include a hierarchy of contacts and a clear chain of command for addressing critical problems. Be flexible with the modes of communication and timelines, especially in cross-geographic situations. Also, encourage vendors to be transparent about their own crisis management plans and vulnerabilities.

Effective communication is the bedrock of managing relationships, especially in times of crisis, and while frequent communication is crucial, I'd also emphasize the importance of 'active listening'. It's not just about conveying your concerns but genuinely understanding the challenges your IT outsourcing vendors might face. Remember, they, too, could be grappling with similar crises so creating a collaborative environment allows both parties to brainstorm and innovate solutions. Always have a backup plan! Regularly reviewing and updating contingency plans with your vendors ensures a smoother navigation through unforeseen challenges. Mutual trust, partnership, and foresight can make all the difference during a crisis.

Very important point. Here it is needed flexibility from both parties (the suppliers and the customers) for a common goal. I would always recommend to review the SLA once a year so it provides the opportunity to make small changes and respond quickly to difficult situations that can occur

While SLAs are important, they should also allow for flexibility during crisis scenarios. Consider incorporating provisions that permit adjustments to SLAs, such as extended response times during a disaster or crisis. In times of crisis, it may also be necessary to increase the frequency of SLA reviews to closely monitor vendor performance and adapt to changing circumstances. And be aware of any legal or contractual obligations related to SLA reviews and adjustments. Ensure that any modifications to SLAs are documented and agreed upon by both parties in accordance with the contract.

One way to think about SLAs and contractual clauses before going live is to do a pre-mortem workshop. A pre-mortem workshop is one where people come up with ways in which there could be a crisis or a disaster. Once this exercise is done, we get a list of possible ways in which crisis can strike. This can be a good input to plan to put in place SLAs and contractual clauses to safe guard against these extremeties to some extent. One thing to note is that the stricter the SLA and the more severe the consequence to the Vendor, the higher will be the cost of the contract (price). There needs to be some pragmatism when designing the SLAs.

Consider different crisis situations, such as a pandemic, natural disaster, cyberattack, or supply chain disruption, and develop scenarios accordingly. For each high-priority risk, create specific risk scenarios. These scenarios should outline how the risk might unfold, its potential consequences, and its impact on your outsourced services. Then develop contingency plans tailored to each risk scenario. Contingency plans should outline a series of actionable steps and procedures to mitigate the impact of the risk and maintain essential services. Contingency plans may include details on resource allocation, communication protocols, alternative sourcing options, and disaster recovery strategies.

A good way to develop a good vendor relationship is to consider this a partnership and not a supplier-vendor relationship. It is the both parties best interest that the engagement and partnership succeeds. Establishing clear success goals for the partnership can bring increase trust and transparency to the relationship.

Seek feedback from both internal stakeholders within your organization and external customers or end-users who were impacted by the vendor's services during the crisis. Internal stakeholders can provide insights into how well the vendor supported your organization's needs, while customer feedback offers valuable perspectives on the user experience. Assess the overall performance vendors in terms of their ability to maintain service levels, respond to crises, and adapt to changing circumstances. Document the lessons learned from the crisis experience. It should include a detailed analysis of what went well and what didn't, as well as the root cause. Capture both positive and negative experiences to create a balanced view.