ITS4350A - Incident Response and Disaster Recovery

Chapter 12: Crisis Management


This lesson is about chapter 12. Objectives important to this lesson:

  1. Crisis definition and management
  2. Trauma
  3. Involvement of law enforcement
  4. Preparing for crises
  5. International standards
Chapter 12

This chapter begins with our text's illustrative company receiving the news that several high level employees have died in a plane crash. The point that the author makes right away is that this is a crisis because it affects the people in the organization. Their emotions, their sense of the organization, their productivity, and more aspects of their business and personal selves are bound to be affected.

The text presents a definition of a business crisis on page 341 that seems to ignore the human concerns that the author led with. To the author's credit, the definition is adapted in the next paragraph. It is not as visible as the definition at the top of the page, but it is more useful in the light of the author's concerns:

Business crisis: A significant business disruption with a direct impact on the lives, health, and welfare of an organization and its employees.

The quoted definition deals with more business concerns, such as bad press. There is a place for that kind of thinking, but we can do better than that, so let's try.

A crisis can loom on the horizon for quite a while if it is a smoldering crisis, one in which events build over time to become a crisis. Some people say that the American culture is one that manages everything this way. We let a situation go as it will, as long as it is not a crisis, and handle it as an emergency when it becomes one. Then the chain of events has led to what might have been avoided, but is probably being presented as a sudden crisis, one caused by sudden unforeseen events. That is not a good policy. I have pointed out to you before that everyone respects a hero who handles an emergency, but few give the same respect to a person who prevents such an emergency from happening. I think there is a place for both kinds of respect, and we need to honor those who prevent disasters by providing us with adequate preparation and foresight, as well as those who are the public face of those who work for years to make something possible.

Of course, we should honor those who act (or choose not to do the wrong thing) when they find themselves at a crisis.

So, we should honor both the emergent hero and the hero who plans or looks ahead. The author does not address this, but I hope he would agree. If we want to benefit from the works of both kinds of heroes, we should recognize those works. That will inspire those who see it, and may inspire further acts of heroism.

The text spends its usual space discussing building a team for a crisis. In a sudden crisis, there is not much time to build a team or to train one, so we can take heart in the fact that the team is much the same team that the author wants to build in every chapter. The causes of crises are many, so we can't always be prepared for every possible type. Figure 12-1 in the text shows a list of crisis contributors.

sources of crises

As you can see, the second largest cause in this graph (13%) is "Other", with another 7% from "Other categories". This indicates that 20% of the time, a crisis will not be caused by an anticipated cause. Like a good Scout, you should be prepared, but keep your eyes and mind open.

Some crises, like any disaster, may require that we attempt to secure the safety of our staff and our customers immediately. The author points out that we should keep records on the specific health concerns of our staff, and that we pay attention to "head count" when moving people from a dangerous area to a safer one. We don't want to leave anyone behind who needs assistance getting out of harm's way. Passing a completed head count up through a chain of command is recommended.

A crisis may cause lasting trauma, physical and mental, to those involved in it. Counseling is often available through human relations departments, at least for organizations having significant health plans. For those without such a plan, community resources should be contacted. The text lists several federal and local agencies that may be of assistance.

A section of the chapter that relates directly to the crisis on the first page is about succession, knowing who takes over for someone who is unable to do his/her job. In this case, the people who are missing are presumed dead. More often, a crisis is more temporary, and less permanent measures can be taken, but in either case, the organization that has a chain of command with succession built into its plans will continue with less stress than one that has no such element in its plans.

For those who are in need of guidance about crisis management, the text discusses some international standards available from the NIST and from ISO. The NIST link above goes to an article about a smoldering crisis.

  • The text also mentions BIS, the US Commerce Department's Bureau of Industry and Security.
  • Another source is ASIS, another international security organization.
  • The text also mentions FFIEC, which is not international, but it does concern federal financial institutions.