WWW.EVERBRIDGE.COM

Crisis Management Frameworkfor Successfully Utilising a MassNotification System

by Andrew Woods

Crisis Management Framework for Successfully Utilising a Mass Notification System Scope This document and its associated modules are designed for organizations who are starting to build resiliency and crisis management plans. Often this decision is trigged by the requirement for a mass notification system and vice versa. To maximize the impact of a mass notification tool it is advised that the foundations of crisis planning are used. This document will help you build out the essential components but is not designed to replace a fully implemented resiliency program. Crisis management is one component of the BCM life cycle and while it can be used in isolation, it is best used in synergy with Business Continuity, and(IT) Disaster Recovery to build a resilient organization. In this document You will find a framework that is designed to work with an automated calling/notification system. The framework is designed to be used as a cornerstone for managing numerous situations and scenarios. Each scenario is available as a module. The module documents can be added or removed to the framework as required to reflect specific risk(s). The goal of this document is to give an organization a starting point when building a crisis management framework. Before you start When implementing a notification system, it is important to consider and/or put a number of steps in place to ensure success. These are:

• Establish a crisis management team (CMT): This will be the team who are ultimately responsible for making decisions about declaring a crisis, recovery and communication. Typically, these will be business leaders and senior management in your organization. This could be C-level members or directors of businesses depending on your organization structure. A crisis team is normally between six and twelve people.

• Leadership support: It is important to get buy in from the leadership team. Have

them sponsor the crisis process even if they are not part of the crisis team. This should include tools, processes and procedures used.

WWW.EVERBRIDGE.COM

• Policy control: Establish a policy that can be used to ensure that everyone understands what is required of them before, during and after a crisis. The policy should be a strategic goal that sets out the high-level aims, requirements and measurements in an organization.

• Education: Having a common understanding of what constitutes a crisis is and

how employees must behave during any given situation is vital. Ensure that this message comes from the top down and is understood. Put procedures in place to educate both existing employees and new employees.

• Establish a reporting line for both invocation and escalation. In the event of a

crisis it is vital to ensure that everyone has the right information at the right time. This will vary depending on the scale and nature of an organization. This document does not cover this section as it will depend on the structure of your organization.

Crisis Management Team Purpose The Crisis Management Team (CMT) are the people responsible for managing any situation, crisis or incident that occurs. The CMT will take command and control, make decisions, and/or lease with key stakeholders, customers and emergency services. Organization The Crisis Management Team needs to consist of members of an organization that are empowered to make decisions on the behalf of the company. A team should be between six and 12 people. Once a person is identified as being a member of the CMT it is essential that they are given access to any and all training, support and tools required to carry out the role. In the event that a crisis does occur it is important to have a team who understands the role and can operate for extended times as a crisis may last for hours, days or even months. Roles A Crisis Management Team member may be expected to carry out the function they are used to, such as an HR Director acting in the HR capacity. However, in many cases it

WWW.EVERBRIDGE.COM

will be necessary to fill roles based on those who are available. The identified roles must include:

Role Responsibility

CMT Leader Controls the team and is ultimately responsible for all actions of the team.

HR Lead All aspects of HR and people.

IT Lead All aspects of IT and IT third party vendors.

Media and Communications Lead Both internal and external communication to media.

Loggist Keeping accurate notes of all decisions made by the crisis team.

Business Relationship Lead All aspects of business and customer management including working with both internal and external customers.

Delegation Each member of the Crisis Management Team should have a delegate that can stand in for them in the event they are not available. This is to cover sickness and holidays etc. Quorum As part of the Crisis Management framework, the number of people required to make a decision should be established. In some cases, the decision to take an action will be clear. In other cases, a number of people may need to agree. Crisis framework Once a person is identified as being a member of the CMT they should be recorded in the Crisis Framework. Each CMT member must also have a copy of the plan and ensure that they understand it and have it to hand.

WWW.EVERBRIDGE.COM

Crisis Management Team Members

Name Job Role Depute

It is agreed that the quorum is: Expectative Plan: During a crisis event it is vital that executives know what their role is if they are not part of the crisis team. It is essential to have support from executives as they will be supporting any on-going issues. Executives have four main priorities:

1. Support: To support the CMT with organization and logistical hep. 2. Financial: Approve costs or expenses that arise from the incident. 3. Business relationships: To work with customers, clients and third parties. 4. Media relations: Senior leadership may be required to work with media.

Instructions to executives: In the event that a crisis is declared, executives will be contacted with instructions and should be prepared to follow the executive brief. It is important for executives: Wait – For information, do not attend site, do not block in coming lines. Log – Keep a log of incoming calls or contacts. Report – Use the agreed method (CONTACTBRIDGE) to report serious issues.

Having a plan for management is very important as often when a manager is not part of the CMT they may, though the best intensions put themselves or others at risk. This may be as simple as calling other managers on the CMT to arriving at site “to help out”. As a separate effort having an executive plan, normally no more than four pages is advantageous. The plan outlines the roles and responsibilities of each executive. This plan should clearly identify the areas of responsibility and how to communicate.

WWW.EVERBRIDGE.COM

Crisis management framework

Crisis Framework: The following process must be followed in the event of a crisis. It is designed to be used as a check list that will ensure that all important actions are managed. In this section of this document you will see an example of the document. The text in the boxes in italics are notes and instruction on filling out the plan.

!! DO NOT TAKE RISKS OR ASK OTHERS TO TAKE RISKS !!

1: Determine the course of action using the table below:

Is this a false alarm? Yes/No (details)

Has the Crisis team been activated? Yes/No (details)

Are employees hurt? Yes/No (details)

Has the crisis management process stated? Yes/No (details)

In this section the initial record of the incident should be logged. Once recorded this should remain present and on display for the length of the Crisis. The CMT on finding out an incident they should stand up the team as required.Paths will need to be established and documented regarding how the CMT is informed. This will depend of the size and structure of the organization. In some cases, a specific type of incident template being launched will trigger automatic notification of the CMT.

IncidentA:Occurs

B:Identified

CMTInformedofsituation CMTinitiated

WWW.EVERBRIDGE.COM

WHO WHEN WHY

Should an incident be reported to the CMT record who initially alerted the CMT and when. If possible record as many details as to why they are calling.

2: Criticality and impact to the organization. 2.1 Criticality index: Using best judgement of the CMT what grade is the impact.

GRADE CATEGORY ACTION

1 Emergency Response Immediate and Obvious threat

2 Priority Response Likely to involve serious injury to a person, process or property.

3 Scheduled Response Certain degree of important or urgency however, immediate response is not required.

4 Evolving Response Possible threat that needs to be monitored but may not by its self, represent a direct threat.

Based on the information initially gathered assess and categorize the incident. This gives the crisis team and any others teams a sense of the severity of the situation.

Using this method, it is also possible to launch multiple notification templates to different teams. This is discussed in the “managing scenarios”.

WWW.EVERBRIDGE.COM

ISSUE GRADE DATE & TIME

Record the initial issue and what grade is it currently recorded as. This may change overtime. Each time an issue is up or down graded this should be recorded.

2.2 Impact scale: To help score the grade of the emergency use the following agreed scale of impacts. Duration Impact Trivial Minor Moderate Major Extreme

Very long (7+days) G2 G2 G2 G1 G1

Long (5 to 7 days) G3 G3 G3 G2 G1 Medium (3 to 5 days) G4 G3 G3 G2 G1

Short (1 to 3 days) G4 G3 G3 G2 G1

Very short (1 day or less) G4 G2 G2 G2

It is important to have a common understanding of what the impacts are across the CMT. It should be noted that critical incident in one part of the business may not be a wide spread issue. A good example is P1 IT issue may not represent more than a G3 or G2.

3: Activating the CMT: To activate the Crisis Management Team use on of the following methods: 3.1 Activate the “CMT Initiation” template.

Using the notification system, a template will be launched contacting each member of

WWW.EVERBRIDGE.COM

the CMT. They will be automatically joined to a conference call. This must be an option for all locations. The template starts a conference call to a crisis management bridge. An example of a template may be – Title: Category 1 – Fire at loading facility. Body: All CMT members must join the bridge. Message type: Conference call.

3.2 A member of the CMT directly call the team to order.

Any member of the CMT may call the other members to order. This can be done using the notification system template “CMT Initiation” as above.

3.3 The CMT decide to convene should it look like an issue will occur.

In some situations, the CMT may convene due to no urgent matters. This may be that a season normally associated with bad weather is starting or a political situation is forming. These risks may be slow to form or contain a number of factors that form in a risk that needs to be discussed. This is often known as horizon scanning.

4: In a crisis do the following:

The crisis checklist is a form to be used to record that actions have occurred. Each time an action is completed the time, date and who took the action must be recorded. Simply entering initial’s and time/date is acceptable, for example “AW06112016”. If a specific action is required, it can be added to the check list. Should an action not be required it can be removed.

WWW.EVERBRIDGE.COM

Activity Complete

1. The CMT must initiate the following responses: a. Account for employees. b. Prepare media responses. c. Activate any CMP, BCP or DRPs required. d. Ensure resources required are provided.

2. Managing the ongoing crisis: a. Maintain necessary resources to mitigate crisis.

• Personnel and scheduling. • Equipment and supplies. • Crisis command centre.

b. Maintain crisis communication communications, both internally and externally.

c. Continue situation assessments and adjust crisis plan as required.

3. Execute recovery operations: a. Execute plan for recovery and return to normal

operations. b. Maintain necessary resources to mitigate crisis.

• Personnel and scheduling. • Equipment and supplies. • Crisis command centre.

c. Maintain communications both internally and externally. d. Continue situation assessments and adjust crisis plan as

required.

5. CMT Communication framework: When communicating each external communication must contain the following information: WHAT: What has occurred. WHERE: Where did it happen. WHEN: At what time did it occur. IMPACT: Who or what is impacted. WHO: Who was the message sent to.

WWW.EVERBRIDGE.COM

WHAT WHERE WHEN IMPCT WHO

Specific messages that relate to a scenario are templated in notification message templates and the correlating appendices. TO support these messages, the above topics should be captured at each communication point and logged.

6. Communication Red, Amber, Green status: The RAG system is used to quickly indicate a situation at a location. When sending a message ensure that the status is in the title of the message.

When communicating to wider sets of staff or employees it is important to keep communication clear and concise. For this reason the RAG system is popular with may organizations. Employees being made aware of how each of the colours affects their location and how to respond ahead of time leads to a quicker and more precise response.

Immediate threat. • Run, hide, tell, fight. • Switch devices to silent. • Follow instructions of first responders.

Caution / possible threat / de-escalation.

• Caution is required. • An attack has occurred or is close by. • Shelter in place.

Business as normal / All clear.

• All clear. • Training exercise.

WWW.EVERBRIDGE.COM

It is not recommended to include the category when communicating to wide groups as this may cause confusion. The RAG system is easy to understand for people that are not trained crisis or emergency responders.

7. CMT Members: Name Job Role Depute Role

Crisis Management Team member should be identified before an incident with a backup selected. The backups stand in during holiday, sickness or for other reasons of absence. Each team member must be familiar with the crisis management plan and procedures. Ideally, they will have attended an exercise. When assigning roles, it is important to note that each person should be given a clear role with restorability’s. In some cases, it may be obvious who fills a specific role but in others it may be required for a person to manage one or more role. Typical roles are:

• Lead: Responsible for running the crisis team and making final decisions. • Spokesman: Responsible for leasing with and making press statements. • HR / Employee welfare: Responsible for employees and their families. • Emergency response liaison: Responsible for working with the emergency

services. • Customer liaison: Responsible for working with customers. • IT liaison: Work with IT and IT vendors. • Vendor Management: Work with vendors. • Scribe: Responsible for taking notes, recording and pictures that can be used

for evidence or insurance purposes.

WWW.EVERBRIDGE.COM

7.1 CMT Call Bridge: The CMT Call Bridge can be activated by sending out the template EMEA CMT Call Bridge.

Conference telephone number

Conference ID

Conference Link

Conference Password

The CMT call bridge is the conference calling details to use in a crisis. These details should be stored in the notification system and triggered from there. It is also extremely handy to have them in your plan.

7.2 Additional resources: In the event that additional resources are required the following are listed. All of these resources are also listed in the notification system. Team Engaged

Physical Security

Communication and media

EH&S

Business Partners (impacted or likely to be impacted)

IT

Information Security

Finance

Legal

HR

Vendors / Partners

Customers

Emergency Responders

Media

Interested parties /Customers

WWW.EVERBRIDGE.COM

Additional resources can be identified in a specific module and should be recorded here when engaged. This is to ensure that the information can be easily found.

7.3 Informing all Employees: Name Target Detail

In the event that the all of some of the employees need to be contacted the notification system holds all contact information. The notification system will have a full audit trail and record of the messages and a short reference can be stored here. Use the name box to include the title of the message, the target box to note the group name and the detail for any additional information.

8. Logging: Use this log to ensure that all important information is recorded.

ID No Time / Date Message Sender/Receiver

Ensure that all actions are recorded in this sheet. This must include incoming and outgoing communication, press relations, emergency responder messages and so on. These logs must be kept as they may be required during any investigation.

WWW.EVERBRIDGE.COM

9. Document Modules: Below are the modules associated with this crisis management framework. These modules may be generic or deal with specific issues.

Module Name Locations Date

In this section it is important to record what modules are associated to this plan. Use this space as a summary of what risks have been identified and how they are to be managed. This could be as simple as managing building, employee, IT and utility unavailability to having specific plans to manage very acute threats.

10. Monitoring, benchmarking and reporting: After each exercise the results can be logged here. Test No Scenario/module Previous exercise Current Score

Keeping track of the modules run and the results is vital part to demonstrating that your plans are effective. The CMT frame work and modules should be exercised to ensure that they are fit for purpose.

Final Note This plan can be used in isolation but is designed to be used in conjunction with a notification system. A blank copy of this plan can be found here. In the blank copy there are no instruction boxes such as this or example information.

WWW.EVERBRIDGE.COM

Modules Examples Scope The following sections list out some of the common modules that an organization may have. These modules are designed to help establish a base line of communications templates. The modules address either a specific risk or a set of risks that fall under a category. Examples of both are:

• A specific risk at a given location: Active shooter. • Any issue that results in a building being impacted: Building unavailability.

The main modules below are:

Module Risk

Active Shooter A plan for managing active shooter events.

Account for employees Managing employees after a terror attack or natural disaster.

IT Outage Any IT incident that requires the Crisis team to be invoked.

Building Unavailability An impact that stops a building being available.

Employees Unavailability An impact that stops employees being available.

Third party Unavailability Loss of any service that is provided by a third party such as power, water etc.

Often specific risks may be identified at a given location. These can be in the same generic category. In this case a second template is often created. An example of this is:

Module Template Use

Building unavailability Any issue out side of a specific risk.

Building unavailability - Carpark 3 flooding Used for managing flooding in carpark 3.

Employee unavailability – Snow storm Snow storms affecting travel networks.

Third party Unavailability – Trade feeds Trade feed provider outage.

WWW.EVERBRIDGE.COM

All modules can be used as a template. The primary purpose of having a generic template is to avoid creating many, many communications plans for issues that are essentially the same. Using the module approach, it is possible reduce the number of plans being created. This is evident when many issues result in the same, such as a building being unavailable.