Last updated: November 2015

Scope Crisis

TU Oeucumene can identify strategic, operative and other threats that can cause damage, which may develop into a crisis. Crises can be caused by

1. Physical, such as fires, shooter incidents and other direct threats that can lead to loss of life.
2. Strategic, such as political, financial, university reputation threats
3. Operational threats to the continuation of the primary processes of the University: research and education

The so-called high-priority risk areas include cyber security, data management, corporate reputation and trust, and strategic service delivery as agreed.

Crisis Escalation

The crisis procedure is invoked when

• A member of the Management Team requests the commencement of the crisis procedure.
• If a critical service sustains a service outage which has lasted 24 hours or is determined as likely to do so.

Crisis Management Team

The Crisis Management Team consists of:

• Security manager
• Communication specialist
• Experts/ head of services
  • The service security officer (responsible for service continuity and recovery plan).
  • The service owner or system administrator
• The crisis management team can also include, if necessary:
  • Someone from senior management
  • Human Resources Director
  • Other expert services or service management

Flow of Information

• The crisis management team will set out actions to the different teams
• During a crisis every relevant team will send updates on their actions to the crisis management team every half hour
• The crisis management team will send out updates on the crisis situation and a summary of actions taken to all relevant teams every hour

Procedure Crisis Management Team

Intro

You can use the following procedure to handle the crisis during the exercise. Of course, you are also free to follow another process with your team.

First steps

• Establish a timeframe (when do you need reports back from your teams, when do you want to start communicating etc.)
• Logistics: documentation, location, food and drinks, dedicated phone line (communication devices)

After that, a continuous loop of the next steps:

Situation-analysis.

Getting a clear view of the situation starts with uncovering the facts:

• What is going on?
• What is the situation?
• What is the source?
• What is the cause?
• What are the effects?
• What are the areas of impact?
• How does it affect the safety, security, continuity and reputation of the organisation?
• Is your organisation the victim of this circumstance, or are you responsible for this situation?

Tip: Limit the analysis about the cause of the incident in the beginning to the relevant elements, or else you will lose too much precious time during the next steps.

Scenario-analysis

The second step in getting a clear view of the situation, is assessing the development of the incident.

• How will the crisis unfold?
• What other scenarios can you reasonably expect?
• Consider not only the likelihood that a certain scenario will happen, but also consider the undesirability: what should absolutely be prevented?

Scenario-analysis can lead to managing multiple crises at the same time: the real crisis that is happening at the moment and the crises that have to be prevented at all cost.

Option-analysis.

If the situation and scenarios are clear, you can start with identifying the options.

• What can you do?
• What is your operation framework (handelingskader)?
• What are the short-term options and what long-term actions can you take?

Tip: Do not stop the option-analysis to soon. It is very tempting to immediately use a familiar response for the problem, but don’t forget this is a big crisis. Give yourself some time and put a brake on your ‘action-modus’ for a little while. However, stay alert to act when necessary and return to the option-analysis afterwards.

Consequences-analysis.

The second step in judging the situation is weighing the consequences from the option-analysis.

• What does every separate option mean for the safety, continuity and reputation of your organisation?
• Be aware that every consequence has consequences of its own. Keep asking yourself ‘if we do this, what consequences does that action have?’ until you can’t go any further.

Setting a goal

If you have completed all the steps, you should have enough information to start making decisions. Determine your goal. What do you want to achieve and when? What should you do to achieve this and who has to do this? Make your decisions explicite and formulate your goals SMART (Specific, Measurable, Assignable, Realistic, Time-related).

Actions.

The last step is delegating actions and monitoring the progress of the crisis management. After that you can start again with step 1 of the cycle: getting a clear view of the situation, after you’ve set out actions. Ask yourself:

• Is the situation changing?
• Are the scenarios still developing in the way you predicted?
• Are there new options or have your options diminished?
• What does that mean?
• Will you still reach your goal in time?
• Until you are done.