A few years ago, I was a speaker at a series of Windows
IT Pro events about security. Mark Minasi was also
a speaker and would claim that he knew the secret
to being a security guru and was going to teach it to everyone
in the audience. He would then ask the audience to stand
up and repeat after him: "The … sky … is … falling." Funny.
Of course, this joke does beg the question: What would you
do as an IT manager if someone came to you—from your
company's security team or elsewhere—and made this
exclamation? In any crisis situation, perceived or real, the
speed at which decisions are made and the pressure felt by
the individuals making them can lead to mistakes. Here are
three rules to follow when you're managing a crisis situation.
With a little practice, you can make dealing with emergencies
as routine as a trip to the grocery store.
Rule 1: Stay Calm
Stay calm, both inwardly and outwardly. Becoming agitated
will negatively affect your decision making and could spread
panic. The people around you will likely become excited,
emotional, and fearful—particularly if they feel they might
be at fault. Be sure to smile, thank people for their help, and
keep a positive yet realistic attitude. Your staff will be looking
to you to be a leader and need to believe that the crisis will be
averted or resolved, so it's your job to remain in control.
Rule 2: Drive for Certainty
Part of what drives panic in a crisis is the unknown. To
remove this pressure, drive for certainty from the outset. As
people bring you information, calmly ask where it came from,
how it can be verified, and who is responsible for reporting
any change in the information to you. Doing so will help
you separate facts from fancy. If the alleged disaster really is
a disaster, you need to be able to make decisions based on
verifiable facts as often as possible, or else risk spending time
on the wrong problems or even amplifying panic. Initially,
you'll want to establish the following:
- What is at risk?—How effectively you respond to the
situation will largely be determined by what's at risk.
Consider the following scenarios: Customers can't use their line of business (LOB) software; a tornado is
approaching the building; a VP can't log on to his or
her computer. Each of these situations might constitute
an emergency that you have to deal with, but each is
unique because of what's at risk—the business continuity of a division, human safety, or the business continuity
of a user (albeit an influential one).
- Who was the first observer?—Determining who the first person was to observe the situation helps you establish
a timeline in which to place other observations, and also
provides an excellent place to start investigating the facts.
- What is the scope of the symptoms?—Determine exactly
what's affected and when it was affected. Plot the logical
and physical locations on a diagram and log the time on
the master timeline. Plotting these things will help you
look for the cause of the problem and for what might be
affected next.
- What would a successful outcome entail?—Determine
early on the successful resolution to the crisis so that you
can focus your efforts on success rather than on chasing
dead-end leads or getting lost in details. For example,
if an LOB application isn't available to a call center, the
immediate goal is to restore the service, whether you
find the source of the problem or not. You might solve
the problem by initiating a business-continuity plan to
move users to a different LOB server or by switching to a
manual backup process.
- Who else needs to be involved?—From the previously
mentioned items, determine who you need to work with
to successfully reach the goal that you've identified and
what information and assistance you'll need and when
you'll need it.
Rule 3: Communicate
Clearly and Consistently
Few things amplify a crisis like confusion. On a whiteboard
or wall, use Post-it Notes to create four columns, each with a
heading describing the trust level of its information: Verified
fact, Believed to be true, Rumor, Untrue. Place each piece of
information that's reported to you into the appropriate column. Regularly report the overall status of the situation, the
information gathered according to rule 2, and any other relevant information (along with the corresponding trust level),
to the appropriate stakeholders. Over time, try to move all the
information that's reported to you into either the Verified fact
Untruecolumn.
Controlling Crisis Situations
Following these three fundamental rules will make responding to any incident less taxing for you and everyone around
you. These rules will help you control the emotions, uncertainty, and confusion that are all endemic to a crisis situation.
In reality, situations in which the sky is falling occur rarely, but
practicing this column's advice—even in the course of routine
operations—will prepare you for the worst.
End of Article
Register
