Crisis Management for the CIO

1. The CIO and Crisis Leadership, an examination of the role of the CIO when failure presents itself. “If anything can go wrong, it will”

2. Crisis By definition a crisis is: A crucial or decisive point or situation; a turning point. An unstable condition, as in political, social, or economic affairs, involving an impending abrupt or decisive change.

4. Complexity of systems is a variable usually directly affected by the inter-relationship of software and hardware and can be thought of in terms of MTTR or Mean Time to Repair or Mean time to recovery depending on the type of system.

7. Reliability is the key to success of systems

8. MTTR will be the key to restoring systems to a success state.

9. MTTR requires planning and resources usually under the control of the CIO (redundant systems, spares on the shelf, etc.)

10. MTBF is built in to systems and cannot be measured definitely and is not under the absolute control of the CIO.

11. The point of failure can be only estimated and never predictable with any accuracy.

12. Responsive crisis management can reduce MTTR.

14. Duties of the CIO as an Incident Commander Overall field management of the emergency as it relates to CIO’s area of authority; Coordination with Management and/or other senior managers. The CIO of the firm’s Emergency Response Team should co-locate and coordinate with the Fire or Police Department IC (an element of ‘Unified Command’) if the crisis is large enough to have external responders; Ultimate responsibility for the safety of their staff; Approval of all plans and resources; Situational analysis; Setting objectives and priorities; Delegating authority as necessary; Function as primary responder until others arrive.

15. The full NIMS ICS structure

16. ICS Management Concepts Common Terminology Modular Organization Management by Objectives Incident Action Planning Manageable Span of Control Incident Facilities and Locations Comprehensive Resource Management Integrated Communications Establishment and Transfer of Command Chain of Command and Unity of Command Unified Command Accountability Dispatch/Deployment Information and Intelligence Management

17. What works and doesn’t Weaknesses in incident management are often due to: Lack of accountability, including unclear chains of command and supervision. Poor communication, due to both inefficient uses of available communications systems and conflicting codes and terminology. Lack of an orderly, systematic planning process. No common, flexible, predesigned management structure that enabled commanders to delegate responsibilities and manage workloads efficiently. No predefined methods to integrate interagency requirements into the management structure and planning process effectively.

18. What works and doesn’t When applying the Incident Command System to the business/industrial setting, you need: Templates for doing things right such as forms and procedures in written form that are familiar to the likely staff and other responders. Organization and Focus on strategic, as well as, tactical applications. Creation of superior information flow is of particular importance for a CIO. Creation of a function based structure that practices upward, as well as, downward management. Maximization of resource throughput through cross training and functional backups. Creating a seamless vertical and horizontal structure that enhances communications throughout the incident command system.

19. Beyond the ICS

20. Odds and Ends Mitigation and restoration must be the mantra of the CIO. This is the first priority. How do we restore damaged or lost items? When it is all over the thought the CIO put into the backup and disaster recovery policies and practices will be tested. Hopefully they work as intended. Hopefully the CIO has tested the various activities and in fact they worked as intended. From experience this is an area of gray hair. How do we prevent this from occurring again? If the CIO can’t say with a straight face to his or her bosses that “here is what I am doing so it will either never happen again or if it does the outcome will be less disruptive”, they should find another line of work. The framework for preparation? Is there an atmosphere supported by the CIO that takes disaster / crisis planning seriously. Since people only respect what you inspect, this means the CIO must be actively engaged not a just delegate the responsibility. How to flex the response when we do not know the full extent of the crisis is an art. The CIO must be fast on their feet and have the ability to think through the “what if” questions. Keys to adaptive responses are motivated and committed staff with the right training and education both in the methods of ICS but also the understanding of the department and its systems. Execution and follow-up are the keys. A flawless execution that has no follow-up is almost as bad as a failed execution.

23. Buy my book only $19.95