The Three P’s of Contingency Planning: People, Process, and Products

By Glenn Lemons

Most of us have been accustomed to working and collaborating in an environment which has some degree of centralization–we are able to have impromptu desk side meetings and discussions face-to-face. When it comes to intelligence teams, some organizations have established Fusion and/or Security Operations Centers where planning is centralized and execution is largely decentralized. In today’s environment though, virtually everything is decentralized and “business as usual” processes need to adapt. 

Throughout my career, I have had the opportunity to either work on or author a number of playbooks and contingency plans. These plans focused on issues which were not necessarily enduring, but were specifically designed to address short-term issues. These playbooks have primarily been technology-related, but not a complete revamp of a business’s ability to operate in an uncertain environment for an extended period of time. One consideration on the technology side, for example, is that we’ve seen organizations reevaluate their hosting costs and costs associated with brick and mortar offices. However, I would estimate that some businesses will not just simply dust off their office and return to work once officials have signaled re-opening is allowed to commence. 

Though technology is at the core of continuing operations, the human factor is something that needs to be carefully evaluated. We can always re-engineer or adapt a process to continue business operations; however, I’ve noticed customers, co-workers, and peers, who are all incredibly dedicated to their organizations and missions, are working well beyond the number of hours and days than previously expected. Dedication is extremely commendable, but leaders need to increase the number of check-ins with their direct reports and encourage people to still unplug and spend time with their loved ones. We’re all operating at a different level, but it is critical to ensure the people within your organization are not burnt out and can navigate this isolation in the healthiest way possible.

Overall, contingency or pandemic planning needs to be holistic, including: people, process and products. People should come first, they are most certainly the key to any organization success and it’s most valuable asset. In terms of process, I’m not sure any of us anticipated the degree of impact COVID-19 would have on our personal and professional lives, but having a baseline understanding of processes which need to continue and ensuring our co-workers, third party partners, and customers understand operations will be critical to continue. And lastly in terms of product, my recommendation is to think of ways to best support your customers for the new ways that pandemic situations impact their organizations. Flashpoint, for example, is hyper-focused on helping it’s clients navigate the cybercrime that comes with uncertain situations like we face today when it comes to fraud, misinformation, disinformation, and other schemes.

From my perspective, most of the organizations I have been in contact with have adapted very well given this unprecedented situation. I’d encourage organizations to use this as an opportunity to evaluate your pre-COVID-19 business as usual mindset. Are some of those legacy reports or processes that seemed to be a part of your organization’s DNA still actually necessary? Does it make sense for your organization to remain remotely distributed for some functions?

You can plan for almost anything, but some of those plans will not work as designed–no plan is foolproof. Your peers, your co-workers, sometimes the most junior person on your team will rise to the occasion and help us all weather this situation given the right leadership and plans in place.