A Crisis Preparation Organizational AssessmentTable Top Case Study Project

DYNM 672: A Systems Approach to Crisis Preparation and Building Organizational Resilience Dr. Steven Freeman Spring, 2011

Are we prepared?

Scott YaroshApril 27, 2011

2

Crisis Preparation Assessment: Table Top Case StudyTable of Contents

Table of Contents– Project Presentation

• Objective of Project• Executive Summary of Approach• Crisis Scenarios used in Table Top Exercise• Pictures – Setting the Tone• Crisis Scenario Concerns from Team• Key Findings• Team Action Plans

– Appendix• Crisis Planning in Pictures• Crisis Scenario Talking Point Prompts• Scenario 1 Additional Information• Crisis Scenario Concerns from Team - Details• Post Table Top Feedback - Details• References

3

Crisis Preparation Assessment: Table Top Case StudyProject Objective

Objective: To assess the overall readiness / preparedness of the Vanguard IT Technology Operations Architecture Office to deal with, by sheltering-in-place, significant crisis events.

4

Crisis Preparation Assessment: Table Top Case StudyExecutive Summary - Project Approach

• Table Top Exercise– Tech Ops Architecture Office – 8 people volunteered from team– 2 Hour session– 3 Scenarios of escalating urgency– Shelter-in-place directive(s)– Potential concerns from each scenario– Additional discussion points prompts– Survey of shelter-in-place compliance – Action Plans

• Post Table Top– Education handout regarding shelter-in-place– Education handout regarding dirty bombs/Cesium 137/

psychological help– Feedback gathered, post table top

1

2

5

Scenario 1• Press Announcement on KYW and TV: Heightened Terrorist Alert

for the US and Major Shopping Malls: (Code Orange)

• Department of Homeland Security Secretary Janet Napolitano says: “Recent interceptions of cell phone conversations indicate special concerns about security in and around our nations largest shopping malls.”

• Vanguard Data Center, secretly nestled 3.8 miles from King of Prussia Mall– King of Prussia Mall is the largest mall in the USA by sq. feet

• It’s 1:30 PM on Thursday, December 8th

• 48 degrees; sunny day; winds are at 5-10 mph from the NE; similar weather predicted for the next few days

3

4

6

Scenario 2• Code Red: Simultaneous explosions at 9:35AM, Friday,

December 9th at King of Prussia Mall

• Rumors of “dirty bombs” abound. PEMA (Pennsylvania Emergency Management Agency) advises “shelter in place.”

• Crew members still arriving at work

• People coming to work arrive shaken; “could new arrivals be radioactive?”

• In service day for teachers in the surrounding school districts. Wife mentioned something about taking the kids shopping.

7

Scenario 3• December 9th 4 PM – perpetrators have been identified but not

caught. Al Qaeda has claimed responsibility for the bombings

• On KYW and the web, reports of death, destruction

• Confirmed: Cesium Cs-137 radioactive material in detonated devices; PEMA renews advisory to shelter in place

• Paoli, Chester County, and Norristown Hospitals overflowing with MUPS (medically unexplained physical symptoms)

• Cellular communication has been non-existent most of the day

8

Pictures – Setting the Tone

9

Scenario 1 ResultsTeam Concerns

• Stay away from mall – potential danger area• Traffic gridlock? How would people get away if they needed to?• Does our failover work to our other data center, Nortech?• Is our primary data center in immediate danger?• Should we send people to Nortech? Send people home? Franklin Mills and Neshaminy

malls are near Nortech.• Do we share any infrastructure (electric) with the mall?• Are my kids and wife in the mall?• How bad is the warning?• Are we desensitized to the code colors?• Would Vanguard tell senior management to stay away from all malls?• Should I make some phone calls to check in on family• Go out to web to see if more info exists and what Orange means. Any more data? Can

I get more info?• Should we consider sending crew (employees) home?

10

Scenario 2 ResultsTeam Concerns

• Find shelter wherever you are! – where?• Make phone calls – whereabouts of family?• Cells circuits are flooded – now what?• Land line circuits are not available either!• If didn’t know where wife was, would not leave building – wife/spouse was a

primary concern• Perhaps text message would work – communication with family needed• One person left immediately – should we stop him?• Manager needed to calm people down – could that happen?• Would radiation go through the walls? Would need lead lining?• Is it a personal decision to stay or go? Ethical decision? • Concerns about supplies, food – do we have any?• Water contamination?

11

Scenario 3 ResultsTeam Concerns

• What’s the long term plan?• What if it’s really long term?• Do we have people in the environment who are

contaminated?• What is Vanguard telling us?• What are the expectations from a business perspective?• Have to risk venturing out at some point?• What happens with Cesium? Cesium impact declines substantially after two days? • Electricity? How long will backup generators work?• Was the attack a diversion? Is Limerick Nuclear Power Plant on lockdown?• In looking for family, would we all become contaminated?• How much safety do windows provide? • If wife and kids are at mall, then I should go!?• Supplies: Preparedness: Not good!?

– Water concerns– No real extended food supply– Need a strategic food supply– No duct tape– No plastic sheeting

• Get in the car and drive?

12

Key FindingsOverall Summary• So, are we prepared to shelter-in-place for a serious crisis

event?

– Straight forward answer: No - it certainly did not feel that way.

– Physically - no supplies of food, water, tape, etc.

– Process – do not really understand the shelter-in-place process, who can leave, when can they leave, what do we do if someone wants or even demands to leave? Can they be stopped!?

• Thinking through and knowing what to do in that first 5 minutes is critical.

– And most importantly, …

– Emotionally – family concerns were paramount. It trumped any feeling of loyalty to company and role. If family safety was unclear or unknown, the emotional response to get to them at all costs was a major driving force of response.

13

Team Action Plans• Plan! Do we have a plan? - Create a generic kit and plan for any type of disaster.

– Need a plan and supplies for work!• Need a discussion of shelter-in-place. Roles, responsibilities, timing, communications.• Supplies – food, water, duct tape, plastic sheeting, etc.• Talk with Mike Curry – invite to TOAO staff meeting; Include Victor D. and Bill L. Discuss education on scenario

planning & shelter in place planning. Want to understand the mechanics of the building and the overall integrity of building.

• Hard pressed to stay more than 24 hours – discuss this aspect.• Discuss resiliency – emotional views.• Create a leadership plan – Who is responsible for what?

– Need a plan and supplies for home!• 3 days worth of supplies, minimum• Emergency kits• Stock up on dry foods, water, etc.• Create communication plan with wife – family plan – default understanding of where people will go; walk through • Call relative or a contact out of region to relay information• Buy hand crank radios and flash lights for home• Buy batteries

• We need to know what we’d do in that first 5 minutes.

14

Appendix

15

Crisis Preparation Assessment: Table Top Case StudyCrisis Planning In Pictures

16

Scenario 1 Discussion Points

• What if anything should we do to the heightened alert?

• What is the real likelihood of danger?– Probability wise, small likelihood.

• Is there a physical security issue?– Mysterious packages? AK47’s?– For us at the data center, not really concerned about

physical security?• What should we be thinking about the situation?

Should we just go about our business?

17

Scenario 2 Discussion Points• How likely would you be to shelter-in-place if we were instructed to do so? Survey vote:

– Very likely? 7– Somewhat likely? 0– Not very likely? 1– Very unlikely? 0

• 30 min in, what if wife/kids are out? Could be at the mall – TBD. Can’t get in touch to verify one way or another. Survey vote:– Very likely? 3– Somewhat likely? 2– Not very likely? 2– Very unlikely? 1

• Do we have anyone saying they want to leave the building? How would we deal with that?

• How will we get updated information on the status of the situation?• How are we dealing with crew members just getting to work? Is everyone accounted for?• Do we have sufficient supplies for shelter in place? For how long could we survive?

18

Scenario 3 Discussion Points• What is the primary risk that needs to be addressed at this time?• What is happening to our workplace?• How do we deal with fear? How do we handle people with physical or

psychological symptoms?• How do we keep in touch with the outside world, people, family?

19

Scenario 1 Additional Information

20

Feedback, Post Table Top Exercise• Scott, it was a great session. Really made me think about how unprepared we are both at work and at home. My responses to the questions would remain

unchanged – I would not shelter-in-place. I love Vanguard and feel very blessed to work here. However, my family is everything to me and their welfare would be my top priority in a crises situation. That said, if Vanguard had a well thought out communication plan (ex: walkie-talkies) I would feel compelled to offer system support or other services once my family was safe.

• Scott, No change to my reply - still very likely [to shelter in place]. I had an interesting conversation with my wife on this yesterday which confirmed my answer, justifications and my continued decision on the shelter in place action. She felt that I would be foolish to enter the probably chaos in the area to go 'searching' for her and possibly my kids (despite the scenario description it would be highly unlikely that she, along with both or either one of my sons would be at King of Prussia). Being a health care professional she's been through these types of exercises at her hospital and their recommendation is to never go to the scene of the event (going home is a different response but equally risky when there are so many unknowns). We also talked about our preparation and surprisingly, probably by dumb luck, we're actually more prepared than I thought. Our problem is we do not have any types of action plans and we've never talked to my boys on what to do, so that's high on our list of To-Dos. Overall, it was a very interesting and thought provoking exercise. I appreciate the opportunity to participate. It really got me thinking on the way home from work as to where I would go and how I'd react. Good stuff.

• There is nothing changed for me [after thinking more about it] ; so I am still "Very Likely“ [to shelter in place]. I feel it's important to have more crew members to participate in this discussion, which will help them understand and be prepared for these type of events!! Overall, I am not prepared!! My action plan is to start the discussion with my family focusing on communication, supplies and shelter in place.

• Whether I’d shelter in place after thinking about it more?...I'd say very likely. I was definitely unprepared (personally at home), and unsure that I would have the patience to stay confined in the data center for any extended period of time. It also appears that we are unprepared in the data center facility for any long confinements. We would at least additional food / water / communication devices in areas accessible to the people who are sheltering in place. Like most low-probability dangers we are most likely going to push this out of our minds. It's likely a much higher probability you will die from natural causes or accident but you see how people avoid even doing paperwork like wills. There are so many things to do and so many things to spend money on that this will get ignored until something actually happens that affects us.

• Somewhat likely [to shelter in place]. Additional Thoughts: Not that prepared, many basic things at home in terms of food and emergency supplies, but no real communication or 'meet-up' plan in case of such a situation. Definitely makes you think and can become difficult as you go deeper into it because it forces you to imagine some very tragic scenarios. But definitely important and worthwhile - better to think about it and be ready, than not and get caught off guard. Reflections: be happy, enjoy each day and be prepared for the worst just in case.

• I did talk with my wife about this last night and we are going to talk more about it in the future. As a dad, this is scary stuff, but it was a very useful exercise to discuss it. Unlikely to stay [if asked to shelter in place].

• Still not likely [to shelter in place]. I thought the exercise was valuable in that it's a subject that most people typically don't spend any time thinking or talking about in their day to day lives. Problem with that is that when disaster strikes, you won't be in a position to react in an effective way, you'll be in panic mode. So, personally, I left the meeting feeling pretty underprepared as far as having the right supplies on hand as well as a plan to be able to take care of my family if something bad were to happen.

21

References1. (2011). Retrieved April 2011 , from:

http://www.nationalterroralert.com/readyguide/shelterinplace.pdf2. (2011). Retrieved April 2011 , from: https://www.llis.dhs.gov/index.do3. Gartner Data Center Conference (2010). Eagle Rock, Enterprise Resiliency Planning

Solutions, Las Vegas Nevada.4. (2011). Retrieved April 2011 , from:

http://en.wikipedia.org/wiki/List_of_largest_shopping_malls_in_the_United_States