Nothing like a Crisis to Fuel Innovation

Innovation is the positive response to crisis. We have three leaders this week who have taken what the world has supplied us and used it to strengthen their approach to their business. We find the core disciplines needed to thrive are still in place: leadership, organizational strength, a methodology for success, the resources needed to aggregate, manage, and communicate intelligence that will impact the business, and, finally, the rightsized technology to augment the human.  

Nick Weber, a strategic risk consultant, sits down with us and we end up on a journey that starts with the nature of work to the nature of work in security today. We walk away acknowledging that this is a road less travelled.  

We had just come off a call with Dr. Rob McKenna speaking about work life balance on his weekly, free leadership series. For Nick, work life balance is probably not an accurate term. He sees work as tied to purpose and passion and, therefore, as more of a river. A river is not linear.  You ride the river allowing it to take you, but not control you.  

We also talked about the unique problems with our critical infrastructure as well as a surprising way of seeing how our dysfunction may have strengthened our resilience.  

I asked Nick to treat me as a client and ask me the questions he would ask in his first meeting. They were questions designed to measure my program as well as my leadership. I think you will appreciate the approach.  

Kip Boyle, the CEO of Cyber Risk Opportunities, runs a virtual CISO for business leaders who need leadership and advice in protecting their companies. Seasoned decision makers that are held back by a threat or a perceived lack of discipline that is constraining their business but cannot afford a full-time leader or a team, turn to Kip for “fractional” ownership over the cyber risk.

We are seeing the idea of renting a CSO or CISO is becoming more urgent given the state of risk, the breadth of knowledge and resources needed to manage it, and the evolving landscape of technology. Like any business decision, it is multi-dimensional. He lists three examples of this in our conversation.

“A lot of decision makers have not caught on to the fact that cyber was once seen as obscure” said Kip. “Cyber is now a bonafide business risk, not just a technology issue. It should be a peer risk with operational line of businesses and disciplines that can threaten the viability and long-term prospects of the business.”

Kip terms this a management opportunity in his new book: Fire Doesn’t Innovate: The Executive’s Practical Guide to Thriving in the Face of Evolving Cyber Risks featured on our resource page.

Robert Dodge is the President of Corporate Risk Services at one of the largest security companies in the world; G4S. I wanted to pick his brain on how G4S is innovating in this rapidly changing world. What I discovered is an organization that can meet you where you are and rapidly shift to downsizing or scaling for growth to meet demand. Robert talks a lot about agility. And he has architected his services to meet the speed of a changing business climate.

One of the key pillars of the current and future strategy for growth is the Risk Operations Center (ROC). I was able to tour this in February before The Great Conversation in Palm Beach, Florida. This center contains predictive and proactive intelligence, executive protection, and real time command and control.

This fully leverages the 600,000 security professionals on the ground by marrying this “human sensor” with fully automated intelligence and monitoring. Robert called it “Intelligence-led Risk Management”. He has effectively converged the silos of excellence that have been architected over the last 65 years.

All three of our conversations pointed to a reimagination of leadership, and for Kip and Robert, the business model of security. Change is a constant. Risks are not going away. We need to invest in hiring and training for mindset,  be it a vendor or an employee.

Enjoy the conversations. And remember, membership is free. The price for leveraging the knowledge: priceless.

A Framework for Evaluating Your Emergency Plans and Preparations

By Christopher Stitt

The emergency management cycle is made up of four major parts: Mitigate, Prepare, Respond, and Recover.  Emergency management for entities with wide-spread, particularly multinational operations present unique challenges.  Ultimately, the goal of emergency management is to minimize the impact on operations, respond effectively and recover efficiently so the organization can get back to its core functions.

Other than facing a crisis, how can you evaluate your plans and preparations to see if they have a good chance of success when it comes time to respond and recover?  Having a solid template that is adapted to your industry is a good start, but each operating location will have its own unique variables that are going to impact the plan.  To ensure maximum effectiveness, it is critical that the plans and preparations are viable, accurate, and usable for each operating location.

What do I mean by a viable plan?  Unfortunately, the plan designed for Ottawa will likely not work in Ouagadougou, nor will the plan for Chicago work in Calcutta. Plans for production facilities will differ greatly from administrative or public-facing operating sites.  There are myriad factors that come into play when trying to put together a viable plan for a given location.  Some of these include variations on the size, structure, and operations of the location, local laws and effectiveness of local response services, and even variances in construction and fire codes.  Another major factor is the make-up of the staff: pre-defined roles and action items will need to be adjusted to fit the specific location being evaluated.  The working groups that develop the plans for their location need to be encouraged to evaluate and incorporate these factors into their planning and preparations, not just accept the template as adequate.

Each city in the world is going to have variables that need to be accounted for and there will likely be variables you would never think to consider.  It’s always useful to reach out to the local emergency management services, organizations like the International Association of Emergency Managers (www.iaem.org), other companies working in the same environment, or the embassy(s) of the countries in which your company is headquartered to get some ideas of the variables to consider. 

What do I mean by an accurate plan? The shelf-life of the information in your plan and the equipment used to implement it is limited.  Without a regular refreshment, the plan’s viability is again at risk. Contacts need to be regularly reviewed and updated.  Here are some example questions to be answered:

• Has the operating location itself changed, such as increasing or reducing in size or staff, or a change in operations that needs to be accounted for? 

• What about the incorporation of new technology into the worksite, such as upgraded cameras, alarms, or communications?

• Are there any changes in the local environment, such as a fire department that gets new trucks that are now too big to access your location, or an increase in civil unrest or terrorist threat?

• Emergency preparations need to be refreshed as well. 

  • Do the people you trained to take specific actions still work at this location? 

  • Do they need some refresher training?

  • Are the supplies expired?

Finally, plans and preparations need to be usable.  Having a huge binder, or even a small flipchart, that no one ever looks at is not a usable plan. Too often, plans become bloated with too much information and preparations that rely on high-tech solutions that may fail when needed most.  Keeping it simple is important.  While the overall plan may appear complicated and dense, ensuring it is structured by phase of the planned-for emergency with role-based checklists allows for key information to be extracted in a shorter, more useable form for each employee.  While not restricting knowledge of the whole plan from anyone, the key is to help employees focus on their part.  Regular communication of this is also key, so that employees are familiar with immediate, potentially life-saving, actions that can be taken if needed.

Keeping supplies accessible and ensuring people know how to use them is critical. Instead of locking up emergency supplies so they are not pilfered, tamper-evident seals or other controls may be a better idea.   Make sure to offer regular refreshers on how to operate emergency equipment such as fire extinguishers, satellite phones, or automatic defibrillators, and specialized equipment unique to your business or industry.

Ultimately, no matter how good the overall template is, no template can account for the uniqueness of each operating location in a global setting.  With a focus on getting local working groups to adjust the template to focus on creating viable, accurate, and usable plans and preparations the chances of a successful response and recovery can be dramatically increased.

Christopher Stitt has spent more than two decades in international security, emergency management, and law enforcement with the Federal Government. He is also Adjunct Faculty at George Mason University and is credentialed as a Certified Emergency Manager by the International Association of Emergency Managers.

His specialties include: Emergency management; multi-jurisdictional crisis management; enterprise-wide crisis management policy development; program development and management; strategic planning; risk analysis and mitigation strategies; policy and procedure development; technology/policy/process integration; criminal, personnel, internal, and counterintelligence investigations; and dignitary protection.