How to move from crisis response to crisis management

Governments and corporations face crisis events every day. An active shooter terrorises a campus. A cyber extortionist holds a city for ransom. A hurricane washes away a key manufacturing facility. Not all critical events rise to the level of these catastrophic emergencies, but a late or inadequate response to even a minor incident can put people, operations and reputations at risk.

Effective response plan

In 2015, for example, the City of Boston experienced several record-breaking snowstorms that forced the city to close the subway system for three days. The extreme decision cost the state $265 million per day and was largely attributed to a lack of preparation and an inadequate response plan by the transportation department. The reputation of the head of the transportation department was so damaged by the decision she was forced to resign.

Being able to better predict how the storms would impact the subway system’s aging infrastructure – and having a more effective response plan in place – could have saved the state hundreds of millions of dollars (not to mention the transit chief’s job). A comprehensive critical event management strategy begins before the impact of an event is felt and continues after the immediate crisis has ended. This full lifecycle strategy can be broken into four distinct phases – Assess, Locate, Act and Analyse.

Assessing threats for prevention

Security teams might have complained about not having enough intelligence data to make accurate predictionsIdentifying a threat before it reaches critical mass and understanding how it might impact vital assets is the most difficult challenge facing security professionals. In the past, security teams might have complained about not having enough intelligence data to make accurate predictions. Today, the exact opposite might be true – there is too much data!

With crime and incident data coming from law enforcement agencies, photos and videos coming from people on the front line, topics trending on social media and logistical information originating from internal systems it can be almost impossible to locate a real signal among all the noise and chatter. Being able to easily visualise all this intelligence data within the context of an organisation’s assets is vital to understand the relationship between threat data and the individuals or facilities in harm’s way.

Social media monitoring

Free tools like Google Maps or satellite imagery from organisations like AccuWeather, for example, can help understand how fast a storm is closing in on a manufacturing facility, or how close an active shooter is to a school. Their usefulness, however, is limited to a few event types and they provide only a very macro view of the crisis.Data from building access systems, wifi hotspots, corporate travel systems, among others, can be used to create a profile

Critical event management (CEM) platforms, however, are designed specifically to manage critical events of all types and provide much greater visibility. Internal and external data sources (weather, local and national emergency management, social media monitoring software, security cameras, etc.) are integrated into these platforms and their data is visualised on a threat map.

Security teams can quickly see if there are actual threats to the organisations or communities they are protecting and don’t lose time trying to make sense of intelligence reports. The more they can see on a ‘single pane of glass,’ the faster they can initiate the appropriate response.

Locating a threat

Once a threat has been deemed a critical event, the next step is to find the people who might be impacted – employees/residents in danger, first responders and key stakeholders (e.g., senior executives or elected officials who need status updates). Often, this requires someone on the security team to access an HR contact database and initiate a call tree to contact each person individually, in a specific hierarchical order.

This can be a time-consuming and opaque process. There is no information on the proximity of that person to the critical event, or if a person has skills such as CPR that could aid in the response.

Ensuring ahead of time that certifications, skill sets, or on-call availability is included with contact information can save valuable time in the middle of a crisis response. Going even further, data from building access systems, wifi hotspots, corporate travel systems, among others, can be used to create a profile of where a person just was and where he or she might be going in a CEM platform. This information can be visualised on the threat map and help determine who is actually in danger and who can respond the fastest. The emergency response then becomes targeted and more effective.

Security teams can quickly see if there are actual threats to the organisations or communities they are protecting

Acting and automating

The third step is to act and automate processes. If there is a tornado closing in on a town, for example, residents should not have to wait for manual intervention before a siren is activated or a message sent out.

Organisations can build and execute their standing operating procedures (SOPs) fully within a CEM platform. Sirens, alarms, digital signs and messages can all be automatically activated based on event type, severity and location. Using the tornado example, an integration with a weather forecasting service could trigger the command to issue a tornado warning for a specific community if it is in the path of the storm.

Summon security guards

Warning messages can be prepared in advance based on event type so there is no chance of issuing a misleading or unclear alert

Warning messages can be prepared in advance based on event type so there is no chance of issuing a misleading or unclear alert. All communications with impacted individuals can be centralised within the platform and automated based on SOP protocols. This also includes inbound communications from first responders and impacted individuals. An employee confronted by an assailant in a parking garage could initiate an SOS alert from his or her mobile phone that would automatically summon security guards to the scene.

Conference lines can also be instantly created to enable collaboration and speed response time. Additionally, escalation policies are automatically engaged if a protocol is broken. For example, during an IT outage, if the primary network engineer does not respond in two minutes, a designated backup is automatically summoned. Eliminating manual steps from SOPs reduces the chance for human error and increases the speed and effectiveness of critical event responses.

Analysis of a threat

Looking for ways to better prepare and respond to critical events will not only improve performance when similar events occur again

It’s not uncommon for security and response teams to think that a critical event is over once the immediate crisis has ended. After all, they are often the ones pushing themselves to exhaustion and sometimes risking life and limb to protect their neighbours, colleagues, community reputations and company brands. They need and deserve a rest. In the aftermath of a critical event, however, it’s important to review the effectiveness of the response and look for ways to drive improvements. Which tasks took too long? What resources were missing? How many times did people respond quickly?

With a CEM platform, team performance, operational response, benchmarking data and notification analysis are all captured within the system and are available in a configurable dashboard or in after-action reports for analysis. Continuously looking for ways to better prepare and respond to critical events will not only improve performance when similar events occur again, but it will also improve response effectiveness when unforeseen events strike.

Coordinate emergency response

Virtually every organisation has some form of response plan to triage a critical event and restore community order or business operations. While many of these plans are highly effective in providing a structure to command and coordinate emergency response, they are reactive in nature and don’t account for the full lifecycle of a critical event – Assess, Locate, Act and Analyse.

Whether it’s a large-scale regional emergency or a daily operational issue such as an IT outage, a comprehensive critical event management strategy will minimise the impact by improving visibility, collaboration and response.