MissionMode Corporate Blog

Business Continuity, not data breaches, among top concerns for tech firms

Through research based on SEC filing, Joan Goodchild has discovered that data security and breach prevention rank fairly low as a risk factor for most big technical firms.  This research examined the risk factors listed in the FY 2009 10-K SEC filings of the largest 100 US public technology companies.

Among security risk, natural disasters, wars, conflicts and terrorist attacks were identified by 55% of respondents as a risk concern and #16 on the list and much higher than breaches of technology security, privacy and theft, which was cited by 44% of the companies, making it 23rd on the list.

This was a surprising result since it had been thought that data security and breach prevention were the focus of risk management; but rather business continuity seems to be driving the majority of worries about natural disasters and conflicts risks.

Aftab Jamil, leader of the Technology Practice at BDO Seidman, the consulting firm that released this research, expresses this concern, "Can they get back on their feet relatively quickly?  If you are in the path of a hurricane or an oil pill, can you keep your business going?"

For more details on this business risk and crisis management research, read the full business continuity article.

www.missionmode.com

Flunking crisis management

As reported in JoongAng Daily, the statement, "The first rule in corporate risk management is thata those at the top are in charge.  Entrepreneurs are warned not to take the backseat and let the chief risk officer take command at times of crisis," proves to be true over and over.

An example of this rule is when then-CEO of Johnson and Johnson, James Burke, quickly responded with sincerity and urgency to the company's crisis when seven people died after bottle of Tylenol were found to be laced with cyanide. Their disaster recovery was successful with this approach.

An ineffective response by Exxon Chairman Lawrence Rawl to a company tanker's spill of millions of gallons of oil off the shores of Alaska proved shatter the company's image.

The second rule mentioned in this article is that risk management is all about honesty.  Again, Exxon broke this rule when they tried to dodge responsibility by finger-pointing at coastal guards and public officials.  Countering this approach, Ashland Oil in 1988 took full responsibility when one of their oil tanks collapsed and sent millions of gallons of diesel into the Ohio river.  This response afforded the company forgiveness and praise for a cool-headed management team.

Read the full crisis management article...

www.missionmode.com

How a Crisis Management Team Works

In an article on the website Security Beyond Borders, author Francisco Mateo begins with a good quote:

 The Chinese use two brush strokes to write the word ‘crisis.’ One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger – but recognize the opportunity 

-John F. Kennedy

Mateo also emphasizes that there are ideal factors that have to be in place for an ideal crisis management team to exist.  Those factors would be:

• Crisis Preparedness
• Crisis Management
• Post Crisis & Post Mortem

To begin with, the strategy has to be formulated with clear and distinct elements where the "guiding star" for the organization needs to be crisis prevention.  Especially important is the all-encompassing nature of this strategy.  That is, a holistic approach should cover all the bases from R&D to the very end of the company's supply chain.

The next step involves the company's communication strategy and is perhaps the greatest area of weakness when a communication plan is not in full force and effect.  According to Mateo, the first step for the crisis team is to "gain influence over the message communicated to the general public regarding the event..."  How this message will be delivered can include everything from the standard media approach to the new social media opportunities.

There are several other important points related to formulating a good crisis management team and implementing the corporate strategy under pressure.  He concludes by saying that how the team performs during a crisis event is commensurate with the quality of training done prior to the crisis. 

Read the full article...

www.missionmode.com

Why emergency managers need to answer the call to be terror-ready

Jim Rush posted to Big Medicine about how the need for us to become a true readiness culture is so important.  Some of the forces at work that prevent this readiness include:

• Refusal to accept reality - Many in positions of leadership hold to the belief that this terrorism phenomenon is limited in both size and scope.  Rush states, "Catastrophic events are listed int he Federal Planning Scenarios for planning activities at the state, local and federal levels, but there is little evidence that there could be an effective response and recovery for any catastrophic event.  There seems to be good progress int he prevention of large scale disasters, but almost no capabilities for 'consequence management.'  A National Healthcare Capabilities Plan to manage hundreds of thousands of casualties and millions of affected human being has yet to be developed."
• Prejudice - There seems to be a prejudgement that people who would engage in terrorism are just thugs and that any deviation from this pre-determined image would be people who are influenced by thugs.  Rather, Rush suggests that "We have pre-judged that terrorists are criminals and not soldiers in a war against us."  We are also taking precautions based on what happened in the past and not taking steps to thwart the next attack.
• Need for normalcy - Rush indicates that, in general, society will shifts from a very high level of anxiety about security and well-being and then right back to complacency.  Not indicating that people are stupid but rather the need for normalcy is so great that vigilance is released.
• Optimistic Bias - Too many emergency workers show a tendency to resist maintaining vigilance and "somewhere deep in their psyche" these professionals -- even in the face of the Hazard Vulnerability Assessment (HVA) depicting catastrophic events -- think of the planning for those events as optional.

Finally, Rush asks these questions:  Would a crisis planner or emergency manager be guilty of dereliction of duty if they chose to ignore a horrific HVA planning scenario?  Do we have to wait for a catastrophe to occur before we define dereliction of duty?

Read the full article...

www.missionmode.com

Supply Chain Security Threats: 5 Game-Changing Forces | The Industry Standard

As any CSO knows, it's not enough to mind your own business. You have to look after your business partners as well, across all links that connect to your supply chain--whether that chain is physical or virtual. And that goes double in times of rapid change and high stress.

When a company experiences a crisis, they need to quick identify and assess the situation and bi-directional communication between the crisis managers and the event itself.  It is important to review your corporate crisis plans for gaps in the plans and operations before you are in the middle of a crisis that could impact your business continuity adversely.  It is important that the corporate crisis plans address more than the key supply chain nodes and specific scenarios but also emerging security vulnerabilities.

Read more...via www.thestandard.com

www.missionmode.com

Emergency operations planning vs disaster planning

The Critical Incident Management blog has posted an article about the difference between emergency operations planning and emergency preparedness in the healthcare industry.  In fact, many corporations outside of the health care industry have the same misunderstanding of the difference.

The fact is that developing an emergency operations plan (EOP) is simply one component of an effective emergency management program to insure preparedness. In the healthcare industry, there are two different scenarios that must be addressed: 1) the organization serves as response agency or 2) the organization must prepare the instance where they are a victim of the incident.  The EOP must address both of these circumstances.

The EOP is a concept document that can be thought of as a leadership guidebook to manage the consequences of a disaster that delineates what response operations and functions will be performed or achieved by what department, agency, or organization and under what circumstances.  The EOP is not a detailed reference document to be used as a standard operating procedures manual by response personnel during a crisis.

There are 15 basic issues that are important when developing the healthcare EOP:

• Notification - an emergency notification system that alerts the existence of the disaster and continues to inform throughout the management of the crisis.
• Decontamination - Who, where and how the decontamination will occur.
• Facility physical protection - in addition to the actual victims, expect asymptomatic, possibly exposed individuals, to also present for care.
• Evacuation - must be prepared to rapidly evacuate, identifying the transportation sources and receiving facilities.
• Shelter-in-place - if there is no time to evacuate, existing facility must be prepared to manage the load.
• Detection - usually the weakest link in emergency management and response, several methods of observation must be available.
• Identification - Detection is different from identification; identification determines the response path.
• Triage - standard triage methods will have to be modified if the entire community is affected.
• Treatment options - depending on the health risk being addressed, the options will vary
• Surge capacity - measures that allow increasing capacity if needed.
• Prophylaxis - who will be the recipient of actions to prevent or address disease.
• Fatality management - resource management (facilities, personnel, etc.) for mass-fatality internment procedures
• Counseling services - responders and employees, as well as victims, will need counseling assistance, maybe even more so than other medical needs.
• Horizontal and vertical integration - integrating health services with other local or regional response organizations.
• Law enforcement and incident forensics - from identifying criminal acts to maintaining chain of custody, law enforcement will be involved throughout all phases.

For the full article, read more...

www.missionmode.com
www.missionmodefastresponse.com

The value of crisis communication

Since the economic crisis began to impact the world economy, many businesses have enhanced and expanded their crisis communication strategies with the hope of alleviating the fears expressed by workers and to project corporate confidence to clients and shareholders.

In late 2008, consulting firm Watson Wyatt reported that survey results indicated 77% of employers had nor were planing to send out internal communication addressing the impact of the financial crisis. Sixty-nine percent of those businesses stated that reducing employee anxiety was one of their top two goals for crisis communication and 32% are attempting to capture employee trust.

The Institute for Public Relations states that crisis can come in the form of these three threats that are often related:

• Public safety risks
• Financial losses
• Damage to a reputation

This article makes further recommendations for emergency planning, targeting the following areas:

• Employees - explain how the crisis will affect their jobs
• Management - provide all the information managers need to protect the interest of the company, employees, clients and vendors
• Public - tell the public how the company is managing business affairs during the crisis and how it may affect the community
• Customers - to avoid damaging relationships, let customers know how products and services will be delivered during the crisis
• Government - in case it is necessary to interface with governmental agencies determine if assistance might be needed to continue business activities
• Other companies - it may be necessary to communicate with other businesses to inform them how the crisis may impact their business as well.

For more information, read the full article.

www.missionmode.com

Welcome to the MissionMode blog

We want to make sure you have the best, first-hand knowledge of crisis management, incident management and emergency notification news. We welcome any comments or feedback that you may have.

Don't let the crisis take control of your business. Take control of the crisis with Missionmode.

www.missionmode.com

Omniflight Helicopters selects MissionMode Solutions

Omniflight Helicopters Inc., a leading national provider of air medical services, has chosen MissionMode Solutions as its virtual command center and alert notification platform for both daily operations as well as for crisis management, incident management and emergency notification.

Omniflight recognized that MissionMode is able to enhance their communications functions and the delivery of emergency-related information to those in need within their operations.  "MissionMode's solutions both reduce our ongoing operational costs as well as strengthen our service provision."  Read the full story...

www.missionmode.com

Unconventional Cooperation

The September 2009 issue of Security Management has a cover story on Event Management about how Denver established a public-private partnership through which business, government and private-security entities could work together during the Democratic National Convention (DNC).

In a remarkably well-planned coalition effort, the Denver Police Department, businesses in the private sector and several security company worked together to support the city's emergency operations center (EOC).  Communication links were set up using an emergency notification system developed by MissionMode.

With the help of the Department of Homeland Security, preparation began with training with various courses for the private-sector security managers.  The training was thorough and included the fundamentals of security methods taking place both in the classroom and at the potential on-site targets for problems during the convention.

The Colorado Emergency Preparedness Partnership (CEPP) was established in the spring of 2008.  The biggest issue recognized by CEPP was the gap between what businesses would do and what the public-safely sector would do during the DNC.  It was during a DNC tabletop exercise that this lack of communication became painfully obvious.  Fortunately, Robert Edson, MissionMode Solutions' vice president for the western US, was in the audience and was able to step in with the perfect solution using their customizable web-based information-sharing and crisis management tools.

The result was the Business Emergency Operations Center (BEOC), a secure, virtual, invitation-based online forum where all participants in the security activities would receive instant alerts from the EOC and be able to respond with appropriate feedback, keeping everyone fully informed.

Conclusions and challenges

The biggest challenge was the coordination of communication between the two sectors, the police department and the private sector security businesses.  The major communications hurdle between the public-private partnership was overcome quickly through the arrangement between the CEPP and MissionMode.  In addition, the partnership reached out to the DHS to provide the necessary training to the private-sector security officers at no cost to the participants.

The result of this well-planned crisis preparedness effort was a resounding success during the DNC.  The BEOC is still activated from time to time for events such as wildfires, responding to the swine flu and during major civic events.  The program has a large membership of business and security partners in the Denver metro area.

As successful as this operation was, the challenge facing Denver now is maintaining a level of preparedness once the convention was over.  "The most challenging aspect is just getting people involved when there's not a major situation that's doing down," says Lt. Rob Rock of the Denver Police Department.  People just "want these systems to run in the background" until they're needed, he notes.  Read the full article.

www.missionmode.com