Setting up a crisis communications centre: Jobs

To print: Select File and then Print from your browser's menu

--------------------------------------------------------------
This story was printed from ZDNet Australia.
--------------------------------------------------------------

Setting up a crisis communications centre

By Peter Rogan, TechRepublic
September 06, 2004
URL: http://www.zdnet.com.au/jobs/soa/Setting-up-a-crisis-communications-centre/0,139023216,139158356,00.htm

Reestablishing your organisation's IT capabilities takes ample planning before a disaster or a crisis happens. Here's how to plan for putting together a crisis communications centre when you need to connect your business with the rest of the world.

The crisis communications centre (CCC) is the nexus for all communications among the teams involved in disaster recovery. It serves to eliminate confusion, establish confidence among working partners, and act as the single point of contact between the organisation and all external bodies. Not all communications will be routed through the CCC, but it will set the rules by which all disaster recovery communications will be conducted.

Although the term "crisis communications centre" evokes images of banks of phones and swarms of bustling clerks, its primary attribute is simplicity. The CCC is a single point of contact between the affected organisation, its leadership, and the outside world. Most of the time this will be a single trusted individual connected to the organisation by phone, Internet, or personal contact.

The CCC establishes the three most critical communications needs in the event of a disaster: control, veracity, and authority.

Prerequisites

Three things are needed for any crisis communications centre: the equipment to operate it, the personnel to staff it, and the rules by which it will operate. Location is not a primary concern. If the disaster is limited to a portion of the site affected, the CCC will be on the premises. If the disaster prevents the whole site from being used, the CCC will be located at a preestablished backup site specified in the organisation's disaster recovery plan.

Equipment
A CCC will need to include the following equipment:

A landline phone, multiple lines optional, with a voicemail system
A PC running the applications needed by management as specified in the disaster recovery plan
An e-mail program compatible with the company standard and with a known and verifiable address, preferably within the company's domain and firewall
A fax machine and copier
Furniture for the equipment and operator(s)

Typically this equipment will be available at the affected location outside the disaster zone. If the disaster encompasses the entire site, it must be provided at the backup location, if present, or at a temporary crisis communications location determined by management. Note that all e-mail addresses, phone and fax numbers, and other contact information will be in the disaster recovery plan that each manager must have with them.

Personnel
The crisis communications centre will be staffed by at least one senior administrative assistant who is knowledgeable in the disaster recovery plan. Above all, this person must know the command structure and be familiar to all the management teams involved in disaster recovery.

Depending on the size of the organisation and its disaster communications needs, more personnel may be required, particularly for multiple shifts. Whenever possible, all personnel should be internal to the organisation.

Rules
The most basic rule is this: The crisis communications centre is responsible for establishing and maintaining control over communications, for the veracity of the information, and for speaking with the authority of leadership. The following documentation must be present:

The disaster recovery plan for the affected unit and all contact listsÃ¢â,¬"verified and datedÃ¢â,¬"for management and the affected teams
Guidelines in the crisis communications policy for establishing and controlling internal and external communications

Additionally, any requirements established for the particular situation by management and senior management, which must be documented when they are received and used, need to be at hand.

Setup: in-house

For most disasters, the crisis communications centre will operate out of the senior manager's administrative assistant's office. When the contact numbers and addresses are known, the authority and veracity of the person do not need to be established, and control is not an issue. Equipment and information will be in place or provided as per the disaster recovery plan. The most critical part of the setup of any CCC is establishing its role in the handling of disaster recovery-related communications. It is far easier to do this from the original location, even if it must be done from a side office on borrowed equipment.

If several staffs occupy the same location, leadership may move to have a single common crisis communications centre established to be manned in the event of disaster involving one or more staffs. The common CCC needs to be established under the leadership responsible for all the staffs sharing the facility, so that responsibility and costs are centralised. No one staff should be made to bear the full cost, even if the common CCC is located in its area. This location, once established, should not be changed, and it should not be used for any other purpose.

A common CCC has the advantage of having common hardwareÃ¢â,¬"including fax machines, copiers, and phone linesÃ¢â,¬"and common software. Maintenance and upkeep of the equipment should be the responsibility of the leadership over all the staffs sharing the facility. If specialised hardware and software is required, provisions for installing those items at the time of the disaster should be made in each affected disaster recovery plan and should be tested at the same time as the rest of the plan (the same goes for deinstallation at the conclusion of testing or actual disaster.)

Check with your telephone and security representative to insure there is no problem with multiple crisis communications centre personnel having access to the same voicemail account.

Setup: alternate location

Some disasters are so extensive that use of the original facility is not permissible. For such situations, two possibilities exist: a permanent alternate site, with equipment and furniture in place, or no permanent alternate site, and the crisis communications centre must be reconstituted. A permanent alternative site will need to have been established by agreement with the permanent residents of that site; often these are reciprocal agreements, where Group A agrees to share its space and resources with Group B in the event of displacement due to disaster, and Group B agrees to do the same if disaster befalls Group A.

Rarely an alternative site will be available without a current occupant; the disaster recovery plan will specify what the alternatives are.

Permanent alternative site

If within the same company, even if not the same division, the first task of the CCC will be transmitting to all disaster recovery participants the declaration of disaster, along with the CCC contact information, including e-mail addresses (if different) and who will be on the phones. The CCC contact will have this information captured on the crisis communications centre information sheet, ready for transmission. While this information needs to be captured in the disaster recovery plan, circumstances may require different locations or phone numbers. The CCC contact needs to capture and document this information as soon as possible.

No permanent alternative site

Establishing the crisis communications centre is top priority, along with reestablishing communications among the leadership as provided in the disaster recovery plan. The minimum requirements are a phone number and an e-mail address that will both be available throughout the duration of the disaster. If no provision has been made for alternates within the same company prior to disaster, then these must quickly be established and promulgated to leadership.

In most cases, none of the required equipment will be immediately available. Procurement can be expected to be a problem.

For that reason, in the absence of alternatives, the crisis communications centre may need to be located in a residence. At short notice the existing computer, if any, must be brought up to the standard on the CCC information sheet, and other necessary equipment, hardware, and software must be provided as listed.

This solution is less than optimal. Communications cannot be secured, computer hardware may not be upgradeable to the needed standard, access cannot be controlled, and as a result, corporate information needed for disaster recovery may not be placed in this location without violating company confidentiality or data security.

Because of this, leadership is encouraged to work with senior management to provide a common crisis communications centre. The costs for equipping and staffing this common CCC can be shared, while data security is not compromised and the company's phone system, e-mail system, and computer assets may be used with minimal hindrance.

Please note that while a common crisis communications centre can reduce costs for several staffs, it should not be used across large regions where the staffs may be separated by several kilometres, making transportation a problem. Nor can they be used verticallyÃ¢â,¬"that is, a common crisis communications centre should not be used for multiple reporting levels of an organisation, but only for staffs at the same reporting level. This avoids communication mistakes that would be easily avoided by routing through the respective levels of leadership.

Activation checklist

In the event of a declared disaster, getting the crisis communications centre up and running is the first activity. To make sure no errors exist that would hamper communications and recovery efforts, the CCC contact is responsible for the steps needed to get the CCC operating in minimal time. The activation checklist poses a series of go/no go questions to insure a smooth launch. Top management should have the CCC contact test the activation of the CCC at least once a quarter using the activation checklist to make sure all preparations are in place and to identify any problems.

The steps are numbered and are used as follows:

1. Disaster declared?
Has management made the formal decision to declare a disaster? This step must precede all others, even in a drill.

2. CCC location available?
Is the physical space for the CCC accessible, and can the CCC contact actually enter it? If this space is normally secured, a member of the building support or security team may need to open it. This step should be documented in the disaster recovery plan and added to this activation checklist as necessary.

3. Information sheet confirmed?
Is all the information complete and current? Any gaps must be filled for activation to be successful.

4. Equipment sheet confirmed?
Is all the equipment listed on the sheet present or on its way? This should be a quick visual check. Any missing equipment that cannot be quickly replaced can hamper or limit activation and operation.

5. Primary phone live?
Is there a dial tone? Is voicemail active? Can voicemail be accessed? Any problems must be noted and dealt with as soon as possible.

6. Secondary phone live?
The same questions for any secondary phone. Skip if none, or if fax access is critical, test it now.

7. PC functional?
Does it boot normally? Does the desktop or security screen appear as normal?

8. Password/ID functional?
If the CCC computer is not tested more often than the default ID deactivation interval set by the company's information security policy, the ID may not be functional and access to the system will not granted. Make sure this does not happen. If reset is not possible, document the fact and the reason.

9. E-mail functional?
Does the e-mail package launch normally and present its logon screen? For corporate onsite systems, this is not a major point of failure. However, this is critical for offsite locations.

10. E-mail password functional?
If the CCC e-mail account is not accessed sooner than the ID deactivation interval set by the company's information security policy, the onsite CCC may not have e-mail access. For offsite locations, e-mail security may need to be established to prevent access by other persons. Such security should be applied before an actual disaster occurs to avoid errors during activation.

11. Web access present?
Does the primary browser launch and show the homepage? Internet access is more and more a critical business need, and a source of news and information is important for the crisis communications mission. If this is a test, note the present status of the firewall and antivirus software and whether they are up-to-date.

12. Contact list available?
The test of any communications plan is how well it works when it is broken. The contact list from the disaster recovery plan or even the normal company directory is absolutely vital to reestablishing communications and the chain of command. Ideally, the CCC contact should have a fresh copy in hand.

13. DRP present?
The disaster recovery plan, along with the critical communications policy, directs how communications in a disaster should be handled and what expectations are on the actors. The CCC contact must have a copy, preferably a duplicate of the master copy with all subdocuments possessed by the business unit manager.

14. Top manager alerted by phone?
The top manager needs to be informed at this point that all technology and information assets are in place for the crisis communications centre to operate.

15. Top manager alerted by e-mail?
The top manager is sent confirmation by e-mail that electronic crisis communications are now active. An active response should be required for acknowledgment of function.

16. Direct reports alerted by phone?
The top manager's direct reports are now phoned and informed that the crisis communications centre is now active and to expect confirmation by e-mail that they need to acknowledge on receipt. If voicemail group lists are used, they must be reviewed for completeness and recency during testing. Any failures must be logged and reported to the top manager.

17. Direct reports alerted by e-mail?
The direct reports are sent confirmation by e-mail that the electronic crisis communications are now active and that they need to acknowledge receipt. Any failures must be logged and reported to the top manager.

18. Additional equipment in place?
If additional computer hardware or other fixtures (burn bag, portable hard drive, portable CD burner) are needed for the CCC mission, their presence or arrival and installation should be noted here after communications have been sent. Any delays in testing should be noted for improvement later.

19. Additional information in place?
If additional information (electronic, paper, or other media) is required for the CCC mission, its presence or arrival should be noted here after communications have been sent. Any delays or missing information showing up in testing needs to be noted for improvement later.

20. All questions answered?
The final step of activation is to review any questions that came up in the course of activation and whether or not they have been satisfactorily answered. All questions not answered by the time Step 19 has completed need to be recorded and presented for improvement and possible modification of the disaster recovery plan. Otherwise, the crisis communications centre is now active until management declares the disaster is over.

Crisis communications centre deactivation

The final action of disaster recovery is for the crisis communications centre to announce the formal end of the effort and to declare the crisis communications centre closed. At deactivation, the crisis communications centre contact should review the activation checklist, steps 2 through 11 and 19, and make sure the equipment and access needed are still present and functional before closing the physical site. Please note that your company information security policy may require an audit of any offsite computing devices to make sure no proprietary data is left behind. Any noted defects in the machinery, the protocols, or the process should be preserved for the next disaster recovery plan review.

Everything should now be ready when disaster comes again.