Toro Solutions and Insignia Crisis Management recently brought together a group of people with experience in security, crisis management, communications and resilience to discuss a difficult question: how do you prepare leaders for a serious security crisis?
Panellists
- Jonathan Hemus – Insignia Crisis Management
- Zoe Thomson – Arcadis
- Ben Hockman – Google
- Gavin Wilson – Toro Solutions
Chair
- Peter Connolly – Toro Solutions
Most organisations put considerable effort into preventing serious security incidents and planning how they would respond if one happened. But a plan can only take you so far. At some point, people have to make decisions, often quickly, with incomplete information and while the situation is still changing around them.
That places very different demands on a leadership team. They need to set direction without getting drawn into the detail, make decisions before every fact is known and communicate when there may still be significant gaps in their understanding. How well they do that can shape the course of the response.
The discussion ranged from what happens in the first hour and how leaders make decisions without the full picture, to fatigue, communications, organisational culture and whether having a crisis plan really means you are ready to use it.
The first hour is rarely straightforward
In the first 60 minutes, a serious incident is understandably messy. Information arrives from different parts of the organisation, technical teams are trying to work out what has happened and senior leaders are often being asked for decisions before the wider impact is clear.
Cyber incidents show this well. A technical team may know quickly that something has happened, but establishing what has been accessed, what the attacker has done and what it means for the wider organisation can take much longer, sometimes weeks or months.
Leaders are often tempted to get closer to the detail because that feels like the route to certainty. One of the points made during the discussion was that their role is to stay above it. They need enough information to make decisions, while giving the people investigating and managing the incident the space to do their jobs. Good leaders get the best out of the teams around them rather than trying to become a one person superhero. They set the strategic direction, keep reassessing priorities and have the rigour and courage to make decisions even when they do not have all the information.
Some of the questions are very practical. If the incident is cyber-related, can you trust the normal network? Can the crisis team communicate safely on its usual systems and, if not, does everybody know where to go instead? The threat actor may still be present, watching the response and adapting.
Making decisions without the full picture
In a fast moving incident, information very rarely arrives cleanly. Technical findings are still being tested, employees report what they have seen, suppliers give their own updates and information may already be circulating externally. Some of it will be accurate, some will be based on assumption, and some will simply be wrong.
One practical approach discussed was to keep a running picture of what the organisation knows, what it does not know and what it is assuming. This makes the level of certainty visible and reduces the risk of an early assumption being repeated until it is accepted as fact.
Misinformation and disinformation add to the difficulty. Leaders may be dealing with gaps in their own knowledge and with material elsewhere that is outdated, inaccurate or deliberately misleading. Decisions still have to be made, which makes it important that leaders understand what is known, what remains an assumption and where there are still gaps.
The panel also distinguished between decisions that can be reversed and those that cannot. Taking a system offline may be relatively straightforward to undo. An external statement or notification based on incomplete information is much harder to retract. Leaders need to establish what must happen immediately, what can wait and whether further information could change the decision they are about to make.
People, communication and culture
A major incident draws on people from across the organisation. Security, technical, communications, legal, operations and senior leadership all have a role in the response, while the rest of the business still has to run.
Some of the most important roles can also be the easiest to overlook. Someone needs to maintain an accurate record of events, log decisions, track actions and keep everyone working from the same information. Organisations need depth around these lynchpin roles too, with people who can step in if those responsible for logistics, communications or organising the response are unavailable.
The process itself needs to be simple enough to work under pressure. When nerves are frayed and adrenaline is flowing, people need a clear structure they can follow rather than something so complicated that it becomes another problem to manage.
Then there is capacity. Who takes over from someone who has worked through the night? Who covers their normal role? Who tells a senior leader to step away, eat or sleep because fatigue is affecting their judgement? And if some of your most capable people have been pulled away from their day jobs to manage the crisis, who is keeping business as usual running?
Communication becomes harder when the organisation does not have all the answers. Waiting for certainty can leave a vacuum that media, employees, customers and others begin to fill themselves, so leaders need to be comfortable saying what is known, what is still being established and when people can expect the next update.
The way people work together matters too. They need to be able to challenge one another, question assumptions and say when something does not feel right. A serious incident can also put an organisation’s stated values under pressure, particularly when the interests of employees, customers, investors, legal advisers and reputation do not neatly align. How people behave and the decisions leaders make in those moments tell you a great deal about the culture that existed before the crisis began.
A plan will only tell you so much
Against a backdrop of increasing global threats, businesses may feel they cannot afford the time or cost to properly prepare and test their crisis management plans. But can they afford for a crisis to be managed poorly?
One analogy used during the discussion was professional sport, where far more time goes into practice than performance. The same principle applies here. An organisation may have a crisis plan and people may broadly know their responsibilities, but that does not show how the team will work when information is incomplete, pressure is high and decisions have real consequences.
Good exercises bring those difficulties to the surface. Remove the person everybody relies on. Make the normal communications channel unavailable. Introduce conflicting information. Cut off access to an important supplier or system. Ask what the minimum viable version of the business looks like if a critical dependency disappears.
The panel also stressed understanding the risks that are relevant to the organisation, mapping the software, suppliers and other dependencies the business relies on and building scenarios around them. Exercises can then show what a written plan cannot: how people behave, where decisions get stuck, whether the information reaching leaders is useful and whether people will challenge one another when they disagree.
No organisation can know exactly what its next serious incident will look like, but it can understand the risks that matter to the business and give the people who will lead the response experience of working through difficult situations together. As someone put it during the discussion, having a plan does not necessarily mean you can successfully deploy it.