Continuity Planning

Could your business recover and continue trading after a major security incident?

• Loss of staff through death or injury.
• Damage to your buildings.
• Loss of IT systems, records, communications and other facilities.
• Unavailability of staff because of disruption to transport or their unwillingness to travel.
• Adverse psychological effects on staff, including stress and demoralisation.
• Disruption to other organisations and businesses on which you may depend.
• Damage to reputation.
• Changes in the business demands placed on your company.

You will need the right resources to maintain your critical business functions. These are likely to include:

• Sufficient people with necessary expertise and motivation to lead and manage the organisation.
• Access to key records and IT systems.
• Reliable means of communication, especially with your staff.
• The ability to carry on paying staff, to ensure their safety and to provide them with welfare and accommodation.
• The ability to procure goods and services.
• The ability to respond to demands from the media.

THE IMPORTANCE OF PLANNING

CONTINGENCY PLANNING, DISASTER RECOVERY AND BUSINESS CONTINUITY

There is often a lack of understanding as to what is a contingency, a business-continuity and a disaster recovery plan. This often hampers the performance of your security people in a crisis situation.

DEVELOPING AND MAINTAINING AN EFFECTIVE PLAN

The plan should have three main parts:

• How you intend to protect your people.
• How you intend to safeguard your strategic/key assets and infrastructure.
• How you can assist and coordinate emergency services on the ground.

1. The security of your business

2. Roles and responsibilities

All plans look different but they should be clear about roles and responsibilities. You will also need to determine:

Suggested roles are:

• The training required by the plan.
• What internal resources you will need.
• What external support you may need to bring in when an emergency occurs.
• What the process is for obtaining that resource.
• The role of your security officer in the event of an incident.

FIRE

• Fire Warden / Marshals
• Evacuation
• First Aid
• Assembly point co-ordinator

POWER/WATER/UTILITY CUTS

• Emergency services call out
• Transfer to back-up power
• Restoration of Power
• Evacuation
• Centre of knowledge of building layout and service outlets
• Knowledge of key contacts/ key holders

EXTERNAL THREAT

• Major incident liaison e.g. Project Griffin
• Emergency services call out
• Evacuation

3. Critical success factors

• What they are?
• How to measure them?

TESTING YOUR PLAN

ROLE OF YOUR SECURITY PROVIDER

ASSIGNING KEY PERSONNEL

• Remove all works of art.
• Direct firemen as to which articles to protect or remove.
• Prioritise the items to remove based on their assignment instructions.

ADVANTAGES OF MULTISKILLED SECURITY OFFICERS

In the past, many companies had designated Security Officers, Fire Wardens, First Aiders and Health and Safety Officers. However, recent times have seen the emergence of the multiskilled security officer trained to cover additional responsibilities.

Having multi-skilled security personnel can offer you more protection and greater flexibility under continuity and disaster recovery plans.

At the local level, the Civil Contingencies Act 2004 requires local authorities to provide advice and assistance to businesses in relation to business continuity management. You should consult your Local Authority website for further details.

NATIONAL CONTINGENCY SUPPORT PROGRAMMES

There are also programmes across the UK that you may be able to tap into when developing your own contingency plans.

CASE STUDIES

City of London Police - Project Griffin
Developed by the City of London Police, Project Griffin has a remit to advise and familiarise managers, security officers and employees of large public and private sector organisations across the capital on security, counter-terrorism and crime prevention. The Project brings together and coordinates the resources of the police, emergency services, local authorities, business and the private sector security industry. Organisations registered with the Project take part in a one day security-focused seminar, which can be geared to their specific needs. This enables organisations to target their specific concerns whilst sharing best practice across a range of security issues. This is followed up 12 months later by an online refresher package. Following its success in London, Project Griffin has now been adopted by over 20 other UK police forces, and has generated interest and acclaim from overseas (Hong Kong, Australia and the US in particular).
www.projectgriffin.org.uk

Corporation of London
In 2004 the government introduced the Civil Contingencies Act to enhance the capabilities of the Corporation of London to respond efficiently to emergencies. It covers the way the Police and local authorities plan and prepare for security incidents.

This legislation requires the emergency services to communicate and work together on all aspects of emergency planning.

The Corporation of London and the City of London Police have established the City of London Contingency Planning Team (COLCPT) to help the city businesses to be more efficient in their response to security emergencies.

Project Argus
Project Argus is a National Counter Terrorism Security Office (NaCTSO) initiative which explores ways to help organisations prevent, handle and recover from a terrorist attack. It achieves this by taking businesses through a simulated terrorist attack. The event allows the client to explore their options; what is likely to happen in the event of a terrorist attack; how their continuity plans (if any) function, and what their priorities should be. The events are free and are ideal for businesses of any size. The events take place around the country and have involved constabularies from around the country, including Merseyside, Bedfordshire, North Wales and Cambridgeshire.
www.nactso.gov.uk

CONTINGENCY PLANNING SAVES LIVES

When those two planes struck the Twin Towers on September 11th 2001, Morgan Stanley activated their contingency and continuity plan to safeguard the lives of their employees. In the first 20 minutes between the first and second planes crashing, their evacuation plan was implemented.

This plan was developed after the 1993 terrorist attack on the World Trade Centre. Most of the 3,700 employees were off the high floors by the time the second plane struck. Six employees were killed in the attacks; considerably fewer than other businesses in the Twin Towers.

Operations managers acted promptly to ensure Morgan Stanley could continue operating. Employees walked 22 blocks to their back-up site to turn the computers on.
By 9:20am the back-up site was live and by 9:30am senior management had relocated to another back-up site that became their command facility.

In the attempt to locate their 3,700 employees, as per the plan, Morgan Stanley converted one of their credit card facilities in Phoenix to a toll free emergency hotline. By 11 am the number was appearing on national television and by 1:30pm the centre had received over 2,500 calls. New York’s City’s phone system suffered failures within one hour of the attacks so Morgan Stanley accessed a dedicated phone line to their London office, which enabled them to call their Chicago Office. Morgan Stanley recognised that it was not only important to get back to business quickly and as efficiently as possible but that it had to ensure that its employees were coping with the situation. Three hundred grief counsellors were hired to help traumatised employees and to train mangers on how to respond to their fellow employee’s difficulties in coping with the aftermath of the incident. A key part of Morgan Stanley’s efficient reaction during this incident was the way in which their highly trained security personnel responded.

ARE YOU PREPARED?

So ask yourself the following:

Do we have a plan for?

• Contingency
• Disaster Recovery
• Business Continuity
• If so when did we last review the plan? Is it current?
• Does it comply with BS7799* or another external body?
• Who owns the plan? Who is responsible for implementing it?
• What are our critical success factors for each plan?
• Who knows we have a plan?
• What expertise can I use to build our plan?

CONCLUSION

At some time in the future you will face the challenge of recovering from a security incident. How you respond when it occurs will determine your ability to trade in the future. We recommend that you develop a continuity plan that is structured, involves your people, has been tested and fully utilises the skills of modern day security best practice.

FURTHER ADVICE

A wide range of advice on business continuity is available and much of it is free. The Government’s Preparing for Emergencies website www. pfe.gov.uk provides extensive information for businesses, including the booklet ‘Expect the Unexpected’. This booklet is jointly published by the police National Counter Terrorism Security Office, London First and the Business Continuity Institute. More detailed advice for business continuity professionals can be found at www. ukresilience.info.

The London Chamber of Commerce and Industry has also published guidance for businesses on how to draft and implement a business contingency plan, entitled ‘Crisis Management and Business Continuity Planning: A programme for Business Survival (see www.londonchamber.co.uk).