header image

CYBER INCIDENT RESPONSE: PERSPECTIVES FROM INSIDE THE RISK ECOSYSTEM

In our latest report, we examine a cyber incident from the perspective of several key stakeholders.

Download Report

The world remains in a coronavirus-induced state of flux.

Global reported infections have topped 1 million. The epicentre of the pandemic has moved from Asia through Europe to the United States. Whilst some countries are reporting a flattening of the curve others are experiencing a resurgence of infections.

With certainty thin on the ground, S-RM’s Resilience Advisory practice shares its thoughts on the four teams business leaders should be building as they seek to manage the human and commercial challenges of the months ahead.

 

 

Team 1
COORDINATE

The life and safety elements of the early stages of coronavirus have, perhaps necessarily, kicked many organisations’ crisis teams into overdrive. With early indicators of success in infection control appearing around the globe it is now time for business leaders to look further ahead.

Your crisis team needs to be sustainable. Image_COV-19The shape and cadence of your response needs to reflect the nature of the threat. In the months to come we will see the manifestations of the second and third order consequences of coronavirus – in supply chains, in your workforce, in the economy and in society at large. These will create a new set of challenges for leaders to tackle.

In light of what’s coming you will need to remain agile; that is to say willing to take in new information and bold enough to act upon it when appropriate. Be wary of fixing position in a dynamic situation.

Complex situations can push upon your ability isolate signals from the noise. Adhering to simple principles for crisis operation can provide structure for discussions and support decisions in real time, giving you the confidence to act when you need to.

Most importantly, communicating clearly, frequently and consistently both internally to your workforce and externally to your supply chain and business partners will provide you with the information you need to make good decisions in uncertain times.

The steps outlined in the infographic above will help you shape your risk thinking. Consider for each stage of the pandemic where your risk lies, and how strong your controls are.

Team 2
Keep People Safe

Pandemic Stages

Keeping employees, families, communities and business partners safe throughout the coronavirus pandemic is the top priority for all businesses leaders.

Doing it well requires access to specific skills and experience. Seniority isn’t enough. It means ring-fencing your team from other responsibilities and pressures; creating the space for them to identify life and safety issues and aligning them with the necessary authority within the business to act.

From a leaders perspective, keeping people safe is about much more than minimising the likelihood of them catching coronavirus and supporting their medical needs if they do – it is equally about thinking ahead and anticipating the challenges to come.

The psychological challenges associated with extended periods of working from home must not be underestimated. As society enters a lengthy and unpredictable period employees will be subject to all manner of external pressures and have far less access to their usual coping mechanisms. Not coming to the office isn’t the only thing that will have changed in their lives.

Returning to work will bring with it huge uncertainty for both employer and employee. As we come to live in a world in which the possibility of a colleague accidentally bringing the virus back to the workplace is accepted, businesses must work tirelessly to prepare people and response teams to respond proportionately.

Use scenario planning as a tool to model how particular situations might play out. Involve your employees. Create a sense that you are working through this together.
 
We know that in challenging times people’s actions are driven by their perception of risk and not the reality of it. Your role is a communicator and convener is vital in keeping expectations and understandings aligned as the pandemic timeline expands.

The economic consequences of coronavirus will, directly or indirectly, destabilise the lives of your employees for years to come. The psychological manifestations of these events may not be immediately apparent,  so within the pragmatic confines of reality, think carefully about how and when support is withdrawn.

 

Team 3
PROTECT THE BUSINESS YOU HAVE TODAY

Business Infrastructure COVID-19

Whilst some level of sustained change in the business environment  is inevitable as a result of the way coronavirus has impacted society, it is unrealistic to think that this change will happen overnight.

From a business continuity perspective you need a team to be focusing on protecting the business you had in December 2019. This is the business you entered the crisis with, it is the one all of your employees know and rely upon, it is the business all of your customers and suppliers transact with – and whatever business you end up with in 2021, it is this business that will get you there.

Look at your portfolio of investments and slow down anything based upon future assumptions which may no no longer prove to be true. This certainly isn’t to say that everything should stop, but that you need to be clear about your next decision point and prepared to consider it within the context of your new reality.

The goal here is to minimise avoidable loss or damage, and to get your business into the best possible shape to weather any storms ahead.

Apply scenario based analysis to your business infrastructure. Use the risk thinking steps and coronavirus planning phases as a framework within which to explore how prepared key elements of your business are.

For example: Do you understand what the risks to your supply chain are during the return to work phase? How would you monitor them? Are your controls good enough – and if not what do you need to do?

The hazards posed by the coronavirus pandemic encompass much more than the (clearly imperative) life and safety issues. By thinking clearly, and in a structured way, you will be able to identify specific issues and implement specific solutions – so that even when an obvious path ahead cannot be found you can still be confident you are taking the right steps.

And don’t forget your customers – they are going through this too. At times of crisis it is easy for planning to become overly inwardly focused. Remember why you’re in business!

 

Team 4
PREPARE FOR THE BUSINESS YOU HAVE TOMORROW

Your fourth working group should be deployed separately to identify the risks, opportunities and challenges associated with the new normal that will emerge post coronavirus.

Their role is to stay away from the immediacy of the issues being dealt with by the other teams and instead to focus on developing, evaluating and implementing the foundations for your business in the future.

Scenario planning and stress testing are again your allies in putting structure around this process.

Good decisions are based upon good information, and rarely will you find a circumstance in which that is harder to come by than this one. Predicting the second and third order effects of coronavirus is much more of an art than a science. There are, however, steps you can take to improve your odds.

Seek input and insight from as wide a range of business partners as you can. This is not just an exercise in recovering from a crisis, it is every bit as much about serving your customers, keeping your employees happy, healthy and wealthy and maintaining or elevating your position in the global marketplace.

Scenario planning teams should include representation from all major business departments – and where possible your customers, and suppliers too.

Design thinking can be a useful tool to quickly and iteratively understand what is changing in your customer / employee environment and explore what, if any changes to your business model might create advantage.

You should be identifying indicators both internal and external and agreeing in advance trigger points after which decisions will need to be made.

For the foreseeable future at least long term planning will be less reliable than we have become used to, so you may also want to consider shortening your strategy periods from years to quarters – setting staged near term goals that will give the business a sense of continued progress.

From a risk perspective much of the foundation upon which your existing controls were built may no longer be valid.

You may have a much larger portion of your workforce working remotely than before; you may in the future be running many more of your key business processes through you digital infrastructure.

Both of these changes create new ways for cyber (and hence, business) risk to enter the organisation.

Reports are suggesting we may be entering the deepest global recession in living memory, which will place significant strain on many parts of society and could pose a variety of new circumstantial risks to your physical assets and operations, as well as prolonging the need for psychosocial support to employees in consideration of their immediate and family experience of the pandemic.

One last key point. It is important to remember that when the new normal comes, your customers and business partners will look back on not just what you did during the pandemic, but the compassion, pragmatism and openness with which you did it. It will form part of your reputation for years to come.

View the presentation on SlideShare

 
COVID-19 Pandemic

S-RM is a global risk consultancy providing intelligence, resilience and response solutions to clients worldwide. To discuss this article or other industry developments, please reach out to one of our experts.

John R. White
John R. White Global Head of Resilience Consulting  Email John

CYBER INCIDENT RESPONSE: PERSPECTIVES FROM INSIDE THE RISK ECOSYSTEM

In our latest report, we examine a cyber incident from the perspective of several key stakeholders.

Download Report