Picture a bustling Friday at your company’s headquarters. Hundreds of employees are working and there are many guests and vendors in the building. The company CEO is overseas on a business trip. The VP of Human Resources is on vacation. Several other senior-level executives are offsite visiting one of your regional operations. Then, a disaster strikes.
A hostage situation is unfolding in the lobby. Two dozen people are trapped and it is believed a few are hurt. As word spreads of the situation, chaos ensues, people run from the building. Media vans begin arriving in the parking lot. The situation needs to be controlled immediately. “Tell me what you are going to do, ” says the Security Team Manager. “What is the plan?”
Would you have an answer?
That is the focus of a table-top exercise designed to determine if your company is disaster-ready and how prepared your key personnel are to handle certain situations. This exercise allows for the troubleshooting of an emergency response plan and an opportunity to find flaws in the system. It may be likely that your security plan overlooks some pivotal key elements that should be included in your risk assessment and subsequent security plan.
To help, here are five key things to consider when practicing for disaster recovery:
What are the likely scenarios?
Pinkerton advises that in order to stay fully operational and profitable a company should never be caught off guard. Therefore, use the table-top exercise to cover a range of likely scenarios. “Do the research beforehand” advises Richard Gurley, Vice President of Pinkerton’s Global Response Services. “Evaluate which threats pose the greatest risks of doing damage to your company. Then, assess and prioritize the list to determine which should be addressed in the exercise.” Remember that not all threats become a risk to your company, so design a program tailored to the company’s specific needs.
What are the resources available and what resources will be most affected?
Resources are not infinite. As each scenario is investigated, consider the resources and the security team that manages them. In the event of natural disaster, for example, resources may be quickly exhausted due to widespread need in a particular region. Your datacenter could be affected, leaving many departments without access to critical information. Flag these resources and have a backup plan in place.
Additionally, evaluate whether your security team could potentially need further support and assistance. Identify and train additional employees who could fill in as extra support when needed for particular emergencies and make sure their training is kept up to date.
Who are the key contacts and their backups?
Does your team know who your experts are? The emergency planning table-top exercise will afford your team the opportunity to manage real-life scenarios. It will allow the team to learn to work together and identify arrears for improvement. It will allow you to identify both internal and external resources (subject matter experts) to support the team. A company should have a designated team, a written plan along with a predetermined leader/decision maker and alternate, who is charged with and following the emergency plan. Once alerted, the team should automatically know the next steps. The team leader should also automatically assume their role as determined in the response plan.
What is our media relations protocol?
It is likely that if a significant crisis were to occur, the press will get involved. Do you have designated spokesperson that is designated to address the media? Have they been through proper media training? Did you test them on the disaster communication plan? Where should security or others direct the media to assemble? In each particular scenario, how much information is advisable to tell the press? If not already in place, create a comprehensive media relations plan for when a major issue arises.
How are we monitoring for threats?
Lastly, use the time to set in motion a monitoring system. “Everyday something is going on, ” says Richard Gurley. “Who is gathering and assessing this information for your company and how often is it being conducted?”
Pinkerton can provide you with industry specific or custom tailored daily intelligence reports from a multitude of open sources. Pinkerton has a full-time business unit and staff dedicated for this purpose. Pertinent intelligence can allow a business to plan for/mitigate or manage potential risks. Pinkerton’s Global Incident Reporting is also a great option to streamline this process for efficiency and ease.
Overall, a table-top exercise focused on managing a disaster or event is an optimal time to identify gaps in safety and security that may be a risk to your company and employees. It will be an eye-opening experience for all involved to have a better understanding of process and procedure in light of a crisis. Pre-planning and management will ensure that if a serious situation were to occur all involved will be ready and informed to react accordingly. It is almost universal that participants provide positive feedback on the value of the training in preparing them for real events.
For more information on how Pinkerton can assist in evaluating risk please visit our Disaster Management & Response Services page on our website.
