Two months ago, I published my first blog post which represented my best effort to explain the role of a security consultant, at least from my point of view. I mentioned my various experiences that I hoped to share with family offices and corporate clients to help them reduce their exposure to security risks and prepare for both the known and unknown. Little did I know at the time of my last writing that one month later the entire world would be upside down dealing with a life threatening and insidious virus that did not respect wealth, ethnicity, gender or geography. While we've seen pandemics and life threatening viruses before, not in our lifetime had we seen a disease like COVID 19 that could move so rapidly, affect so many people and cause more economic damage than we could ever imagine. As a people we are currently in the survival mode and have not yet begun to process both the direct and indirect consequences of this pandemic.
What was most amazing to me, both personally and professionally, was to observe firsthand the "normalcy bias" where friends and colleagues summarily dismissed the impending crisis despite the compelling data and warnings emanating from the medical community. I was dismayed at families who insisted on keeping their spring break international travel plans after consulting with "experts" who assured them that COVID 19 was all hype and far less of a threat than the annual flu bug. Where are those experts now?? But I digress...
Hype or not, we are now smack in the middle of a full blown pandemic management plan, complete with quarantines, invocation of the Defense Production Act and military supplementation. It's all hands on deck. Automobile manufacturers, grocery clerks and sewing clubs are all rising to the occasion to meet the need for resources to fight this war of the microbes. But beyond that, from a security and brand risk management point of view, i'm preaching to my clients that we cannot permit ourselves to be completely distracted from our core protection responsibilities. Managing COVID 19 is a huge job, but we still have a day job to contend with which in many cases is now harder because we have less resources and more risk factors to contend with.
Whether you're reading this blog as business leader, security professional or curious web surfer, here's what my security and risk management experience has taught me that we should be doing now, in no particular order:
1) It's never too late to start preparing; we are in the first of many phases of COVID 19 so you should be thinking about how to prepare for future phases, including permanent changes to workflow and business processes, employee travel, duty of care, high risk terminations, etc. Get ready for the next pandemic, it's right around the corner.
2) There have been many mistakes and many lessons learned; don't miss the opportunity to capture them and make adjustments. This can be a competitive advantage for businesses (and families) that accept their failures and commit to learn from them.
3) The criminal element savors distractions of this nature and magnitude; they will seek to exploit, purloin, defraud, and embezzle your physical and digital assets. Employees under stress and fearing termination will be tempted as well. Maintain your access control, security and compliance policies in full force to the extent possible.
4) If you will be reducing your workforce, be prepared for the backlash and have your plans in place to handle employees who have a history of violence, substance abuse, or behavioral problems. Do you know how to file a trespass warning? Is your behavioral threat assessment team assembled and ready? Can your Employee Assistance Program serve as a helpful resource to your employees during times of stress and uncertainty?
5) Technology and connectivity with your employees is paramount but that's not all there is to maintaining engagement. Your message and the way you communicate virtually cannot be the same as a physical town hall meeting. The value of individuals in your workforce who have real experience in virtual or online training has never been greater.
6) Crisis management calls for a number of actions, including preservation of your precious human capital. COVID 19 is a marathon, not a sprint so be mindful of burnout and anxiety-for you and your staff. Don't worry about maintaining all your day to day business functions, concentrate on the CRITICAL functions. You need to ensure you have a healthy workforce once we emerge from this crisis. Mobilize Employee Assistance Program resources for your workforce and remind your employees about it. Repeatedly.
7) As a corollary to the above, ensure your succession plan and delegations of authority are in order. No single points of failure.
Business and personal continuity plans and assumptions are now being validated or shattered by this real life crisis. What are your thoughts, opinions and insights?