I’ve attended a number of great workshops, webinars, and other events this year that address this growing topic of interest for all businesses and organizations. We’ve all grown too accustomed (and possibly desensitized) to the news story about another data breach by a Fortune 500 company or other large organization. We know that cybersecurity is a significant risk for each one of us. We hear about great solutions and services in the marketplace to address this risk. But how many of us are more focused on preparation, monitoring, and risk mitigation than on actual response? If so many of the largest companies in the world have responded to their own data breach in spite of their complex and multi-layered defenses, it’s just a matter of time until the rest of us are faced with this crisis. We need to plan for a cyber response just as much as we need to prepare for, implement, and monitor our cybersecurity defenses.
Cybersecurity is not just an IT issue
Many organizations that we’ve engaged with relegate the topic of cybersecurity to the IT department alone. The reality is that during a cyber incident, it quickly becomes “all hands on deck” for all departments. If a cyber incident took place at your organization, how many of the following departmental issues would need to be addressed?
- Legal – contractual, legal, and regulatory issues associated with response actions and communications to customers, media, and regulators
- Finance – coordination of insurance policies and claims, approval and payment of unbudgeted and costly response and remediation expenses, resulting in adjustments to financial forecasts and budgets
- HR – managing internal communications to employees, what they can say, what they can’t say, and addressing all sorts of questions and concerns while trying to keep top talent from fleeing
- Customer Service – fielding much higher than usual call volumes from customers about social media rumors, actual news stories, and other reports about the incident impacting their services or data
- Sales – devising strategies and messages to respond to prospect’s concerns over the incident and how it will affect their decision to buy your services or products
- Marketing/PR – managing communications and strategic messaging on social media, in the press, and preparing executives for interviews
There are other departments that could be impacted as well, and that’s before we even consider the impact to the IT department trying to troubleshoot, respond, and resolve the root cause of the cyber incident.
Planning for a Coordinated Response – Tabletop Exercises
A good cyber incident or data breach response plan should include the coordination of activities, communications, and information among all of the departments listed above. The challenge that we all face is – how do we get them all on the same page to even begin writing a plan? The answer is simply a tabletop exercise.
I have facilitated dozens of tabletop exercises this year covering a broad range of topics and scenarios, and cybersecurity is quickly becoming the most popular topic. In my experience there is no better or more effective way to bring everyone together to understand their role and to define their responsibilities that will be required during a cyber incident.
An effective cyber incident tabletop exercise should include the following elements:
The right participants – make sure you include the right representatives from each department that will have a role to play during an actual incident. While the above list of departments is a good starting point, consider other departments that may have a role to play in operations or other areas of your organization. Certainly include the required IT representatives, but make sure the other departments have the right people at the table.
The right time – set aside enough time for an effective exercise. In my experience, that’s a minimum of 3 hours and should be 4 – 6 hours. It sounds like a lot of time but if done correctly it will be highly engaging and valuable. People should leave with a clear understanding of their roles, responsibilities, and issues that they need to address to set them (and the organization) up for success during an actual cyber incident.
The right objectives – define exactly what is that you are trying to accomplish during the exercise. Is it to define the roles, responsibilities, and tasks for each department as the foundation for developing a response plan? Or are you trying to identify and resolve any gaps in an existing plan? Other objectives could include focusing on coordination between departments, developing communications messaging, or determining which external resources may be required.
The right scenario – develop a realistic scenario that will achieve your objectives within the allotted timeframe. Make sure you include scenarios and questions for each of the departments participating in the exercise. You don’t want to have anyone sitting around with nothing to do, so be intentional about the scenarios to cover the likely issues of concern for each of your participants.
If you check all the boxes above, you are well on your way to a successful tabletop exercise that will initiate or accelerate development of your cyber response strategy and plans. People should leave the exercise with a clear understanding of the identified gaps, issues, and action items identified during the exercise so work can begin immediately to address these items. The good news is that most people leave these tabletop exercises motivated to actually tackle the issues and action items that were identified. By placing them in the middle of the fictional crisis, it elevates their attention and engagement. It’s the reason why these tabletop exercises are so effective.
Finally, there is one important element that I intentionally omitted from the above list for your tabletop exercise – the right facilitator. You need to find the right person to facilitate your exercise who is experienced and capable of keeping everyone focused, on task, and preventing the entire exercise from running off the tracks. You might have this person in mind in your organization today, or maybe you are that person. But if you need help, please contact us for more information. As a Master Exercise Practitioner, I’d be happy to help you develop, design, and facilitate your tabletop exercise. Either way, be sure to schedule a tabletop exercise soon. Past experience has demonstrated that it is the best way to engage the various departments on this important topic and increase your organization’s cyber resilience.
As the impacts from Hurricane Florence affected many coastal and inland communities, our thoughts and prayers extend to those who suffered from this storm. While the recovery process may continue for some time, one of the best practices we’ve found to be extremely valuable after every disaster is the After Action Review. This process helps organizations to identify areas of improvement in plans while the event, actions, and timeline are all still relatively fresh. It’s great to have and implement plans in response to an event like Florence, but a critical improvement opportunity is missed if organizations don’t make time to identify and implement improvements quickly so the plans work even better next time. Following are some key areas to review and evaluate your plan’s performance, along with our observations during Florence.
Plan Triggers – Is your plan based on number of days until landfall or government announcements such as Operating Condition levels (OPCONs)? Generally those plans that used OPCONs or other government activation level announcements were in better position to coordinate with government along an evacuation decision timeline and were not caught unprepared when the Governor announced an evacuation order. We’ve also noticed in some cases that a hybrid approach, including both government triggers and days to landfall triggers, are effective in more complex organizations or plans.
Evacuation Team – Does your plan have a pre-identified evacuation team? While some of us may debate the timing and effectiveness of an evacuation order, the fact remains that the Governor’s order changes things quickly. Schools close, transportation routes change as lane reversals are implemented, and basic staples and supplies such as gasoline and groceries can become scarce. Plans that have an evacuation team identified to leave early and establish remote operations are in a much stronger position to maintain critical operations while these evacuation impacts are experienced even before the storm approaches.
Communications – Does your plan have redundant communication methods? If phone lines, cell towers, and/or internet service are disrupted, can you still communicate with your key people? Planning to evacuate key personnel, especially those responsible for communications to large audiences, to safe areas ensures that these critical functions continue. Always plan to position people with communication responsibilities (website updates, social media updates, email blasts, conference calls, etc.) to safe areas where power, phone service, and internet can be assured to remain active. Following Atlantic’s plan, I evacuated to a safe location well before landfall so I could continue providing support and updates to our customers and the business community at large. I had multiple means of communicating with a team back in the impact zone to get local reports and discuss the situation at regular predefined intervals.
Re-entry Passes – Does your plan include regular annual updates to re-entry passes for evacuated areas? I helped facilitate daily conference calls for business and industry as part of my volunteer responsibilities with the Charleston County EOC. During those calls we answered a number of questions regarding re-entry passes. Make sure you have the correct people identified and updated on your re-entry passes with local and state authorities as part of your annual preparedness tasks.
Operational Rhythm – Does your plan include predetermined meeting times, conference calls, and communication updates to employees and customers? Maintaining an efficient and predictable schedule of daily operations helps everyone to find some structure in the middle of the chaos. People awaiting information updates during a disaster appreciate predictable times for communications. Decision-making is more effective when team members can plan to collect the necessary information in time for a meeting when those decisions will be discussed. Make sure your plan has a daily operational agenda that can be adjusted as needed.
Worst-Case Plans – Does your plan account for worst-case scenarios for people, facilities, communications, technology, and operations? We’ve seen some of the devastating impacts from Florence in North Carolina. Make sure your plan accounts for the recovery of all aspects of your organization following a major disaster that takes months or even years to get back to normal. Too many plans we review make too many false assumptions regarding staff, communications, technology, and alternate facility availability following a major hurricane or other disaster. Plan for the worst of a Katrina, Sandy, or Florence impacting your area and prepare accordingly.
Now that you’ve reviewed these common planning shortfalls or issues associated with Hurricane Florence, conduct your own After Action Review. Assemble your team and review each of the above areas in addition to those issues that were identified during this storm. Then develop your list of actions to address each issue and track them through regular monthly meetings until your plan has been updated and all issues have been addressed. If you need any help, we have a comprehensive and effective After Action Review process that we can facilitate for your organization. Please contact us for more information and make sure your organization is even better prepared for the next storm.
Last year the South Carolina Emergency Management Division (SCEMD) launched a series of workshops to promote business emergency preparedness to the private sector. Atlantic’s founder and principal, Scott Cave, agreed to partner with SCEMD in facilitating these workshops, but instead of using the typical lecture workshop to convey the preparedness message, he recommended an interactive series of hurricane tabletop exercises. Mr. Cave has achieved the Master Exercise Practitioner designation through FEMA’s Emergency Management Institute and leads dozens of exercises each year for Atlantic’s customers and in various workshops. SCEMD agreed to this interactive format and launched a Coastal Resilience Exercise series in Charleston, Georgetown, and Horry counties. Mr. Cave designed and facilitated the exercises to wide and diverse audiences of businesses between August, 2017 and April, 2018.
On June 12, 2018, Mr. Cave was invited to the SCEMD headquarters in Columbia, SC to receive the State Commendation Ribbon in recognition of these efforts. The commendation reads as follows:
“Mr. Scott Cave is commended for notably superior devotion to community and exemplary performance of duty as a Senior Facilitator for the South Carolina Emergency Management Division’s Coastal Resilience Exercise series for the period 25 August 2017 through 25 April 2018. Mr. Cave personally developed and was instrumental in the delivery of three separate tabletop exercises designed to promote emergency preparedness and continuity for the private sector in Charleston, Georgetown, and Horry counties. Mr. Cave’s broad wealth of experience and expertise in business disaster planning, coupled with his unparalleled willingness to volunteer personal time and hours from his own business to share critical best practices has greatly advanced the level of disaster preparedness of South Carolina’s coastal business community. Scott Cave’s superior performance brings great credit upon himself, the South Carolina Emergency Management Division, and the Military Department of South Carolina.
Signed R. Van McCarty
Major General, SCARNG
Deputy Adjutant General”
We at Atlantic are honored by this recognition and appreciate our ongoing partnership with the South Carolina Emergency Management Division. We look forward to working with SCEMD as we explore the possibility of extending this series of workshops and exercises over the coming months.
Hurricane Irma is now a one of the strongest hurricanes ever recorded in the Atlantic. A storm this powerful bears careful watch and planning now for its impacts. With the ongoing uncertainty of the path and impact area in the United States, it is important for organizations along the Alabama, Florida, Georgia, South Carolina, and North Carolina coastlines to start implementing their hurricane plans immediately. Following are ten tips to consider in your preparations:
- Make hotel reservations now. Hotels are already booked with reservations for this weekend and next week, as residents and businesses from several states are planning for a potential evacuation. Know your destination, your route, and your accommodation reservations. Don’t wait any longer; make your reservations now and encourage your staff to do the same.
- Identify your evacuation zone and route. Evacuation orders could be issued several days before potential impacts from the hurricane. Use the following information to identify your evacuation zone and route. Once the evacuation order is given, you may no longer have a choice of your evacuation route, so evacuate early if you want to be sure that you can travel the route of your choice.
- Develop a Communications Plan. Talk to your staff about their plans now and make sure you know where they plan to go and how you can stay in touch with them. Develop a regular daily schedule for briefings or updates to your staff, customers, and other stakeholders. Identify conference call lines, email distribution lists, alternate methods of communication if needed.
- Identify critical items for evacuation. Make sure each staff member develops a short list of critical items that are essential to performing their job. Then develop a packing list so everyone knows what they are taking with them during an evacuation to perform their job remotely.
- Follow local emergency information. In South Carolina, our state and county emergency management use Operating Conditions, or OPCONs, to identify the current status of their emergency operations. OPCON 5 is normal (good), and OPCON 1 is full operations (bad). For a hurricane in South Carolina, OPCON 1 generally means that an evacuation order has been issued by our Governor. You can follow OPCON and other emergency announcements on Twitter from these agencies (also sign up for emergency alerts at website listed in parentheses where available):
- Confirm re-entry process. Once an evacuation order is issued, a separate process known as re-entry is implemented in phases to return residents, workers, etc. back into the evacuated area. This process varies by jurisdiction, so check with your local government on their exact process for credentials and procedures. Following are some local links:
- Ensure technology availability. Make sure your IT systems, including computers, software, data, communications, internet, etc. are all prepared for an extended evacuation. Verify that your staff knows how to access these systems and use them productively while remote for an extended time. Work with your IT partners and vendors to make sure these systems are resilient and ready with a back-up plan if needed.
- Confirm insurance claim process. Make sure you know the process to follow if an insurance claim is required. Get all the proper documentation in order now so it is ready when needed, including policy information, contact numbers, video and photographic documentation, asset lists and values, financial information, etc.
- Prepare your home and family. Don’t forget that all disasters are personal, and you need to personally prepare yourself, your home, and your family. This includes boarding up windows and protecting garage doors, gathering important insurance documents, taking video of your home and contents, filling prescriptions, making hotel reservations for family members and pets, getting emergency supplies ready, etc.
- Prepare for the worst. This isn’t hype or fear mongering, but emergency and disaster plans need to be based on the worst case scenario so that you aren’t caught by surprise when things head south quickly. So prepare for the worst in this storm, including a direct landfall near your location, extended and prolonged evacuation, utility disruptions, personal impacts to your home and family, etc.
Overwhelmed, stressed, or confused? We’re here to help. Contact us for assistance before or after the storm. We will all get through this together.
Start Planning Now for a Better Recovery
Hurricane Season is upon us, and the predictions and forecasts are generating many of the same questions in recent years:
Will we see El Niño this year, which may inhibit hurricane activity in the Atlantic?
How warm will the tropics be this year, and what will that mean for hurricane intensity?
These and many other hurricane questions are often difficult to answer accurately and confidently, even by the experts. However there is one question with a simple and certain answer.
When should you start planning for Hurricane Season? Now.
Hurricane Season begins June 1 and runs through November 30.
Although most of the powerful hurricanes generally occur between August and October, we have seen tropical systems appear earlier and sometimes even before the official June 1 start of the season. The reality is that we never know when and where these systems will form, so best practice is to have your organization’s plan ready to go by June 1.
When you consider the difficultly in completing this type of planning during the summer months with vacation schedules and other competing priorities, the best time for most organizations to complete their hurricane planning is in May or June.
We have reviewed many hurricane plans from a variety of organizations, businesses, and municipalities over the years, and have seen first-hand where most of these plans fall short. Following are three of the most common issues we see in hurricane plans that could lead to a poor or lengthy recovery from the next storm.
Does your Hurricane Plan suffer from any of the following issues?
1) Detailed preparation but vague recovery
Most hurricane plans we review fall into this trap. The plan may have 20 pages of detail covering the actions to be performed leading up to the hurricane, but only one or two pages of actions after the hurricane. The preparatory steps are important, but the recovery steps are even more important. The purpose of your plan should be a quick and effective recovery, so don’t skimp on this section of your plan.
2) Assumption of immediate return
Many hurricane plans assume that everyone will be able to return to their office, business, and homes very soon after the hurricane passes. Unfortunately, the failure to plan for lengthy evacuations can lead to disastrous results, and these stories have been told repeatedly after Katrina and Sandy. Make sure your plan anticipates the need to establish temporary office and housing inland for extended periods of time.
3) Limited or no alternate communications
Most of the plans we review do not have adequate redundancy for communication systems. After life safety, communications is the top priority for any organization following a hurricane or any other disaster. It is an all too common, but faulty assumption that standard landline, cellular, or internet access will be available following a significant regional disaster like a hurricane. Plans must account for the need for alternate communications to your employees, customers, vendors, and other stakeholders.
We will cover additional hurricane planning tips in future articles. Please share your questions about your hurricane plan so we can address those as well.
Now is the time to start, review, or update your Hurricane Plan. Start by taking our Readiness Assessment to benchmark your organizational readiness for hurricanes and other disasters. Then contact us for a complementary review or your Hurricane Plan by one of our certified experts.
As Hurricane Matthew pushes out to sea, it is time for businesses and organizations to start preparing for recovery after the storm. If you evacuated it is important that you await word from public officials (State, County, and/or Municipal) regarding re-entry. Even if you have pre-registered for early re-entry with a County and/or Municipality, you must await authorization for re-entry. While it can be frustrating awaiting approval to return, there are a number of important considerations and issues to consider in the meantime. Now is the time to carefully consider your recovery plans for each of the following issues:
- Damage Assessment Teams – Who is included on this team and what do they need to do upon return? Do they have proper re-entry credentials? What will they need to bring with them to be self-sufficient upon return? Where will they stay/sleep? How will they communicate if power, internet, voice lines are down?
- Communications – What messages needs to be communicated to your staff, customers, and other stakeholders? Develop a rhythm/schedule of proactive communications.
- Finance/Insurance – Contact your agent(s) now to verify the procedure for submitting a claim if necessary. What documentation will you need? What is the procedure? How long could it take to see the first check? Develop a procedure to document daily the actions and decisions you make throughout the recovery phase.
- Staffing – Consider the staff impacts on your operations when they are allowed to return. Once your staff can check on the damage to their homes, they will have a long list of personal priorities and issues that could impact their availability to work. Develop a plan for staffing back-ups and/or alternating shifts to allow staff to balance work/personal priorities.
- Technology – Confirm plans to remain connected if power, internet, and phones are not working when you return. You may need to keep key staff in an inland area where they can work until these utilities are restored.
Additionally, be wary of all sorts of scams, including the phishing scam that the South Carolina Governor described this morning in her press conference (i.e., fake emails offering power outage information). There are likely to be many types of scams in the days ahead, including email, internet, and in person. Verify the authenticity of all inbound communications and offers to help. Don’t click on anything out of curiosity – think before you click. Our friends at PhishLabs are investigating the source of these email scams from the hurricane. Click here for more info on how to report suspicious emails.
Twitter remains an excellent source of information, especially if you follow trusted accounts from government authorities, public utilities, etc. Be on guard for false rumors and inaccurate information in the days ahead.
Recovery is the critical phase of this storm and it will require your focus on the important priorities for your organization. The time and effort you spend now to plan for an effective recovery will pay off in the days and weeks ahead.
Please contact us if you need any help. We stand ready to assist you.
As the 2016 Hurricane Season opens, another year has passed since most organizations have experienced one of these devastating storms. Many years or even decades have passed since communities or organizations in Florida, Georgia, South Carolina, North Carolina and many other states have experienced the full impact of a major hurricane. While most are thankful and rejoice in this reprieve, the reality is that the more removed we are from experiencing a hurricane the less prepared we are for the next one… unless we practice.
Over more than ten years of working with organizations to prepare annually for each hurricane season, we have found that the best indicator of an organization’s hurricane readiness is the extent to which it actively tests, or exercises, its hurricane plan. We have reviewed all types of hurricane plans of varying complexity, detail, and length, and even the most impressive looking plans can be rendered ineffective if they haven’t been exercised, especially within the current year.
The main problem with most plans is the people responsible for implementing them. People are often the weakest link in any hurricane plan because people require regular training and practice to become proficient at most tasks, especially during the stress of a crisis or disaster. If we expect people to perform their crisis responsibilities effectively during one of the most stressful events of their lives, then we must give them the opportunity to practice these tasks, at the very least annually.
Hurricane exercises also identify plan gaps, issues, and false assumptions that refine and improve the plan and the organization’s overall readiness. Exercises improve the plan in a unique way by placing the organization, people, and plan through the many expected and unexpected impacts in a simulated and relatively stress-free environment. The improvement plan that results from these exercises allows an organization to put lessons learned into action, yielding a much higher degree of preparedness and overall readiness.
Fortunately, more organizations are making exercises an active and integral element of their overall continuity or preparedness program. Over the first half of 2016 Atlantic facilitated (or as of this writing was scheduled to facilitate) at least a dozen exercises. Following are some best practices that we have learned through this recent and prior exercise experience:
1. Just do it. Plan and schedule your exercise now before other projects or priorities get in the way. Put it on your calendar at least 6 weeks from now and start planning for it.
2. Dust off that plan. Make sure your plan is ready to be tested. Spend some time reviewing, discussing, and updating the plan in preparation for the exercise.
3. Train first. Don’t throw your people into an exercise “cold” without some training on the plan they are supposed to test. Warm them up with a thorough review of the plan, their roles and responsibilities.
4. Crawl, Walk, Run. While it may be tempting to use that worst-case scenario Category 5 hurricane for your first exercise, it probably won’t accomplish much. Set realistic objectives for each exercise and design the scenario to reasonably achieve them without excessive complexity. Exercises should begin with a relatively simple scenario and build in complexity and difficulty over time through successive exercises.
Make sure your organization is ready for this hurricane season. Schedule your hurricane exercise today using the tips listed above. If you’d like an experienced facilitator to help with your exercise, please contact us so we can partner with you in this critical best practice and leading indicator for hurricane readiness.
As many of us begin 2016 with a list of resolutions, it is important to consider the one resolution that could actually save your organization when the next crisis or disaster occurs. Resolve to be resilient by implementing these three steps to begin your path towards a resilient 2016 and beyond.
1. Expect the Unexpected. One lesson learned from the October 2015 flooding in South Carolina was the rapid timeline that many disasters follow. A large rain system can quickly turn into a 1,000-year flood. Resilient organizations don’t limit their planning to predictable events like a hurricane or utility failure. Expand your planning horizon to consider worst-case scenarios that often come with little warning, such as earthquakes, loss of key employee, and terrorism. These events continue to occur with regular frequency and require more diligent advanced preparation, starting with the remaining two steps below.
2. Develop multiple recovery strategies. Too many plans that we review are based on a single recovery strategy, whether it is a single alternate worksite, a single IT recovery method, or a single method of emergency communications. Recent events like the South Carolina flooding and others have shown that plans often don’t go according to plan. The best plans often are those that have multiple options. When you identify the critical elements of your organization that require timely recovery, be sure to develop multiple recovery strategies for each. That means multiple alternate worksites or strategies, multiple IT recovery methods and options, multiple communications methods (not just relying on cell phones and email), and so on. Resilience often depends on flexibility and having several options available.
3. Prepare your workforce. People are the most valuable asset of any organization, but often are the weak link when plans are activated in response to a crisis. Schedule time on your calendar in 2016 to prepare, train, and test your staff’s ability to implement plans when needed. Make a recurring quarterly (good) or monthly (better) appointment to prepare your people for the various plans and conditions they may face. Schedule time during annual reviews to talk to each person about their home and family emergency preparations. Review cross-training gaps and identify multiple back-ups for each key position. Make your workforce resilient.
These three basic steps will put your organization on the quick path towards resilience in 2016 and beyond. Don’t let this resolution go unfulfilled. Resolve to be resilient this year by carving out a little time each month to make incremental progress on your plans and preparedness efforts. The payback for your time investment will be huge when faced with the next crisis or disaster, and it may save your organization and your livelihood. Our mission is to support you in these efforts, so please let us know if we can assist you. We look forward to partnering with you to keep this critical resolution in 2016.
Thanks to Mary Helen Berg for interviewing our Scott Cave in her recent emergency preparedness article in USA Today Magazine. The full article can be found here, with quotes from Scott Cave near the end of the article.
The formation of Hurricane Danny coincides with the start of the peak of hurricane season, roughly August 15 through October 15. While this storm is projected to weaken, its path and future are still unknown. Now is the time to review Hurricane Plans in Florida, Georgia, South Carolina, North Carolina, and along the Gulf Coast. Hurricane planning requires advanced preparedness in many different areas and should begin before the season starts on June 1 to ensure that an organization is ready for these storms whenever they occur. However following are some actions that every organization should be implementing now in response to Danny and the peak of hurricane season:
1) Update emergency contact information. Make sure you have current emergency contact information for all employees, critical vendors and suppliers, and customers or other stakeholders.
2) Test back-up systems. Test any back-up systems such as generators, communications, IT systems, etc.
3) Verify alternate locations. If you must evacuate, or if the storm damages your primary location, make sure you know where you will go and what you will bring to recover operations from an alternate location. Consider locations that are nearby and distant so you have options depending on the extent of local vs. regional damage.
4) Talk to key people. Discuss your plans with key employees, vendors, customers, and other stakeholders to ensure that their plans support or agree with your organizational plan.
5) Review financial plan. Check your insurance policies, documentation required for a claim, bank information, lines of credit, and other financial documentation to support your organization if the storm damages your assets or impacts your operations.
Remember that hurricanes are a unique threat because they offer plenty of warning before landfall. Don’t miss out on this great opportunity that hurricanes offer to start implementing these preparedness actions today while the winds are calm. A great place to start is our Hurricane Readiness Assessment that will help you benchmark your organization’s plan against our best practices. Upon completing the Hurricane Readiness Assessment, we will send you a report card with grades in each key readiness area to help you understand your gaps and areas for improvement. Please contact us for more information if you need any help preparing your organization today.