In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses the best way to engage your board of directors in your crisis communication strategy.

Topics discussed include board of directors and C-suite engagement, crisis management, crisis communications, reputation and issues management strategies, and crisis exercises.

Related Episodes & Blog Posts

Blog Post: Engaging your Board of Directors on your Crisis Communications Strategy

Blog Post: The Importance of Having a Crisis Communications Strategy

Episode #117: What Successful Crisis Management Looks Like Internally

Episode #: 125 – What is resilience?

Episode Transcript

Hello, and Welcome to the Managing Uncertainty podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in this week’s episode, I’d like to talk about your crisis communication strategy and what is the best way to engage your board of directors, as you think about how to build your crisis comms strategy.

The way I think about it is every organization faces risk. Whether you are a small or large entity, publicly traded, privately held, for-profit, non-profit, global, or local, at some point, you’re going to face a crisis. How you plan for, handle or manage, recover from and assess a crisis can significantly impact your organization, including your short-term business operations, your reputation, your long-term financial performance, and even the regulatory environment in which you operate.

So how do you minimize that risk, maximize your organization’s resilience and emerge stronger than before? The good news is, is that you have astute leaders that are charged with making sure your organization can thrive well into the future. And that group of leaders is your board of directors. Now your model and your structure might vary depending upon global geography, but boards largely share a common purpose. It is about the strategic oversight of your organization’s viability, your operational resilience, your reputation, and your financial wellbeing. This means your board is a key player in crisis management and communications. In fact, many boards have a risk committee to monitor, assess and advise on risks. Your risk committee and your board know that crisis management and crisis communications like good corporate governance is a focused, ongoing practice and not a reactive event. This doesn’t mean that why they write messaging, run tabletops or create playbooks. That’s not what they’re there for. The executive team and staff and management are responsible for crisis preparation, response, and recovery. Boards also can’t take a hands-off approach and simply be kept informed by the CEO.

So what’s the right role? Your board and its committees should provide critical oversight to your risk management efforts, such as regularly reviewing challenging, advising on, or even securing additional resources for crisis management and crisis communication efforts. Note that there’s an exception here to that oversight rule. And that’s where the board will assume greater responsibility and become the public face of the company. And that’s when there’s executive mismanagement or CEO malfeasance that happens. While your communication staff and lea

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses how resilient communities need public-private partnerships to survive.

Related Episodes & Blog Posts

Blog Post: Public/Private Partnerships – An overview

Blog Post: Resilient Communities Need Public/Private Partnerships to Survive

Episode #79: The Bryghtpath Global Security Framework

Episode #99: Hurricane Season 2020

Episode Transcript

Hello, and Welcome to the Managing Uncertainty podcast, this is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And this week in our episode, I’d like to talk about public-private partnerships, that in my belief that resilient communities need public-private partnerships in order to survive. I’m taken back to October 29th, 2012, when Hurricane Sandy came ashore in New Jersey. It was a strong, slow-moving category one hurricane at the time, I was the head of Global Crisis Management and Business Continuity for one of the world’s largest retailers. In Sandy’s path, that day were more than 200 of my stores, multiple distribution centers, and two data centers that powered our eCommerce website. More importantly to me, tens of thousands of our employees were in harm’s way as the storm rushed to shore. But I knew even though I worked for a private sector organization, that I was not in this fight alone. Over the previous decade, I think we’ve come to realize that for a community to truly be resilient against a natural disaster or another emergency or crisis, that public and private sector entities must work together and share information in a collaborative and transparent manner.

For the three years leading up to Hurricane Sandy, local State and Federal Emergency Management agencies had begun to embrace outreach and joint planning with the private sector. The private sector, particularly retail and utilities, had embraced this new approach with open arms. That resulted in a strong set of partnerships between the public and private sector that was apparent throughout the preparation, response, and recovery for Hurricane Sandy. For example, for several days prior to landfall, public and private sector entities were exchanging information through predefined channels. Emergency management agencies were sharing situational updates, storm path updates, and plans for road closure and evacuations long before landfall. Private sector companies were sharing their plans for facility closure, employee evacuations, positioning of recovery supplies, and post-landfall response plans. This collaborative and transparent approach provided broader situational clarity for the public and private sectors, and it helped avoid confusion later during the more chaotic response phase of the situation. As Hurricane Sandy began to dissipate and its impact in New Jersey and New York and other states became clearer, public and private center entities remain in close contact.

The Federal Emergency Management Agency or FEMA had activated their new national business emergency operations center as a component within FEMA’s National Response and Coordination Center or NRCC. The NRCC consolidated a number of federal and state agency reports into one easy-to-read report for the private sector to digest. At the same time, private sector entities were sending information to the NBEOC that were consolidated and shared at the highest levels of state and federal government. This information h

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses what is resilience?

The concept seems straightforward in a personal context; building up the psychological fortitude to bounce back from all of life’s bumps and bruises.

But what exactly does it mean for a business to be “resilient”?

We hear a lot of business leaders and highly trained business continuity, crisis management, and security professionals asking this same question. While everyone can agree that resilience is important to their business, there seems to be much less accord about precisely what it entails.

Topics discussed include how to think about organizational resilience within a large, complex organization – and how to go about putting it into place across the organization.

Related Episodes & Blog Posts

Blog Post: What is Resilience?

Blog Post: Plan-Do-Check-Act and your Business Continuity Program

Blog Post: Business Continuity Standards: How each can help you

Episode # 121: Metrics for Success in your Business Continuity Program

Episode #123: Plan Do Check Act and your BC Program

Episode Transcript

Hello and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in today’s episode, I want to talk about the question, what is resilience? Is it just me or is this the new buzzword of 2021, resilience?

The concept seems straightforward in a personal context, building up the psychological fortitude to bounce back from all of life’s bumps and bruises. But what exactly does it mean when we talk about a business being resilient? We hear a lot of business leaders and highly trained business continuity, security, crisis management, risk management professionals, information security professionals asking the same question.

And while everyone can agree that resilience is important to their business, there seems to be a lot less agreement about precisely what it entails. Perhaps it’s because it’s the inherent nature of resiliency to mean something different for every organization. Its precise parameters and components are shaped by its context. Every business has different experiences, threats, and resources. So why should any resiliency program look the same as another?

Still, here at Bryghtpath, we think there are fundamental components that every business should have in place if they want to make good on their resiliency imperatives. So here’s our take. What is resilience? Well, according to the International Standards Organization, ISO, organizational resilience means the ability of an organization to absorb and adapt in a changing environment to enable it to deliver its objectives, to survive and to prosper. But like a lot of standards-based definitions, that leaves an awful lot to read between the lines.

Here at Bryghtpath, we think of resilience as a group of capabilities that supports an organization’s ability to solve big problems, to continue their operations, to protect their assets. And most importantly, protect their people. On a practical level, this is achieved with what we think of as basic blocking and tackling, implementing certain key components in a logical way to prevent plan, for respond to and recover from disruption. Those core compo

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses Business Continuity standards and how they can help you improve your business continuity and resiliency program.

Topics discussed include the ISO 22301 Standard for Organizational Resilience, NFPA 1600, and the ASIS Business Continuity & Crisis Management Standard.

Related Episode & Blog Posts

Blog Post: ISO 27031: Looking at ISO’s Disaster Recovery Standard

Blog Post: Business Continuity Standards: How each can help you

Blog Post: An overview of the NFPA 1600 Standard

Episode #24 – The Traditional Business Impact Analysis (BIA)

Episode #123: Plan Do Check Act and your BC Program

Episode Transcript

Hello, and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive at Bryghtpath. And in today’s episode, I’d like to talk about business continuity standards and how each of those standards can help you improve your program of resiliency and business continuity in your organization. No matter how much business experience you have, or how long you have looked, or studied, or thought about risk and resilience in your business, creating a business continuity program can seem daunting. But there are internationally recognized guidelines that exist to help you build the right program for your organization’s unique solution. I want to talk through all the essentials you need to understand each of the internationally accepted guidelines and decide which one works the best for you. These standards and guidelines save you from reinventing the wheel when it comes to business continuity by describing what your program needs.

These guidelines share many common elements, such as calling for top leadership support, your board, your senior executives, assessing risk and business impact analysis. In general, these standards can be adapted to large and small organizations in any industry. They’re also not prescriptive. They describe what you need to do, but not how you need to go about doing it. All of them though, reinforce the same broad business continuity goals. And those are reducing the risk of disruption, supporting the continuity of your business, and reassuring customers and stakeholders that you can continue to operate. I want to start by describing the NFPA 1600 standard on continuity emergency and crisis management.

NFPA is the National Fire Protection Agency, NFPA. This is a U.S.-centric emergency planning specification that’s become globally accepted. NFPA was one of the first standards related to business continuity that appeared after September 11th. The United States Department of Homeland Security adopted this standard, calling it as a, they were describing it rather, as a voluntary consensus standard for emergency preparedness. Likewise, the September 11th Commission Report recognized NFPA 1600 as the national preparedness standard at the time. Despite these endorsements, NFPA 1600 is just a guideline. It’s not a regulatory requirement. It makes up nine chapters on business continuity and emergency management, program management, planning, implementation, training, exercises and tests, and program improvement. Then there’s an Annex B that includes checklists for ongoing self-evaluation.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses the Plan Do Check Act Cycle in your Business Continuity Program.

Topics discussed include the Plan Do Check Act Cycle, how the PDCA Cycle connects to the ISO 22301 Standard (and others),  and how you can use the PDCA cycle to mature and improve your business continuity program.

Related Episodes & Blog Posts

Blog Post: A look at the new ISO 22317 Standard for Business Impact Analysis (BIA)

Blog Post: Using ISO 22301 to Evaluate your Business Continuity Program

Blog Post: Plan-Do-Check-Act and your Business Continuity Program

Episode #110: Is your BC Program ready for the next disruption?

Episode #121: Metrics for Success in your Business Continuity Program

ASQ:  What is the Plan Do Check Act (PDCA) Cycle?

Lean Enterprise Institute:  Plan, Do, Check, Act

Episode Transcript

Hello, and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath, and in this week’s episode of our podcast, I’d like to talk about the Plan Do Check Act Cycle in your Business Continuity Program. And I want to start by talking about the Law of Aggregate Marginal Gain. As this theory goes, many tiny improvements can add up to huge wins over time. In the case of the British Cycling Team from many years ago, the small acclimation of tiny improvements, such as improved hand-washing, new massage gels and pillows, and minor changes to their bike ergonomics were credited for their wildly successful performance at the 2012 Tour de France, and then the London Olympics. For the rest of us, a more practical example of this theory in action might be parking at the far end of the parking lot, taking the stairs, and then skipping dessert to shed a few more pounds over the course of the year. Or if savings are your goal, ditching your drive-through coffee every morning, packing your lunch, and collecting your change can quickly propel your savings efforts into appreciable gains.

In theory, the Law of Aggregate Marginal Gain seems like a foolproof and nearly effortless way to accomplish big things. So how is that then the average 20 something has less than $10,000 in retirement savings? And am I the only person here with a step-tracking smartwatch, I use an Apple Watch, who has yet to fit back into my size 34 jeans that I wore in high school? There’s endless explanations for why as humans we find it hard to make progress towards our goals, whether it’s losing weight or saving money, or making strides in our business. When it comes to organizational resiliency, one of the common problems I see is just not having a good system for implementing and improving maturing your Business Continuity Program. Ad hoc efforts, in my experience, lead to ad hoc results. Opportunities for improvement will slip through the cracks in your program quietly and unimpressively just manage to subsist.

It’s not exactly your dream scenario, especially considering the ramifications of being unprepared for the next disruption that your company will face. Meaningful improvem

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser tells a personal story about an experience he had this past week around his Mom’s heart attack and the importance of helping family, friends, and loved ones recognize the signs of cardiac arrest.

Related Episodes & Blog Posts

Blog Post: Personal Preparedness: Steps You can Take Today to Improve the Safety of Your Family When Disaster Strikes

Blog Post: Four steps you can take today to improve your personal preparedness

Episode #6 – Personal Preparedness

Episode #69: National Preparedness Month

Episode #71: Pet Preparedness

Episode Transcript

Hello, and Welcome to the Managing Uncertainty podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in this week’s episode, I want to tell a more personal story than I usually talk about here on the podcast with a little bit about an experience I had in this past week. I was awoken last Thursday morning by a phone call from my younger brother. I live in Minnesota, but I grew up about 10 hours from here in rural Indiana, where my parents and my brother, who is about five years younger than I am, reside. And my brother called to tell me that my mother had had a medical emergency and was en route to the hospital in an ambulance. It turned out that my mother had her first heart attack, her first real medical emergency in her 71 years of life. Fortunately, she’s on her way to a full recovery and is doing all of the normal post-cardiac issues and challenges that you need to work through after having a life-threatening medical emergency.

Like many women, my mother didn’t recognize that the signs and symptoms that she was experiencing were a serious cardiac issue because she thought of a heart attack as, I’m going to have searing chest pain and pressure. And that, that means I’m having a heart attack, and I should call an ambulance. Instead, she had this enormous shortness of breath that continued to get worse over several hours until she felt like she couldn’t get up off of the couch. She’d actually been up most of the night. Finally called my father on his cell phone. He was asleep at the far end of the house. After having this severe shortness of breath, she never had a feeling of great pressure or any searing chest pain. And we were fortunate that when she awoke my father, who is 74, after several hours of discomfort, that my father recognized the situation for what it was and immediately called 911, which dispatched paramedics.

Now, my parents live in very rural Indiana. It was a great place to grow up, in that there was very little crime, and there were plenty of people that cared about you, and a true sense of community. But it also means that you’re a long way from good medical care. At the time that I was growing up there 25 plus years ago, calling EMS meant that you got a basic life support capability, an EMT, two EMTs, and an ambulance. But now, they have paramedics. But it’s still a 12 to 15-minute wait for them to show up. So, as the paramedics arrived, they recognized the situation for what it was. They were out of the house in less than five minutes en route to the emergency room where she received some treatments, an

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses the key metrics to measure the success of your business continuity program.

Topics discussed include business continuity program metrics, maturity models and measurements for continuity programs, strategic metrics that your c-suite wants to see, and operational metrics that show the day-to-day progress of your program.

Related Episodes & Blog Posts

Blog Post: ISO 27031: Looking at ISO’s Disaster Recovery Standard

Blog Post: Business Continuity as a Service: How to Outsource Your Continuity Program

Episode #113: Roles and Responsibilities in a BC Program

Episode #116: Tools We Use At Bryghtpath (2021 Edition)

Episode Transcript

Hello, and welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, principal and chief executive here at Bryghtpath. In this week’s episode, I would like to talk about key metrics to measure the success of your business continuity program. I’ve been doing this for about 25 years and the question… One of the questions that just makes me cringe is this question: Are there metrics we should be tracking? In short, the answer is yes. Hell yes, there are. What metrics should you be tracking?

Well, it depends. Do you really want to know where your program is working? That your organization’s resilience and actually prepared to respond to the next disruption? Or you just want to make sure the boxes are checked. It’s really not a trick question. I think everyone wants to know if their program and plans would actually work. But if you can’t grasp the difference between these two questions, you’re not alone. We frequently encounter confusion about the fact that merely tracking business continuity program compliance (i.e. checking the boxes) is not the end game for business continuity program success.

It takes more than just know the requirements, do the thing, check the boxes to gauge whether your program is effective, and helping move your organization forward towards its resiliency goals. Employing the right combination of metrics, operational compliance, plan quality, and program maturity are all equally important to understand your organization’s true resilience. Implementing a system that measures all three will give your company the insights it needs to move your program to full maturity, long-term sustainability and success in responding to the next disruption.

Let’s talk about how to understand program metrics. The first is operational compliance metrics. And as I just said, these really only tell you part of the story, but there’s still a foundational starting point for measuring the success of your program. At the very least, you should be looking at progress at the business unit or plan level for BIA completion, business continuity plan completion, whether new plan creation or revisions to plan on whatever your cycle is, completion of exercises and then whether after-action items that have been identified in exercises or actual incidents have been addressed and the improvements implemented.

You can get more detailed here. You could track like policy compliance and attestation of the plan at the next leadership level. You could track… I think I already mentioned training, but you can track all the different elements of things that your program r

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses making the case for your business continuity program with your senior executives.

Topics discussed include:  bridging the gap from aspiration to action as a business continuity leader in your organization, positioning your argument, using metrics and benefits to bolster your argument for investment, aligning your program against organizational objectives, and overcoming objections in the discussion.

Related Episodes & Blog Posts

Blog Post: How to sell your business continuity program to senior executives

Blog Post: Making the Case for your Business Continuity Program

Episode #81: When to bring in a consultant and use them effectively

Episode #84: Making the case to Leadership

Episode Transcript

Hello, and Welcome to the Managing Uncertainty podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. I want to talk, in today’s episode, about making the case for your business continuity program. You may not know this, but by 2025, 70% of CEOs, according to Gartner, are predicted to place organizational resilience as a top priority for their company’s strategic basic objectives. That means your CEO is likely, in the next few years, going to place organizational resilience as a top priority for your company. So with resiliency being thrust in the limelight in the way that it is, many business continuity professionals see their next step … might see their next step to sit back and wait for budget money just to rain down on the program, because that’s how it works, right? I think your wait might take longer than you may expect.

I can’t deny it excites me to see our profession gain a new level of visibility and traction as resiliency becomes more important to CEOs. But having spent 21 years in the trenches of corporate America, I know there’s a lot of work to be done to get from the idea of a resiliency mandate like this, to building a business ecosystem that’s prepared to respond to tomorrow’s next issue, your next disruption. A lot of work, a lot of that work centers around convincing the people at the top, your C-suite executives, your top management, as the ISO standards call it, and your board of directors to invest money where it’s needed. Your board knows what they want strategically, but are they really ready to make that spend in support of your program? So it’s your job as a business continuity leader, to help them bridge the gap from aspiration to action.

I want to talk about exactly how to do that. Let’s talk about perspective. If you talk to any marketer, they will tell you the key to making the sale is to get deep into the mind of your target audience. What keeps them up at night? What particular challenges and concerns are facing them at the moment? If they could just press an easy button, the Staples Easy Button, what does it do? If you can answer those questions, you’ll have the insight you need to perfectly position your program, your product, or service as the answer to their woes. It’s not any different, as we think about that when it comes to selling your business continuity program to your executive leaders and board in your organization.

The first step is to get buy-in for your business continuity program strategy is to ensure that it ladders u

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser shared best practices to follow in an investigation of sexual harassment or hostile work environment in your organization. Handled improperly, this can be one of the most critical reputational crisis situations you will ever face.

Topics discussed include employing neutral, third-party investigators, investigation best practices, and the need to take allegations seriously to protect the victims and the organization’s reputation.

Related Episodes & Blog Posts

Episode #22 – When sexual harassment comes to the C-Suite

Society for HR Management:  How to investigate sexual harassment allegations

Episode Transcript

Hello and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in today’s episode, I want to talk about something that’s been in the news a lot here in Minnesota, over the last couple of weeks. And that is the issue of sexual harassment and allegations of assault that have gone on. Here in Minnesota, there’s a number of allegations happening towards the culture at the Republican Party of Minnesota.

Now, the purpose of today’s podcast episode is not to talk about the actual political scandal that’s going on. I just give you that for some context. What I want to talk about is how to appropriately manage these kinds of situations as a leader in your organization. Before I started Bryghtpath in 2014, I spent 21 years in various roles in corporate security, in a Fortune 50 organization. A lot of that time was spent in crisis management and business continuity, but I also spent time in investigations and I spent time running large security teams in the field in New England and New Jersey and in Baltimore, and in Ohio, before I wound up at a corporate headquarters environment for the last nine years of my career there. And I was a part of many sexual harassment investigations as an investigator and security leader, working with my partners in human resources and employee relations.

So I want to talk just a little bit briefly here about best practices when things like this happen. In most organizations, human resources is responsible for investigating such complaints when they’re made. But often, security leaders, even physical security leaders, are often involved for a number of different reasons. It might be because HR’s not available. It might be because they need additional witnesses or they need another interviewer. It might just be because as a security professional, you have more experience in interviewing and talking with individuals in this context than an HR leader may in some cases.

The professional trade association, if you want to call that for human resources is the Society for HR Management, often called SHRM. Their website is shrm.org. And SHRM has a list of best practices, which we’ll link in the show notes, about how to investigate sexual harassment allegations and these best practices with a little bit of my experience is what I want to talk about today.

First, SHRM recommends that you begin by making an investigative plan when these allegations are made. The plan should outline who will investigate, preferably a neutral outside investigator. That could be you as a security professional or an HR leader or an employee relations leader. It could also be an outside counsel in organizations or where that’s necessary or where the level of the person being investigated, simply calls for that kind of attention to be paid. You want to p

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses one of the biggest threats facing businesses today: ransomware.

Bryan discusses steps you can take to manage and survive ransomware attacks and crisis situations that can have deadly serious consequences to your organization’s operations, continuity, and reputation.

Related Episodes & Blog Posts

Blog Post: The Importance of Having a Crisis Communications Strategy

Blog Post: Insider Threat Webinar: The Threat Lurking inside your Organization

Episode #59: All roads lead to one – Crisis Management Framework

Episode #115: Ransomware and Backups

Episode Transcript

Hello and welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And today I want to talk about one of the biggest threats facing businesses, small, medium, large, Fortune 50 sized organizations, and that is ransomware. And I want to emphasize the need to plan your ransomware attack response now. That there is no time to wait based on thinking about how you will manage this as a business continuity, crisis management, information security professional, as a chief security officer, or as a leader or owner of a business.

If you think about what we’ve seen in just the last six months, food manufacturing and food processing fuel pipelines, police departments, a transportation authority, cities and counties in terms of government. Those are just some of the largest targets that have been hit with ransomware attacks in the United States so far this year in 2021. But for every ransomware story in the news that we see, there are dozens of incidents that go unnoticed, unmentioned because either the company is too small for news outlets to care, or because the organization wants to handle that situation quietly on its own and usually by paying the ransom.

And ransomware is paying really good money. In 2020, the amounts that victim’s paid to regain the use of their data went up more than 300%. I bet your margin didn’t climb 300%, but theirs did. So it’s not surprising that the Washington Post is now claiming that the frequency of attacks have more than doubled from 2019 to 2020. And it seems to be a case of not if a company will be hit, but when a company will be hit. Also, the perfect storm has been created with the pandemic. The growth of remote work has really created the perfect condition for cyber attacks.

Although mobile work and mobile devices have increased for more than a decade now, companies really didn’t proactively communicate the urgency of hardening home-based information security, your home network the way that we should have. Billions of homeworkers during the pandemic have provided multiple entry points through insecure home routers possibly that are still running older encryption like WPS instead of WP