Exploiting Change

1. Phase 1 – Preparedness. The focus of this phase is the coordination of plans and procedures. This phase is activated on a continuous basis. Emergency measures and business continuity plans are developed and regularly reviewed through the incorporation of lessons learned from plan activation, training exercises, and learning from similar experiences in other organizations and regions. Physical preparedness of alternate sites, emergency power, emergency supplies, etc. are regularly verified. Operationally critical employees are identified, briefed and trained to respond to a disruptive event. There are three readiness levels, defined as:

• Normal Readiness: Routine governance and activities are in effect. Emergency Operations Centres (EOC) remain unstaffed but ready for activation. Emergency Management Teams (EMT) meet as required to coordinate and conduct planning and readiness activities. Emergency and Business Continuity planning and readiness measures follow regular planning cycles (for example annual business planning and budgeting processes).

• Medium Readiness: Medium readiness can be activated at any level of an organization by appropriate, pre-designated authorities based on pre-set criteria such as survival, public service, safety, public health, public order or organizational triggers, directives or advisories. EOCs are activated to a 12/7 posture supplemented with on call personnel outside of these hours. EMTs are activated and meet on declaration of Medium Readiness and at least once a week thereafter. Key tasks of EMTs include coordinating internal communications and preparing or updating plans and directives for future response and recovery options. Heightened security measures may also be in effect if required.

• High Readiness: High Readiness declaration and triggers are as for Medium Readiness. A local or regional emergency demanding an immediate or delayed response can also lead to a declaration of High Readiness by the designated authority for that location or region. EOCs are augmented to full 24/7 staffing and provide daily (or more frequent) Situation Reports and daily or twice daily situational awareness briefings to the designated authorities. EMTs meet daily (or more frequently, as needed) in their respective EOCs. Heightened security measures may also be in effect.

2. Phase 2 – Response. The focus of this phase is the safety and security of people. This phase is activated by appropriate authorities at relevant organizational levels upon declaration of an emergency involving the occurrence or warning of an imminent disruptive event. Designated emergency/business continuity authorities and EMTs establish and maintain situational awareness while at the same time activating immediate safety and security measures to protect all personnel, assets, and/or individuals or populations under their care or responsibility. Essential elements of information are communicated to staff, the public, stakeholders, contractors, vendors, etc. Designated authorities ensure the conduct of damage assessments (physical, operational, personnel, or cost) of the facilities, systems, networks and assets and this is communicated to all members of the EMT, higher authorities, critical services managers, and critical support function managers. Designated authorities also direct the preparation or heightened readiness of recovery teams and measures. The emergency operational cycle is activated to ensure: daily meetings of the EMT; collation, assessment and dissemination of situational awareness products and damage assessments to decision-makers; planning of recovery measures; and external and internal communications.

3. Phase 3 – Recovery. The focus of phase 3 is the coordination of Critical Support Functions to support continued delivery of Critical Services. Once immediate measures affecting the safety of employees and/or the public are implemented, designated authorities, in consultation with critical services and critical support function managers, activate applicable recovery plans for critical services and associated assets. These recovery options are activated in priority, based on Maximum Allowable Down Time. These options could include: relocation to alternate facilities or hardening of existing critical assets, prioritized system restoration, temporary reallocation of staff, activation of emergency contracted services, etc. Designated authorities then coordinate restoration or reconstruction (if necessary) of facilities, restoration and testing of infrastructure, and resumption of normal functions. At the end of this phase, the disruptive event has been eliminated, allowing designated authorities to terminate response and recovery operations and notify employees, the public, and stakeholders of the return to a normal state. Designated authorities must also coordinate the production of a “Lessons Learned” report.

1. Ensure vigilance through situational awareness.
2. Do preliminary assessment of tasks and time.
3. Activate organization or team.
4. Conduct reconnaissance.
5. Do detailed situational estimate.
6. Conduct wargame and decide on optimal course(s) of action.
7. Perform risk management and contingency planning.
8. Communicate plan and issue direction.
9. Build organizational robustness.
10. Ensure operational continuity.
11. Lead and control execution.
12. Assess performance.

Contact me to apply the whole thing–or just a piece, as needed–to improve your strategy, your readiness… and your results!