What does the first hour after a critical incident look like? What is going on inside of a company’s Global Security Operations Center (GSOC)?

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba share their experiences of leading and working within a command center environment during a critical incident. Topics discussed include GSOCs (Global Security Operations Centers), crisis communications, selecting your GSOC team, the triage of information and intelligence, and many other related topics.

Episode Transcript

Bryan Strawser:                   We were reminiscing about some attacks and incidents that we’ve been through, and one that came to mind as we were setting up this episode is a few months back when there was the attack in London where the guy drove a vehicle down Westminster Bridge, hit and killed a number of civilians, killed a police officer at the entrance to Parliament, and then was shot and killed by armed police there in London, I was in a client’s office in Phoenix, Arizona, and I think had just gotten in and was in a meeting when the news alerts started coming. And so I walked over with the Global Security Team to their Global Security Operation Center, GSOC, and kind of spent the morning with them helping manage that initial response.

We are in there on a retainer basis to help them manage their crisis management and global security programs, which are kind of in transition just for background as to what we were up to. But it’s always interesting to hear what happens behind the scenes, kind of what’s the battle rhythm of what starts up when something happens. And this company had impact from this because their international subsidiaries managed out of London and was only a kilometer from where this happened.

Jen Otremba:                        Yeah. And unfortunately this sort of incident or these types of incidents are not isolated. We’ve dealt with many-

Bryan Strawser:                   Just this year.

Jen Otremba:                        Yeah.

Bryan Strawser:                   Or the last few years.

Jen Otremba:                        Yeah. Many such incidents like this. So we thought it would be great to discuss what happens after the incident occurs, what happens in a command center.

Bryan Strawser:                   Right.

Jen Otremba:                        What does the incident lead to, what do the rest of the parties do in a situation like this.

Bryan Strawser:                   So I think we’re gonna use this as the example, kind of the experience with our client in Phoenix. This client runs a 24/7 GSOC with a typical shift crew of between two and five, depending upon the time of day. This was morning, so they had a pretty good size crew in, including the manager over the facility plus the global security leadership was in the office because the day had just gotten started, so they were all over there as well. So you had a pretty good number of hands plus me sitting there. We’re writing color commentary from the corner.

Jen Otremba:                        So you got CNN up on the screen and, “Breaking news. This just happened.”

Bryan Strawser:                   So let’s start with the TV aspect, right? Their initial notification was this popped up on TV before they started getting incident alerts from the usual sources. Once they identified that it was in London they switched one of their TVs off of a US station and went to BBC so they could get the direct British perspective of what was happening. And then they CNN or MSNBC up, I don’t remember which one. One of the two. And then like most GSOCs,