asis conf 2014: tabletop exercises for bcp
Post on 08-Jun-2015
405 Views
Preview:
DESCRIPTION
TRANSCRIPT
Test Emergency PlansWith
Tabletop Exercises
Robert Carotenuto, CPP, PCI, PSPDouglas HegleyBruce SeglerSeptember 30, 2014
Robert Carotenuto, CPP, PCI, PSPAssociate Vice President for SecurityThe New York Botanical Garden
Arts & Crafts
rcarotenuto@nybg.org
Set and forget it!
rcarotenuto@nybg.org
The Big Question
rcarotenuto@nybg.org
Metrics
rcarotenuto@nybg.org
One Step at a Time
rcarotenuto@nybg.org
See the forest . . . and the trees
rcarotenuto@nybg.org
Chasing Headlines
rcarotenuto@nybg.org
It’s tough to make predictions, especially about the future.
rcarotenuto@nybg.org
Murphy’s Law
rcarotenuto@nybg.org
It ain't over 'til it's over!
rcarotenuto@nybg.org
Scenario• Thursday, February 2, 2011
• You arrive in the morning to find the following scenario:
• An electrical fire has occurred in your office area overnight.
• Sprinklers extinguished the flames, but there has been extensive fire, water and smoke damage to the entire office area. Your computers, paper files, and office furniture are a total loss.
• Museum objects have not been affected; this is only a business interruption.
rcarotenuto@nybg.org
Resources
rcarotenuto@nybg.org
I’m in control here!
rcarotenuto@nybg.org
Perfect Practice
rcarotenuto@nybg.org
… You may not even need a table!
Douglas HegleyDirector of TechnologyMinneapolis Institute of Arts
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Psychology? This BCP needs some serious
analysis
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Psychology of Preparing for a Bad Event
1. Learning and motivationa. Intrinsic v. Extrinsicb. Memory/Thought Action
2. Deniala. “It won’t happen here”
3. Resistancea. “Not now, I’m too busy”b. “This is just too much, we can’t possibly learn it all”
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Resistance is … NaturalHumans *instinctively* respond to any type of stress with
anxiety and suspicion, leading to resistance
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Overcoming Resistance
1. CommunityCohortsPartnership
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Overcoming Resistance
1. CommunityCohortsPartnership
2. Practice Repetition
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Overcoming Resistance
1. CommunityCohortsPartnership
2. Practice Repetition
3. Experiential learningLess talking, more doing
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Honesty+
Confidence
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
(The BCP Tabletop Edition)
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
*
* Well, maybe not “everything”
Scenario(s)Potentially a very deep and complicated rabbit holeK.I.S.S!
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Top-level buy-inDriven by Executive Leadership
… and they make great surprise guests!
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Cross-functional team
SecurityIT
Core Business Unit
Exec Sponsor And more …
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Transparency
• Clear & frequent communication• Demonstrate adaptability
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Conducting a (tabletop) Exercise
Set aside time and space Consider offsite location if feasible
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Conducting a (tabletop) ExerciseSet aside time and space
Consider offsite location if feasible
Documents:Checklist/outline of critical processesResources requiredAction Plan – to be completed during the session
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Conducting a (tabletop) ExerciseSet aside time and space
Consider offsite location if feasible
Documents:Checklist/outline of critical processesResources requiredAction Plan – complete during the session
Emphasize RECOVERYThe emergency is overLet’s get back to business, fast
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Who Attends?Recommend:
Small groups (3-5 individuals)From 2-4 different departmentsSelected with intention – mix ‘em upDecide: Senior and/or Junior staff
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Who Attends?Recommend:
Small groups (3-5 individuals)From 2-4 different departmentsIntentional selection – mix ‘em upDecide: Senior and/or Junior staff
WHY?Opportunities for:
Institutional alignmentTeam-building across the enterpriseIncreased capacity
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Practicing
• Simulation – act it out!• Role-playing
Can be hard to get started• Anxiety and laughter (it’s okay to have fun!)
Emotion + Learning = Higher retention
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
The Power of the Interruption
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Closing Each Session
Reflect, praise results and effortGather feedback from participantsAsk: Single most-important lesson today? Suggestions for improving this process?
Review the written Action PlansSchedule follow-up session
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Don’t Delay, Act Today!
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Do
Learn
Adjust
Do AgainRepeat
Improve
Okay team, let’s debrief on that
last BCP tabletop
They need to document their
procedures
This new iPhone is really big!
I’d like to see more concentration!
The action plan was solid
Including junior staff
was helpful
Keep At It!
Twitter: @dhegleyhttp://www.slideshare.net/dhegley
Disaster Tabletops
Bruce Segler
Security Operations Manager
The J. Paul Getty Trust
September 29, 2014
Ready for…
Earthquake Damage Sustained at Getty Research Institute; Santa Monica, California 1994
Flood Damage; Getty Research Institute, Getty Center 1999
Getty Center
Grand Theft Auto
The Getty Center
Bel Air Fire; November 5, 1961
Bel Air Fire; November 5, 1961
Bel Air Fire; November 5, 1961
Sepulveda Canyon Fire; Getty Center 2009
Sepulveda Canyon Fire; Getty Center 2009
Arts & Crafts
Table Top Exercises in Getty Center E.O.C.
Robust Security Training
SATURDAY
Hans Hoffman-“A Hare in the Forrest”N 102
Emergency Site Evacuation Drills
Tram Evacuation Drills
Questions?
top related