It is certainly not the case that I think there should be no procedural documentation, or even detailed documentation, as long as it is in the right place and appropriate to the people requiring it. That said, i think the default approach to any implementation of crisis, incident or disaster recovery plans leads to a vast amount of needless writing. Having been involved in a programme to simply document what a particular team does with over thirty documents being created from scratch I can testify to the futility of that approach. Hence I propose the two tier approach to writing these plans up.
Tier two documentation is that which is required by the functional team; in the case of disaster recovery it is the detailed documentation of how to fail over applications and services. With crisis management it may be evacuations plans, roles and responsibilities of fire wardens, and with incident management it might be an escalation and first fix path of procedures. This is important, because in many of these cases the people involved in the ground are often in twenty four hour shift patterns and early in their career, or even volunteers (fire wardens etc.), and through no implicit fault of their own have less incentive to fully memorise or become proficient in activities that might never happen on their shift. They need to have a reference document, a thing they can refer to when their pulse is pounding and their heart pumping in the middle of a crisis. I should know, I was that soldier in my first job out of university!
However, there is a group of people that simply can’t be told to have documentation available to hand when the time comes, or even to memorise the roles and responsibilities; the senior leadership who actually make many of the critical decisions during a crisis. What is required here is ability to Communicate and Collaborate very quickly (optimally within just a few minutes of the crisis being recognised), and then have the capabilities at hand to establish rigourous Command & Control. This approach applied to most organisations (except perhaps the behemoths like IBM or TCS where different segments of the organisation could operate like this where the input of most if not all of the C level execs is required
These execs need to be involved in crisis no matter what the subject because what they are good at is synthesizing information from a variety of sources and being able to make decisions quickly, effectively and in the best interests of the company and its people.
Some pre-requisites to this approach though:
- A recognised approach to define the severity of a crisis prior to declaration.
- A mechanism of simultaneously contacting multiple people through redundant channels in a matter of seconds of a crisis being declared.
- A series of very simple yet effective steps for the crisis team to follow.
- The ability to manage a “crisis room” either real or virtual at no notice.
- The recognition that a crisis is by its very nature flexible, and therefore understanding you will not know all the facts from the outset (the “fog of war” effect).
I will investigate this in more detail in a later article, but for the time being, the main question anyone should ask themselves when prparing crisi plans is “how can i simplify this further?”.
These two YouTube videos show just how common the potential for private or sensitive data, intellectual property or even identity theft is when people are working in environments they feel comfortable and “secure” in.
I see this all the time in airport lounges and trains every time I travel, and it beggars belief that people do not realise quite how vulnerable they are. If your laptop is stolen in a situation like this, it is very likely that even if it is encrypted it won’t matter as the thief will have the laptop after the boot time password has been entered.
How many millions of whatever currency you work in could your company be culpable for, and for what? An employee who doesn’t have the common sense to make sure they don’t leave their laptop vulnerable.
Of course, it is actually quite easy to steal a laptop from almost literally under your nose as the second video shows (It gets interesting at about 1:40). At least in this case encryption might actually help!
Traditionally, incident management might incorporate disaster recovery and business continuity planning each with a set of detailed plans that should (but don’t always) have clear hand-offs between them. Over a series of articles I will be discussing my take on this traditional approach in addition to putting forward a more flexible, albeit perhaps more risky, approach.
For now though, it struck me how many ex-pats and business people became reliant upon their own governments to help evacuate them from the danger areas, especially Libya. The newspapers were filled with “the British Government left us to die” stories. These workers, more often than not on lucrative contracts because of the risky locations they were in appeared to be, in my opinion, abandoned by the companies they worked for. These individuals were not expressing their anger towards their employer though; why not? In fact, what exactly can a foreign worker expect from their government compared to their employer.
To make this worse it is not as if there are not a number of organisations (International SOS is just one example) out there specialising in providing evacuation services, including in “hot spots”, and providing medical and professional advice.
In my experience, these organisations provide very clear guidance under these circumstances; “stand by”, “evacuate immediately” etc.. Why are companies not using them when trouble strikes rather than just leaving their employees to fend for themselves? My employer has been at the sharp end of this on a couple of occasions and very successfully swung into action and deployed services to ensure the safe transport of our people from war zones.
If companies operating in these hot spots ignore this advice and continue operations then governments should be able to subsequently recoup the vast costs from them for evacuating their personnel. If these companies do not even have these services in place, or even a crisis plan of sorts, they are committing a very serious dereliction of duty to their employees, no matter how much they are paying them.
And where in all this, is someone’s personal accountability for their own safety?