Copy of presentation given at the ASIS Conference in Atlanta, Sep-Oct 2014. Co-presenters included Robert Carotenuto from the New York Botanical Gardens and Bruce Segler from the Getty Trust in Los Angeles. We discussed Business Continuity Planning, emergency response planning, and tabletop exercises to help help staff prepare and practice real life scenarios.

1. Test Emergency Plans
With
Tabletop Exercises
Robert Carotenuto, CPP, PCI, PSP
Douglas Hegley
Bruce Segler
September 30, 2014

2. Robert Carotenuto, CPP, PCI, PSP
Associate Vice President for Security
The New York Botanical Garden

3. Arts & Crafts
rcarotenuto@nybg.org

4. Set and forget it!
rcarotenuto@nybg.org

5. The Big Question
rcarotenuto@nybg.org

6. Metrics
rcarotenuto@nybg.org

7. One Step at a Time
rcarotenuto@nybg.org

8. See the forest . . . and the trees
rcarotenuto@nybg.org

9. Chasing
Headlines
rcarotenuto@nybg.org

10. It’s tough to make predictions,
especially about the future.
rcarotenuto@nybg.org

11. Murphy’s Law
rcarotenuto@nybg.org

12. It ain't over 'til it's over!
rcarotenuto@nybg.org

13. Scenario
• Thursday, February 2, 2011
• You arrive in the morning to find the
following scenario:
• An electrical fire has occurred in your
office area overnight.
• Sprinklers extinguished the flames, but
there has been extensive fire, water
and smoke damage to the entire office
area. Your computers, paper files, and
office furniture are a total loss.
• Museum objects have not been affected;
this is only a business interruption.
rcarotenuto@nybg.org

14. Resources
rcarotenuto@nybg.org

15. I’m in control here!
rcarotenuto@nybg.org

16. Perfect Practice
rcarotenuto@nybg.org

17. … You may not even need a table!
Douglas Hegley
Director of Technology
Minneapolis Institute of Arts
Twitter: @dhegley
http://www.slideshare.net/dhegley

18. Psychology? This BCP needs
some serious
analysis
Twitter: @dhegley
http://www.slideshare.net/dhegley

19. Psychology of Preparing for a Bad Event
1. Learning and motivation
a. Intrinsic v. Extrinsic
b. Memory/Thought Action
2. Denial
a. “It won’t happen here”
3. Resistance
a. “Not now, I’m too busy”
b. “This is just too much,
we can’t possibly learn it all”
Twitter: @dhegley
http://www.slideshare.net/dhegley

20. Resistance is … Natural
Humans *instinctively* respond to any type of stress with
anxiety and suspicion, leading to resistance
Twitter: @dhegley
http://www.slideshare.net/dhegley

21. Overcoming Resistance
1. Community
Cohorts
Partnership
Twitter: @dhegley
http://www.slideshare.net/dhegley

22. Overcoming Resistance
1. Community
Cohorts
Partnership
2. Practice
Repetition
Twitter: @dhegley
http://www.slideshare.net/dhegley

23. Overcoming Resistance
1. Community
Cohorts
Partnership
2. Practice
Repetition
3. Experiential learning
Less talking, more doing
Twitter: @dhegley
http://www.slideshare.net/dhegley

24. Honesty
+
Confidence
Twitter: @dhegley
http://www.slideshare.net/dhegley

25. (The BCP Tabletop Edition)
Twitter: @dhegley
http://www.slideshare.net/dhegley
*
* Well, maybe not “everything”

26. Scenario(s)
Potentially a very deep and complicated rabbit hole
K.I.S.S!
Twitter: @dhegley
http://www.slideshare.net/dhegley

27. Top-level buy-in
Driven by Executive Leadership
… and they make great surprise guests!
Twitter: @dhegley
http://www.slideshare.net/dhegley

28. Cross-functional team
Security
IT
Exec
Sponsor And more …
Core Business
Unit
Twitter: @dhegley
http://www.slideshare.net/dhegley

29. Transparency
• Clear & frequent communication
• Demonstrate adaptability
Twitter: @dhegley
http://www.slideshare.net/dhegley

30. Conducting a (tabletop) Exercise
Set aside time and space
Consider offsite location if feasible
Twitter: @dhegley
http://www.slideshare.net/dhegley

31. Conducting a (tabletop) Exercise
Set aside time and space
Consider offsite location if feasible
Documents:
Checklist/outline of critical processes
Resources required
Action Plan – to be completed during the session
Twitter: @dhegley
http://www.slideshare.net/dhegley

32. Conducting a (tabletop) Exercise
Set aside time and space
Consider offsite location if feasible
Documents:
Checklist/outline of critical processes
Resources required
Action Plan – complete during the session
Emphasize RECOVERY
The emergency is over
Let’s get back to business, fast
Twitter: @dhegley
http://www.slideshare.net/dhegley

33. Who Attends?
Recommend:
Small groups (3-5 individuals)
From 2-4 different departments
Selected with intention – mix ‘em up
Decide: Senior and/or Junior staff
Twitter: @dhegley
http://www.slideshare.net/dhegley

34. Who Attends?
Recommend:
Small groups (3-5 individuals)
From 2-4 different departments
Intentional selection – mix ‘em up
Decide: Senior and/or Junior staff
WHY?
Opportunities for:
Institutional alignment
Team-building across the enterprise
Increased capacity
Twitter: @dhegley
http://www.slideshare.net/dhegley

35. Practicing
• Simulation – act it out!
• Role-playing
Can be hard to get started
• Anxiety and laughter (it’s okay to have fun!)
Emotion + Learning = Higher retention
Twitter: @dhegley
http://www.slideshare.net/dhegley

36. The Power of the Interruption
Twitter: @dhegley
http://www.slideshare.net/dhegley

37. Closing Each Session
Reflect, praise results and effort
Gather feedback from participants
Ask:
Single most-important lesson today?
Suggestions for improving this process?
Review the written Action Plans
Schedule follow-up session
Twitter: @dhegley
http://www.slideshare.net/dhegley

38. Don’t Delay, Act Today!
Twitter: @dhegley
http://www.slideshare.net/dhegley

39. Learn
Do
Adjust
Do Again
Repeat
Improve

41. Okay team, let’s
debrief on that
last BCP tabletop
They need to
document their
procedures
I’d like to see more
concentration!
This new
iPhone is
really big!
The action plan
was solid
Including
junior staff
was
helpful

42. Keep At It!
Twitter: @dhegley
http://www.slideshare.net/dhegley

43. Disaster Tabletops
Bruce Segler
Security Operations Manager
The J. Paul Getty Trust
September 29, 2014

44. Ready for…

45. Earthquake Damage Sustained at Getty
Research Institute; Santa Monica,
California 1994

46. Flood Damage; Getty Research Institute,
Getty Center 1999

48. Getty Center
Grand Theft Auto

49. The Getty Center
Bel Air Fire;
November 5, 1961

50. Bel Air Fire;
November 5, 1961

51. Bel Air Fire;
November 5, 1961

52. Sepulveda Canyon Fire;
Getty Center 2009

53. Sepulveda Canyon Fire;
Getty Center 2009

54. Arts & Crafts

55. Table Top Exercises in Getty Center E.O.C.

56. Robust Security Training

57. SATURDAY
Hans Hoffman-“A Hare in the
Forrest”
N 102

58. Emergency Site Evacuation Drills

59. Tram Evacuation Drills

60. Questions?