A Crisis Preparation Organizational Assessment
Table Top Case Study Project
DYNM 672: A Systems Approach to Crisis Preparation and Building Organizational Resilience
Dr. Steven Freeman
Spring, 2011
Are we prepared?
Scott Yarosh
April 27, 2011
Crisis Preparation Assessment: Table Top Case Study
Table of Contents
Table of Contents
– Project Presentation
• Objective of Project
• Executive Summary of Approach
• Crisis Scenarios used in Table Top Exercise
• Pictures – Setting the Tone
• Crisis Scenario Concerns from Team
• Key Findings
• Team Action Plans
– Appendix
•
•
•
•
•
•
Crisis Planning in Pictures
Crisis Scenario Talking Point Prompts
Scenario 1 Additional Information
Crisis Scenario Concerns from Team - Details
Post Table Top Feedback - Details
References
2
Crisis Preparation Assessment: Table Top Case Study
Project Objective
Objective: To assess the overall readiness / preparedness of
the Vanguard IT Technology Operations Architecture Office
to deal with, by sheltering-in-place, significant crisis
events.
3
Crisis Preparation Assessment: Table Top Case Study
Executive Summary - Project Approach
• Table Top Exercise
–
–
–
–
–
–
–
–
Tech Ops Architecture Office – 8 people volunteered from team
2 Hour session
3 Scenarios of escalating urgency
Shelter-in-place directive(s)
Potential concerns from each scenario
Additional discussion points prompts
Survey of shelter-in-place compliance
Action Plans
• Post Table Top
1
– Education handout regarding shelter-in-place
– Education handout regarding dirty bombs/Cesium 137/
psychological help 2
– Feedback gathered, post table top
4
Scenario 1
• Press Announcement on KYW and TV: Heightened Terrorist Alert
for the US and Major Shopping Malls: (Code Orange) 3
• Department of Homeland Security Secretary Janet Napolitano says:
“Recent interceptions of cell phone conversations indicate special
concerns about security in and around our nations largest shopping
malls.”
• Vanguard Data Center, secretly nestled 3.8 miles from King of
Prussia Mall
– King of Prussia Mall is the largest mall in the USA by sq. feet 4
• It’s 1:30 PM on Thursday, December 8th
• 48 degrees; sunny day; winds are at 5-10 mph from the NE; similar
weather predicted for the next few days
5
Scenario 2
• Code Red: Simultaneous explosions at 9:35AM,
Friday, December 9th at King of Prussia Mall
• Rumors of “dirty bombs” abound. PEMA
(Pennsylvania Emergency Management Agency)
advises “shelter in place.”
• Crew members still arriving at work
• People coming to work arrive shaken; “could new
arrivals be radioactive?”
• In service day for teachers in the surrounding school
districts. Wife mentioned something about taking the
kids shopping.
6
Scenario 3
• December 9th 4 PM – perpetrators have been identified but not
caught. Al Qaeda has claimed responsibility for the bombings
• On KYW and the web, reports of death, destruction
• Confirmed: Cesium Cs-137 radioactive material in detonated
devices; PEMA renews advisory to shelter in place
• Paoli, Chester County, and Norristown Hospitals overflowing with
MUPS (medically unexplained physical symptoms)
• Cellular communication has been non-existent most of the day
7
Pictures – Setting the Tone
8
Scenario 1 Results
Team Concerns
•
•
•
•
•
•
•
•
•
•
•
•
•
Stay away from mall – potential danger area
Traffic gridlock? How would people get away if they needed to?
Does our failover work to our other data center, Nortech?
Is our primary data center in immediate danger?
Should we send people to Nortech? Send people home? Franklin Mills and
Neshaminy malls are near Nortech.
Do we share any infrastructure (electric) with the mall?
Are my kids and wife in the mall?
How bad is the warning?
Are we desensitized to the code colors?
Would Vanguard tell senior management to stay away from all malls?
Should I make some phone calls to check in on family
Go out to web to see if more info exists and what Orange means. Any more data?
Can I get more info?
Should we consider sending crew (employees) home?
9
Scenario 2 Results
Team Concerns
•
•
•
•
•
•
•
•
•
•
•
•
Find shelter wherever you are! – where?
Make phone calls – whereabouts of family?
Cells circuits are flooded – now what?
Land line circuits are not available either!
If didn’t know where wife was, would not leave building – wife/spouse was a
primary concern
Perhaps text message would work – communication with family needed
One person left immediately – should we stop him?
Manager needed to calm people down – could that happen?
Would radiation go through the walls? Would need lead lining?
Is it a personal decision to stay or go? Ethical decision?
Concerns about supplies, food – do we have any?
Water contamination?
10
Scenario 3 Results
Team Concerns
•
•
•
•
•
•
•
•
•
•
•
•
•
What’s the long term plan?
What if it’s really long term?
Do we have people in the environment who are
contaminated?
What is Vanguard telling us?
What are the expectations from a business perspective?
Have to risk venturing out at some point?
What happens with Cesium? Cesium impact declines substantially after two days?
Electricity? How long will backup generators work?
Was the attack a diversion? Is Limerick Nuclear Power Plant on lockdown?
In looking for family, would we all become contaminated?
How much safety do windows provide?
If wife and kids are at mall, then I should go!?
Supplies: Preparedness: Not good!?
–
–
–
–
–
•
Water concerns
No real extended food supply
Need a strategic food supply
No duct tape
No plastic sheeting
Get in the car and drive?
11
Key Findings
Overall Summary
• So, are we prepared to shelter-in-place for a serious
crisis event?
– Straight forward answer: No - it certainly did not feel that way.
– Physically - no supplies of food, water, tape, etc.
– Process – do not really understand the shelter-in-place process, who can
leave, when can they leave, what do we do if someone wants or even
demands to leave? Can they be stopped!?
•
Thinking through and knowing what to do in that first 5 minutes is critical.
– And most importantly, …
– Emotionally – family concerns were paramount. It trumped any feeling of
loyalty to company and role. If family safety was unclear or unknown, the
emotional response to get to them at all costs was a major driving force of
response.
12
Team Action Plans
•
Plan! Do we have a plan? - Create a generic kit and plan for any type of disaster.
– Need a plan and supplies for work!
•
•
•
•
•
•
Need a discussion of shelter-in-place. Roles, responsibilities, timing, communications.
Supplies – food, water, duct tape, plastic sheeting, etc.
Talk with Mike Curry – invite to TOAO staff meeting; Include Victor D. and Bill L. Discuss education on
scenario planning & shelter in place planning. Want to understand the mechanics of the building and
the overall integrity of building.
Hard pressed to stay more than 24 hours – discuss this aspect.
Discuss resiliency – emotional views.
Create a leadership plan – Who is responsible for what?
– Need a plan and supplies for home!
•
•
•
•
•
•
•
•
3 days worth of supplies, minimum
Emergency kits
Stock up on dry foods, water, etc.
Create communication plan with wife – family plan – default understanding of where people will go;
walk through
Call relative or a contact out of region to relay information
Buy hand crank radios and flash lights for home
Buy batteries
We need to know what we’d do in that first 5 minutes.
13
Appendix
14
Crisis Preparation Assessment: Table Top Case Study
Crisis Planning In Pictures
15
Scenario 1 Discussion Points
• What if anything should we do to the heightened
alert?
• What is the real likelihood of danger?
– Probability wise, small likelihood.
• Is there a physical security issue?
– Mysterious packages? AK47’s?
– For us at the data center, not really concerned about
physical security?
• What should we be thinking about the situation?
Should we just go about our business?
16
Scenario 2 Discussion Points
•
How likely would you be to shelter-in-place if we were instructed to do so? Survey
vote:
–
–
–
–
•
30 min in, what if wife/kids are out? Could be at the mall – TBD. Can’t get in touch
to verify one way or another. Survey vote:
–
–
–
–
•
•
•
•
Very likely? 7
Somewhat likely? 0
Not very likely? 1
Very unlikely? 0
Very likely? 3
Somewhat likely? 2
Not very likely? 2
Very unlikely? 1
Do we have anyone saying they want to leave the building? How would we deal
with that?
How will we get updated information on the status of the situation?
How are we dealing with crew members just getting to work? Is everyone
accounted for?
Do we have sufficient supplies for shelter in place? For how long could we survive?
17
Scenario 3 Discussion Points
• What is the primary risk that needs to be addressed at this time?
• What is happening to our workplace?
• How do we deal with fear? How do we handle people with
physical or psychological symptoms?
• How do we keep in touch with the outside world, people, family?
18
Scenario 1
Additional Information
19
Feedback, Post Table Top Exercise
•
Scott, it was a great session. Really made me think about how unprepared we are both at work and at home. My responses to the questions would remain
unchanged – I would not shelter-in-place. I love Vanguard and feel very blessed to work here. However, my family is everything to me and their welfare
would be my top priority in a crises situation. That said, if Vanguard had a well thought out communication plan (ex: walkie-talkies) I would feel compelled
to offer system support or other services once my family was safe.
•
Scott, No change to my reply - still very likely [to shelter in place]. I had an interesting conversation with my wife on this yesterday which confirmed my
answer, justifications and my continued decision on the shelter in place action. She felt that I would be foolish to enter the probably chaos in the area to go
'searching' for her and possibly my kids (despite the scenario description it would be highly unlikely that she, along with both or either one of my sons
would be at King of Prussia). Being a health care professional she's been through these types of exercises at her hospital and their recommendation is to
never go to the scene of the event (going home is a different response but equally risky when there are so many unknowns). We also talked about our
preparation and surprisingly, probably by dumb luck, we're actually more prepared than I thought. Our problem is we do not have any types of action plans
and we've never talked to my boys on what to do, so that's high on our list of To-Dos. Overall, it was a very interesting and thought provoking exercise. I
appreciate the opportunity to participate. It really got me thinking on the way home from work as to where I would go and how I'd react. Good stuff.
•
There is nothing changed for me [after thinking more about it] ; so I am still "Very Likely“ [to shelter in place]. I feel it's important to have more crew
members to participate in this discussion, which will help them understand and be prepared for these type of events!! Overall, I am not prepared!!  My
action plan is to start the discussion with my family focusing on communication, supplies and shelter in place.
•
Whether I’d shelter in place after thinking about it more?...I'd say very likely. I was definitely unprepared (personally at home), and unsure that I would
have the patience to stay confined in the data center for any extended period of time. It also appears that we are unprepared in the data center facility
for any long confinements. We would at least additional food / water / communication devices in areas accessible to the people who are sheltering in
place. Like most low-probability dangers we are most likely going to push this out of our minds. It's likely a much higher probability you will die from
natural causes or accident but you see how people avoid even doing paperwork like wills. There are so many things to do and so many things to spend
money on that this will get ignored until something actually happens that affects us.
•
Somewhat likely [to shelter in place]. Additional Thoughts: Not that prepared, many basic things at home in terms of food and emergency supplies, but
no real communication or 'meet-up' plan in case of such a situation. Definitely makes you think and can become difficult as you go deeper into it because it
forces you to imagine some very tragic scenarios. But definitely important and worthwhile - better to think about it and be ready, than not and get caught
off guard. Reflections: be happy, enjoy each day and be prepared for the worst just in case.
•
I did talk with my wife about this last night and we are going to talk more about it in the future. As a dad, this is scary stuff, but it was a very useful
exercise to discuss it. Unlikely to stay [if asked to shelter in place].
•
Still not likely [to shelter in place]. I thought the exercise was valuable in that it's a subject that most people typically don't spend any time thinking or
talking about in their day to day lives. Problem with that is that when disaster strikes, you won't be in a position to react in an effective way, you'll be in
panic mode. So, personally, I left the meeting feeling pretty underprepared as far as having the right supplies on hand as well as a plan to be able to take
care of my family if something bad were to happen.
20
References
1.
2.
3.
4.
(2011). Retrieved April 2011 , from:
http://www.nationalterroralert.com/readyguide/shelterinplace.pdf
(2011). Retrieved April 2011 , from: https://www.llis.dhs.gov/index.do
Gartner Data Center Conference (2010). Eagle Rock, Enterprise Resiliency Planning
Solutions, Las Vegas Nevada.
(2011). Retrieved April 2011 , from:
http://en.wikipedia.org/wiki/List_of_largest_shopping_malls_in_the_United_States
21