Mo Flashcards
(103 cards)
Emergency Management Definition
Any formal process used by an organization to prepare for and respond to disasters and emergencies.
Reference: Chapter 1, Section 1.1, Page 15, Paragraph 118
Four Cyclical Elements of Emergency Management
Mitigation: Protective measures to reduce likelihood or impact (e.g., flood barriers, fire-rated elements).
Preparedness: Activities, programs, systems developed before an incident to support mitigation, response, and recovery.
Response: Executing the plan to preserve life/property and provide services.
Recovery: Reestablishing processes, resources, and capabilities to meet ongoing operational requirements, possibly including improvements.
Reference: Chapter 1, Section 1.1, Page 15, Paragraphs 121, 122, 124, 125, 127, 128
Crisis Management Definition (ASIS BCM Guideline)
A holistic management process identifying potential impacts, providing a framework for resilience, ensuring effective response to safeguard stakeholders, reputation, brand, value-creating activities, and restoring operational capabilities.
Reference: Chapter 1, Section 1.2, Page 17, Paragraph 149
Goal of Crisis Management
To protect core assets (reputation, brand, financial wellbeing, trust, property, relationships) from harm caused by a business-interrupting event.
Reference: Chapter 1, Section 1.2, Page 17, Paragraph 153
Crisis Management Principles
Management often responds with limited information and time. Disruptive events need prompt reporting to the crisis management team. Planning identifies criteria to distinguish a crisis from a routine incident. Evaluation and response require procedures, planning, training, and rehearsal. All employees must know how to report and escalate events.
Reference: Chapter 1, Section 1.2.1, Pages 17-18, Paragraphs 157, 158, 160, 161, 162
Business Continuity Management (BCM) Definition (ASIS BCM Guideline)
A proactive set of planning, preparedness, and related activities intended to restore an organization’s critical business functions to predetermined levels, enabling operation despite serious disruptive events and expeditious recovery.
Reference: Chapter 1, Section 1.3, Page 18, Paragraph 163
Business Continuity Management (BCM) Definition (DRI International)
A management process that identifies risk, threats, and vulnerabilities impacting continued operations, providing a framework for resilience and effective response capability.
Reference: Chapter 1, Section 1.3, Page 18, Paragraph 164
Business Continuity Strategies Objective
Resume critical functions quickly and restore the business to its pre-emergency condition/location, or to a new location/level if necessary.
Reference: Chapter 1, Section 1.3, Page 18, Paragraph 166
Influential BCM Organizations/Standards
ISO Standard 22301:2019.
Business Continuity Institute (BCI) Good Practices Guidelines.
DRI International Professional Practices for Business Continuity Management.
ASIS International Business Standards Institute Business Continuity Management Standard.
Reference: Chapter 1, Section 1.3, Pages 18-19, Paragraphs 171, 172, 173, 174, 175, 176, 177, 178
Purpose of a Response Plan
To define crisis/emergency scope; establish teams; establish resource methods; provide means for mode transition; provide framework for testing/maintenance.
Reference: Chapter 2, N/A, Page 21, Paragraphs 186, 187, 188, 189, 190
Emergency Coordinator Role
Designated official responsible for the EOP, ensuring smooth response across departments. Should be someone regularly handling emergencies (e.g., head of security/engineering). Needs capability to deal with all organizational levels and requires top management support.
Reference: Chapter 2, Section 2.1.1, Page 22, Paragraphs 198, 199, 200, 201, 202
Emergency Planning Committee
A committee with representatives from critical departments (e.g., legal, HR, medical, IT, security) should assist the coordinator. Response should utilize the existing organization, temporarily reconfigured.
Reference: Chapter 2, Section 2.1.1, Page 22, Paragraphs 204, 205, 206, 207
Importance of Alternate Designations
Designate alternates (preferably more than one) for primary decision-makers and those with specific plan responsibilities. Brief, train, and test both primary and alternate individuals on duties. Proper training/testing are crucial but often challenging to prioritize.
Reference: Chapter 2, Section 2.1.1, Page 23, Paragraphs 209, 210, 211, 212, 213
Incident Command System (ICS)
A command and control mechanism used globally by many public safety agencies (examples: UK Emergency Response and Recovery guidance, US FEMA NIMS, Canada ICS, Australia Emergency Management function). Common features include command, operations, planning, logistics, and admin/finance. A single incident commander ensures coordinated response.
Reference: Chapter 2, Section 2.1.2, Page 23, Paragraphs 213, 215, 216, 217, 219, 220, 221
ICS in the Private Sector
ICS concepts can serve the private sector. Organizations should understand ICS and public sector procedures. Build relationships and conduct joint drills with public safety/supply chain partners. Organizations need an internal incident management system for emergencies not requiring public safety response.
Reference: Chapter 2, Section 2.1.2, Page 24, Paragraphs 229, 230, 231, 232, 233, 234
Planning Liaison Considerations
Planners should account for a wide range of agencies/individuals: emergency responders, cyber teams, management, employees, victims/families, officials, media, neighbors, community groups, protesters. Contacts within these groups can help obtain assistance and coordinate plans.
Reference: Chapter 2, Section 2.2.1, Page 25, Paragraphs 244, 245, 246
Crisis Management Team (CMT) Setup
Critical piece of crisis management. Should have members from Executives, HR, Public Affairs/Comms, Safety/Security, IT, Legal, Finance, Critical Ops Depts. Senior leadership may be separate, focusing on strategy. Team reflects critical groups for business operations. Members identified by position (primary/alternates).
Reference: Chapter 2, Section 2.3.1, Page 26, Paragraphs 248, 250, 251, 253, 255
Roles on the Crisis Team (Examples)
Team list describes role, contact info, alternate command chains. Examples: Crisis Team Leader, Corporate Security, InfoSec, Legal, Public Affairs, HR, Facilities. Team must be named in the plan, familiar with it, and participate in exercises.
Reference: Chapter 2, Section 2.3.2, Pages 26-27, Paragraphs 257, 260, 261, 262
Types of Crisis Teams
Single team may suffice for some orgs. Larger orgs may need teams at different levels.
Operational: Responsible for a segment of functional operation.
Tactical: Function closer to the crisis level (e.g., geographic location).
Strategic: Overarching command, often at management/executive level.
Reference: Chapter 2, Section 2.3.2, Page 28, Paragraphs 263, 264, 265, 267, 268
Goals of Continuity Planning
Save lives/reduce injuries; protect assets; restore critical processes/systems; reduce interruption length; protect reputation; control media; maintain customer relations.
Reference: Chapter 3, N/A, Page 29, Paragraph 274
Components of Continuity Plans
Team members; alternate locations/transport; disruption prep checklists; response checklists; return-to-normal checklists; resource lists; comms paths/templates; financial considerations; specific disruption plans.
Reference: Chapter 3, N/A, Pages 29-30, Paragraph 274
Business Continuity Teams Role
Responsible for enacting the plan to recover business activities after an event. Separate from but supports the overarching CMT. Develops plans for damage assessment, restoration, payroll, HR, IT, admin support. Members recruited based on skills, commitment, interest. Must have input, know roles, respond, and be tested.
Reference: Chapter 3, Section 3.1, Page 30, Paragraphs 276, 277, 278, 279
Requirements for Developing BCM Plans/Procedures (ASIS BCM Guideline)
Establish/implement/maintain plans based on BIA recovery objectives. Document plans/procedures. Should: establish comms protocol; specify immediate steps; be flexible; focus on impact; be based on assumptions/interdependencies; minimize consequences via mitigation. Inform roles/responsibilities for response. Support mission, stakeholders, assess impact. Utilize resources to manage impact. Include arrangements for safety, continuity, event management.
Reference: Chapter 3, Section 3.2, Pages 30-31, Paragraphs 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294
Role of Risk Assessment in BCM Planning
Conduct risk assessment to identify, evaluate, prioritize threats/vulnerabilities and potential impact. Helps understand operational needs and focus continuity initiatives. Identify mission, goals, critical functions/assets, stakeholders first. Identify likelihood and consequences. Conduct early to allow procedure development/practice. Revise as environment changes. May use threat evaluation team.
Reference: Chapter 3, Section 3.2, Pages 31-32, Paragraphs 295, 296, 297, 298, 299, 302, 303, 305