SPP - Ch1 ESRM, Crisis Management Flashcards
What is essential to ensure recovery from business interruptions and to protect the profitability of the enterprise?
Planning
Even with emergency planning, why is it necessary to improvise and remain flexible when a disaster or other emergencies strikes?
Because the variety of emergencies make planning for every possible contingency impossible.
What are the elements, the primary training of emergency response personnel should focus?
The most likely situations and the location, construction, size and function of each site.
While developing a plan for emergency management what elements should be included in the plan?
The development of a plan for emergency management includes:
1. Defining emergency
2. Establishment of an organization to perform specific tasks, before, during and after an emergency.
3. Esablish a method of using available resources and for obtaining additional resources at the time of an emergency.
4. A means from moving normal operaitons into and back of the emergency mode of operations.
What should an emergency plan provide?
The basis for orderly action and for making decisions that minimize loss.
What are the four elements of emergency management?
Mitigation, preparedness, response and recovery.
How is it possible to prevent from causing substantial loss from an emergency?
By responding promptly to an emergency.
To achieve what business continuity encompasses all the actions taken by a business before, during or after an emergency?
To minimize the emergency’s negative impact on the organization’s operations and to bring a timely response, resumption of critical business functions and recovery if an emergency does occur.
What kind of activities are included in the recovery efforts of emergency management?
Recovery efforts include implementation of continuity of operation or business resumption plan, activations of emergency relocation and reconstitution or restoration at the original location or a new permanent location.
What are those key elements to achieve the objectives of emergency management?
What is to be done and who is to do it.
Explain the term continuity of operations (COOP).
Continuity of operations or COOP is a term normally applied specifically to the US federal government. COOP is different from Business Continuity in that it entails movement of critical functions and personnel to an alternate operating site or sites in accordance with a pre established COOP plan.
What is an effective tool that can be utilized in the developmental stage of an emergency plan for determining the probability of a threat or a disaster, and its impact on an organization?
To conduct a risk analysis
An organization needs to develop an emergency plan depending on what factors?
On the nature of the organization’s activities, the organization’s criticality, its attractiveness as a target, and the type of facilities it occupies, among other considerations.
After what type pf action, each emergency plan should be evaluated and modified?
The emergency plan should be evaluated and modified as required after the following
1. Each training drill
2. Each emergency
3. Changes in personnel or their responsibilities
4. Changes in the facility’s physical design
5. Changes in policies or procedures.
Why does an all hazard approach works well?
An all hazard approach recognizes that many emergency planning requirements are similar regardless of whether an accident is natural threat, a human threat or an accident
In choosing a planning format for an emergency, what are the significant considerations?
The dissemination of the plan and the maintenance of the plan.
While developing emergency operations plan what kind of approaches can be undertaken?
The emergency planning approaches are:
All hazard approach
Stand alone plans
A combination of all-hazard and stand alone
How is it possible to make emergency plan effective?
Every emergency plan should be reviewed and updated regularly.
Why is it essential that all emergency plans are reviewed at least once an year?
To ensure that all dynamic information such as floor plans, contact numbers, key personnel, and key assets are accurate.
Why is the all hazard approach better in comparison to the stand alone approach?
The all hazards approach is relatively simple and it is easier to disseminate information common to multiple emergencies like emergency contact numbers. On the other hand, in a series of stand alone plans, there is a need to update every plan each time common points of contacts or emergency number changes.
An EOP developed with _________ approach will address preparedness and response aspects of business continuity.
the all hazards approach
Who can make risk analysis more manageable in an organization?
Managers directly involved in day-to-day operations.
What is the purpose of an emergency plan?
To highlight the type of problems that decision makers and other key emergency management personnel will encounter and to require them to consider, in advance, how to react when an emergency develops.
What is an effective plan?
A plan must reflect the requirements of the organization to which it pertains.
All persons tasked with responsibilities must clearly understand their responsibilities and be trained to fulfil them.
The plan must be tested through practice and should be revised in light of such testing.
It might need revisions, reassignment of responsibilities or retraining of personnel and thereafter retesting.
What is the most important part of planning?
It is a continuous process that is never finished as long as the plan exists.
Why are emergency tests and exercises conducted?
Checking the workability of a plan or a part thereof
Determining the level of staff awareness and training
Evaluating the adequacy of emergency communications
Identifying shortcomings in evaluation procedures.
What are the elements that scope of the emergency training in the organization depends?
The scope of the training depends on the nature of the entity’s activities. Additionally, it depends on its employees, its recurring visitors, contractors and others who have frequent access to the facility.
How to validate an organization’s emergency plan?
Conduct an unannounced test with appropriate controls and safeguards in place.
What kind of special planning needs to be addressed in the development process of emergency plan?
Special planning needs such as personnel with disabilities, including those of vision hearing, mental function and mobility.
To control losses, a business needs emergency response systems. What should be the components of emergency response systems?
People, equipment and procedures
In setting priorities in EOP, certain time tested principles should be applied to the protection of life. What could be those principles?
Evaluation and shelter
Personnel protection
Relief and recue
What are the guiding principles for minimizing injuries?
Design safety and training
In developing EOP, why planning assumptions are considered?
Planning assumptions reduce the number of “what ifs.”
What could be done to avoid gap in emergency plan maintenance?
There should be a designated alternative by name or position.
After designating primary and alternate decision makers, what are important things to do?
It is important to brief, train and test them on their assigned duties and on most significant aspects of the planning process.
Who should and should not handle emergencies?
A totally new organization should not be developed to handle emergencies. Existing organizations, temporarily reconfigured, along with executives responsible for the day to day operations of the enterprise should handle emergencies.
Who is one of the most important considerations in developing an emergency management structure?
To designate alternatives for the primary decision maker and for anyone else who is charged, by name or position, with a particular responsibility under the plan.
What are the primary elements of an Incident Command System?
Command
Operations
Planning
Logistics
Finance and Administration
Based on what an organization ultimately determines its level of response during crisis or an emergency?
The nature and scope of the emergency.
When the unified command is established?
If incident involves multiple agencies or multiple jurisdiction.
What types of elements dictate the location and scope of EOC/CMC?
The size, nature and location of the organization.
In emergencies that develop during non working hours, telephone communications and electrical power may be severed preventing contact with appropriate executives and making road travel to the facility impossible. In such a situation, the initial implementation of the plan and control of the facility may rest under whom?
With the senior manager present at the site, who in some cases may be a security manager, security supervisor or security officer.
What pre-requisites must be fulfilled by the primary and alternate EOC/CMC?
The primary and alternate EOC/CMC locations should be able to accommodate the CMT and should provide redundant communication capacities. Additionally, the location should have backup power and an independent supply of portable water.
What is the most important ingredient in effectively managing an emergency event?
Communications
If an incident requires a public safety response, who is normally the incident commander?
The senior member of the responding agency.
Where are successions list recorded?
In a written emergency plan
To avoid confusion, what should an emergency plan provide?
The orderly release of information, preferably through a single source in the organization.
In forming a mutual aid association, an organization’s emergency planners take a few steps. What are those steps?
- Obtain advise, assistance, and guidance of the government representatives responsible for disaster planning.
- Invite local industies, utilities and other businesses to send representatives to an organizational meeting.
- Arrange to have the group addressed by someone experienced in the operation of a mutual aid association.
- Elect association officer and appoint a coordinator.
- Appoint communities to develop plans and procedures for various aspects of mutual aid operations such as membership and bylaws, traffic and security control, fire protection, communications.
- Schedule periodic meetings
What is the purpose of the mutual aid organization?
The purpose of the mutual aid organization is to establish a workable emergency management organization that minimizes damage and ensures the continued operation or early restoration of damaged facilities.
When should the names of those who have been killed or injured in an emergency be released?
ASAP but relatives of victims should be informed before such information can be released to the public.
What can pose a serious challenge in an emergency?
Aiding the welfare and morale of employees and their families.
During or post crisis situation, what may have an extremely negative effect on public perception of the organization?
Any missteps connected to media relations
While developing the medical services portion of an emergency plan, what planners should ascertain first?
The type and capabilities of an in-house medical support.
With regards to fire and rescue operations, why a distinction needs to be made between industrial and non industrial facilities?
Because industrial facilities may have a volunteer in house fire and rescue operation; however, non-industrial facilities, particularly office buildings, operate differently. Their occupants are typically instructed to identify the problem, notify the appropriate authorities and evaluate the affected areas.
Why a survey of neighbouring installations should be conducted regularly?
To ascertain the existence of any potential hazards that could aggravate the impact of the crisis for the organization.
During an emergency, looting is a hazard that must be considered because spectators are attracted to any disaster scene. To maintain security and protect the assets and personnel, what measures should be undertaken?
Deployment of additional security personnel
While planning for alerts and warning system, why outdoor as well as indoor warning systems must be considered?
Because individuals might be outdoors during an emergency.
Why should alert and warning systems be tested periodically?
So that employees can experience and become familiar
What should be considered during emergency evacuation?
- Need to think well beyond simple sounding an alarm and asking the building occupants to move to the nearest emergenct exit.
- Consider alternate exits, routes and assembly points.
- Use of these alternates must be practiced regularly.
- Evacuation drill should continue till all occupants have reached the designated assembly points.
- The emergency plan needs to provide for shelter in place for situations where evacuation is infeasible or undesirable such as hazmat release, tornado, earthquake.
In evacuation planning, organizations must consider alternate exits, routes, and assembly points. Furthermore, use of these exits must be practiced regularly. What is one way to do so?
Block the primary exit for a different exit for a different floor or part of a building for each fire drill.
For which type of crisis situation, emergency plan should provide shelter in place?
When evacuation is infeasible or undesirable such as hazmat release, tornado, or earthquake.
During emergency shutdown, who may be the last to leave the facility or establishment when an evacuation is ordered or who may even have to stay in the facility?
Emergency shutdown crew
If restoration has been planned, recovery is less difficult and more efficient. What can simplify emergency operations?
Developing a list of key recovery items simplifies emergency operations.
Define business continuity
A comprehensive managed effort to prioritize key business processes, identify significant threats to normal operations, and plan mitigation strategies to ensure effective and efficient operational response to the challenges that surface during and after a crisis.
What is the use of a business impact analysis?
To identify an entity’s critical functions
To assess the impact of a disaster or other emergency on those functions over time
To determine the other elements of the business on which those critical functions depend, and
To help develop and prioritize recovery strategies.
What is organizational resilience?
The adaptive capacity of an organization in a complex and changing environment and also it is the ability of an organization to resist being affected by an event or the ability to return to an acceptable level of performance in an acceptable period of time after being affected by an event.
What elements should be included in business continuity strategies?
Depending on the nature and needs of the business, business continuity strategies may include resumption and recovery in place, the contracting out of selected functions, or relocation of critical functions and personnel to one or more sites.
Who can find emergency or crisis overwhelming?
Those who have done no planning or preparation
What are the elements the primary training of emergency response personnel should focus?
The most likely situations and the location, construction, size and function of each site.
In large organizations with multiple locations, it is essential to ___________to ensure proper coordination throughout various sites.
require an overall emergency operations plan
Emergency response requires
organization and structure.
If an incident command system needs to be formally implemented due to the size of the incident,____________.
it would be a single incident command.
If the incident involves multiple agencies or jurisdictions, then ___________.
a single command structure is typically established.
With whom security professionals should built relationships?
Security professionals should build relationships with public safety and supply chain partners, conducting joint drills and other exercises.
What is the major function of emergency response?
Coordinating across multiple groups and departments with differing responsibilities is a major function of emergency response.
When should planners take a wide range of agencies and individuals?
Planners should take a wide range of agencies and individuals into account when developing an emergency plan.
Information that may be obtained from some of these entities and other organizations can be of great value in _________.
developing and implementing the emergency plan.
True or False?
In large organizations it is common for the senior leadership team to be separate from the CMT. This allows the senior leadership team to focus on strategic decisions that affect the organization’s strategic goals.
True.
Explanation: This allows the senior leadership team to focus on strategic decisions that affect the organization’s strategic goals.
True or false?
Effective crisis planning includes all areas within the organization that can be activated if necessary.
True
The crisis team list should describe what all for each person on the team?
Their role in the incident
Critical contact information and
Alternate chain of command.
What are the three types of crisis team?
Operational team
Tactical crisis team
Strategic crisis team
What should be the goal of continuity planning?
Save lives and reduce chances of further injuries or deaths
Protect assets
Restore critical business processes and systems
Reduce the length of the interruption of business
Protect reputation damage
Control media coverage (e.g. local, regional, national, or global)
Maintain customer relations (ASIS BCM 2021)
Effective crisis management includes all areas within the organisation _____.
that can be activated if necessary.
It is common for the senior leadership team to be separate from the CMT in ______.
Large organizations.
What gives great value in developing and implementing the emergency plan?
Information that may be obtained from some of the entities and other organizations.
What is essential in large organizations with multiple locations?
An overall emergency operations plan.
What is essential to ensure recovery from business interruptions and to protect the profitability of the enterprise?
Planning
What is a key part of preparing for an emergency?
Developing a plan.
What is the emergency planning format depends on?
The nature of the organization and the organization’s policy.
What is the best course of action for planning for organizations that are exposed to a variety of different types of threats and hazards?
An All Hazards Approach
What is an All Hazards Approach?
This approach provides for a basic emergency operations plan (EOP), with sections that apply to multiple emergency situations.
What is an Emergency Rendezvous Point?
The location that should be selected in advance to meet and brief the responding services in an emergency.
To control losses, a business needs emergency response systems that can rapidly deploy to threatened locations and be supported operationally. What are these systems?
People, equipment, and procedures.
Emergency plan should provide for ___________ for situations where evacuation is not possible.
Shelter in Place.
One of the most important ingredients in effectively managing an emergency event is______________.
Communications
What should be considered while planning an emergency warning system?
Ambient noise and distance.
Sirens, Flashlights, Strobe Lights, Hooters and visual signs are examples of __________.
Warning Systems
Responsibility of emergency shut down should be assigned to
People familiar with the process.
If _________has been planned, recovery is less difficult and more efficient?
Restoration.
The emergency plan should give priority to the ___________ after the emergency.
facility structure
To whom should the emergency plan with contact numbers be distributed to?
To control centres and senior personnel with plan implementation responsibilities.
Some organizations prepare a list of alternatives for key members of emergency management team. What is this list called?
Emergency succession list
How can asset protection be ensured in emergency situations?
By not involving all security personnel in disaster or fire control activities. Also additional security personnel may be needed to maintain security and protect assets from looting.
What is key to ensuring understanding and useability of emergency plan?
Training and testing
When does crisis management begin?
Crisis management begins upon notification of any disruptive event.
When should crisis communication plan be developed?
It is essential to have a crisis communication plan prepared in advance so that less time is spent determining what to say, how to say it, and by whom.
What are elements of a crisis communication plan?
Planning, Training, Exercising, Response and Recovery
What are elements of a crisis communication plan?
Planning, Training, Exercising, Response and Recovery
Who is the communication advisor or lead?
It is typically the most senior communications person in the organization and is ultimately responsible for crisis communications.
The handling of information concerning casualties is an important aspect of ___________.
human resources and public relations.
Why is photographic coverage of incident scene important?
For insurance and legal purposes
Who helps to make risk analysis more manageable?
Managers directly involved in day to day operations
What is a critical but often misunderstood part of emergency planning?
The planning process is critical and often misunderstood.
During an emergency it is best to avoid answering questions with ____________.
No comments.
To avoid confusion, the emergency plan should provide for the orderly release of information, preferably through _________________.
a single source in the organization
Setting priorities for asset protection and risk response planning is the responsibility of _________________.
the business risk owners.
The word __________ often causes us to think immediately of evacuation as the primary response, but different types of crisis event can have different ideal responses.
emergency
The crisis management team must be documented in the ______________.
crisis management plan.
The most important part of the CCP is ____________.
the actual communications section.
CCT members, as well as designated spokespeople, should receive _________communications training.
Annual
____________facilities may have a volunteer in-house fire and rescue operation.
Industrial
In setting priorities, what are certain time tested principles that should be applied to the protection of life?
Evacuation and shelter
Personal protection
Relief and Rescue
What should be the considerations for emergency planning?
- Shelter
- Data search
- Assembly Areas
- Special Item Removal
- Alerting neighbours
- Shut down procedures
- Security
- Emergency Rendezvous point
What are the reoccupation considerations that should be involved in emergency plan?
- Decisions
- Search
- Client and customers
What are the guiding principles for preventing or minimizing injury?
Design safety
Training
Who are the key members of a Crisis Communication Plan?
Senior Communications Advisor/Lead
Crisis Communications Team Lead
Crisis Communications Team (CCT)
Incident Command Staff
Why are emergency tests and exercises conducted?
*Checking the workability of a plan or a part thereof;
*Determining the level of staff awareness and training;
*Evaluating the adequacy of emergency communications; and
*Identifying shortcomings in evacuation procedures.
The rule should always be: train to the plan and exercise the plan. True or False
True
What are the aspects of a crisis management plan?
*Crisis management team;
*Crisis management activation and escalation;
*Crisis command and management succession;
*Crisis recovery logistics and resources; and
*Crisis communications.
The incident policies and procedures are tested through _________.
tabletop to full scale exercises and drills.
What are the categories of a crisis?
natural or environmental, human, active, or cyber-based threats
Natural or environmental, human, active or cyber based threats are examples of
crisis
Methods of emergency drills, policies and procedures are__________.
Table top or full scale exercises and drills.
Inclement weather can pose a serious threat to _____________.
property, critical infrastructure and lives.
What improves the organization’s security culture and strengthens stakeholder’s trust in ESRM?
Transparency.
What seeks to transition the security professional from a delegate role to a partner role?
ESRM
A key outcome of a security risk assessment is to establish _________.
Risk prioritization
What is the objective of ESRM?
To identify, evaluate and mitigate the impact of security risks
What is root cause analysis?
A technique used to identify the conditions that initiate the occurrence of an undesired activity or state.
What is a method of managing security risks?
Enterprise Security Risk Management.
What is ESRM?
ESRM is a strategic approach to security management that ties an organization’s security practice to its overall strategy using globally accepted and established risk management principles. It is a management process or system.
How is ESRM different from traditional program based security management?
It is not built around a security program.
It identifies all risks, prioritizes risks and develops specific mitigation steps.
ESRM does not assign a risk to a specific program.
Security managers transition from the delegated role of a security function to a trusted advisor to asset owners.
Security manager becomes a strategic resource for the organization.
In ESRM asset owners own decisions for the risks to the assets they manage.
What are the major misconceptions of ESRM?
The first misconception is that ESRM is simply convergence or the joining of a traditional security program, corporate security, or physical security with information security/cybersecurity under one leadership.
The second misconception is that ESRM is enterprise risk management (ERM).
What are the benefits of ESRM?
- Bring more resources and perspectives to the risk management process.
- Security professionals are trusted advisors and strategic partners as opposed to tactical owners of security programs.
- Security professionals can more effectively communicate and partner with asset owners.
- Will be better at risk identification and prioritization.
- As security professionals communicate with different stakeholders, they get better at prioritizing risks and formulating mitigation plans.
- With a risk-based approach, they can be more innovative in problem-solving.
- Security professionals can provide a broader depth in value and assist in reducing security and security related risks.
- There are fewer incidents and reduction in the impact of incidents.
- Budgets are more managable and supported.
- Security profesisonals can be asked to participate in other strategic areas.
What are the benefits of ESRM to an organization
- ESRM enhances the organization’s resilience, event response and crisis management.
- ESRM enables critical risk decisions at the enterprise level, & better supports its mission and objectives.
- Allows asset owners to gain a broader and consistent understanding of the security function and security risk.
- Top management is able to better see key security risks.
- ESRM provides early identification and proactive monitoring of a broader range of risk.
- Security resources are better aligned to mitigate prioritized risks.
- ESRM improves understanding by and better engagement with stakeholders.
8.ESRM provides better support for related legal, regulatory, and contractual functions and issues.
9.ESRM provides a platform for security to become better integrated into the organization’s culture.
What are the three components of ESRM?
The context of ESRM
The ESRM Cycle
The foundation of ESRM
What is the first step in the new understanding of ESRM?
Bolstering the understanding of the mission and vision of an organization. It begins with a clear understanding of the products and services of an organization.
Some important notes
How to adopt ESRM
The context of ESRM
Knowing key staff and leadership along with the organization’s operating structure will allow the security professional to smoothly navigate throughout the organization and find and build key relationships.
It is also critical to learn legal requirements and regulations that impact the organization and that the organization must follow.
Long-term strategic plans and goals are the roadmap for the organization. Being fully aware of both will help the security professional support their management partners and make decisions that will enable the organization to reach its goals.
An organization’s core values can indicate how well ESRM and its emphasis on partnership, collaboration, and transparency might be received by the corporate culture.
What are arguably the pinnacle of organizational strategy?
The organization’s mission and vision are arguably the pinnacle of organizational strategy.
What are the roadmap of an organization?
Long-term strategic plans and goals are the roadmap for the organization
What are the points to consider while evaluating value and culture?
*How does the organization handle change?
*What is the organization’s risk tolerance/risk appetite?
*Are some business units more open to working with security than others?
*What do employee surveys indicate for value, culture, and change?
*Is there effective communication with all stakeholders in the organization?
*What are key motivators for the organization?
What are the three kinds of operating environments?
Physical, non physical and logical.
Who is a champion?
An asset owner with whom the security professional has worked and has an existing relationship
What is the most defining characteristics of an ESRM cycle?
The most defining characteristic is its emphasis on understanding organizational assets and involving asset owners in the risk management process.
What are the four processes of ESRM cycle?
- Identify and prioritize assets;
- Identify and prioritize risks;
- Mitigate prioritized risks; and
- Continuous improvement.
Whatever is the scope for the ________ is also the scope for ESRM.
The security professional
Top management
Asset owner
Answer: The Security Professional
What are the four critical concepts that comprise of the foundation of ESRM?
Holistic risk management
Partnership with stakeholders
Transparency
Governance
What are the types of transparency relevant from the perspective of ESRM?
Risk transparency
Process transparency
What does a documentation framework consist of?
Policies, standards, guidelines and procedures.
What is the asset value based on?
The cost of purchasing or replacing the asset
The operational impact of unavailability of the asset through a business impact analysis
The effects of harm to the asset.
The time required to replace the asset
The reputational impact from unavailability of the asset.
What are the activities a security professional should perform for identifying and prioritizing security risks?
Asset and security risk association
Risk assessment
Risk prioritization
Risk tolerance, appetite and capacity
Why does risk identification require expansive thinking?
Because risk can arise from inside or outside the organization.
What are the different types of risk treatments?
Acceptance, transference, spreading, avoidance and mitigation
Which are the three security functions that contribute to continuous improvement (in ESRM)?
Incident response
Investigations and analysis
Information sharing.
How does the process of investigation and analysis help in the continuous improvement of a security program?
Identifies possible areas of increased optimization in the management of specific risks
Improves effectiveness of responses and mitigation methods
Helps to identify root cause
Enables ongoing refinement and prioritization of information collection.
What requires engagement with the asset owners and stakeholders to establish organizational policies, standards, and procedures to identify, monitor and manage enterprise security risks?
Successful and sustainable implementation of ESRM.
When implementing ESRM, the security professionals should have a comprehensive understanding of the organization’s ______.
Mission and vision
Core values
Operating environment
Stakeholders
What is an integral component and driver of corporate culture?
Organization’s core values
What is essential to assess risks?
That the security professional understands the operating environment of the organization.
What are the three main categories of the operating environment?
Physical, non physical and logical.
What is the total amount of risk exposure that an enterprise wishes to undertake?
Risk Appetite
How can a security professional bring ESRM practice to maturity and maintain high performance over time?
By continuously repeating the ESRM cycle.
A thorough and integrated risk mitigation approach includes creating cohesion between __________.
People, Process and technology.
What improves the organization’s security culture and strengthen stakeholder’s trust in ESRM?
Transparency.
A key outcome of a security risk assessment is to establish _________.
Risk prioritization
