In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses Business Continuity standards and how they can help you improve your business continuity and resiliency program. Topics discussed include the ISO 22301 Standard for Organizational Resilience, NFPA 1600, and the ASIS Business Continuity & Crisis Management Standard. Related Episode & Blog Posts Blog Post: ISO 27031: Looking at ISO’s Disaster Recovery Standard Blog Post: Business Continuity Standards: How each can help you Blog Post: An overview of the NFPA 1600 Standard Episode #24 – The Traditional Business Impact Analysis (BIA) Episode #123: Plan Do Check Act and your BC Program Episode Transcript Hello, and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive at Bryghtpath. And in today’s episode, I’d like to talk about business continuity standards and how each of those standards can help you improve your program of resiliency and business continuity in your organization. No matter how much business experience you have, or how long you have looked, or studied, or thought about risk and resilience in your business, creating a business continuity program can seem daunting. But there are internationally recognized guidelines that exist to help you build the right program for your organization’s unique solution. I want to talk through all the essentials you need to understand each of the internationally accepted guidelines and decide which one works the best for you. These standards and guidelines save you from reinventing the wheel when it comes to business continuity by describing what your program needs. These guidelines share many common elements, such as calling for top leadership support, your board, your senior executives, assessing risk and business impact analysis. In general, these standards can be adapted to large and small organizations in any industry. They’re also not prescriptive. They describe what you need to do, but not how you need to go about doing it. All of them though, reinforce the same broad business continuity goals. And those are reducing the risk of disruption, supporting the continuity of your business, and reassuring customers and stakeholders that you can continue to operate. I want to start by describing the NFPA 1600 standard on continuity emergency and crisis management. NFPA is the National Fire Protection Agency, NFPA. This is a U.S.-centric emergency planning specification that’s become globally accepted. NFPA was one of the first standards related to business continuity that appeared after September 11th. The United States Department of Homeland Security adopted this standard, calling it as a, they were describing it rather, as a voluntary consensus standard for emergency preparedness. Likewise, the September 11th Commission Report recognized NFPA 1600 as the national preparedness standard at the time. Despite these endorsements, NFPA 1600 is just a guideline. It’s not a regulatory requirement. It makes up nine chapters on business continuity and emergency management, program management, planning, implementation, training, exercises and tests, and program improvement. Then there’s an Annex B that includes checklists for ongoing self-evaluation.

Managing Uncertainty

Managing Uncertainty Podcast - Episode #124: Business Continuity Standards - Which is right for you?

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses the Plan Do Check Act Cycle in your Business Continuity Program. Topics discussed include the Plan Do Check Act Cycle, how the PDCA Cycle connects to the ISO 22301 Standard (and others),  and how you can use the PDCA cycle to mature and improve your business continuity program. Related Episodes & Blog Posts Blog Post: A look at the new ISO 22317 Standard for Business Impact Analysis (BIA) Blog Post: Using ISO 22301 to Evaluate your Business Continuity Program Blog Post: Plan-Do-Check-Act and your Business Continuity Program Episode #110: Is your BC Program ready for the next disruption? Episode #121: Metrics for Success in your Business Continuity Program ASQ:  What is the Plan Do Check Act (PDCA) Cycle? Lean Enterprise Institute:  Plan, Do, Check, Act Episode Transcript Hello, and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath, and in this week’s episode of our podcast, I’d like to talk about the Plan Do Check Act Cycle in your Business Continuity Program. And I want to start by talking about the Law of Aggregate Marginal Gain. As this theory goes, many tiny improvements can add up to huge wins over time. In the case of the British Cycling Team from many years ago, the small acclimation of tiny improvements, such as improved hand-washing, new massage gels and pillows, and minor changes to their bike ergonomics were credited for their wildly successful performance at the 2012 Tour de France, and then the London Olympics. For the rest of us, a more practical example of this theory in action might be parking at the far end of the parking lot, taking the stairs, and then skipping dessert to shed a few more pounds over the course of the year. Or if savings are your goal, ditching your drive-through coffee every morning, packing your lunch, and collecting your change can quickly propel your savings efforts into appreciable gains. In theory, the Law of Aggregate Marginal Gain seems like a foolproof and nearly effortless way to accomplish big things. So how is that then the average 20 something has less than $10,000 in retirement savings? And am I the only person here with a step-tracking smartwatch, I use an Apple Watch, who has yet to fit back into my size 34 jeans that I wore in high school? There’s endless explanations for why as humans we find it hard to make progress towards our goals, whether it’s losing weight or saving money, or making strides in our business. When it comes to organizational resiliency, one of the common problems I see is just not having a good system for implementing and improving maturing your Business Continuity Program. Ad hoc efforts, in my experience, lead to ad hoc results. Opportunities for improvement will slip through the cracks in your program quietly and unimpressively just manage to subsist. It’s not exactly your dream scenario, especially considering the ramifications of being unprepared for the next disruption that your company will face. Meaningful improvem

Managing Uncertainty Podcast Episode #123: Plan Do Check Act and your BC Program

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser tells a personal story about an experience he had this past week around his Mom’s heart attack and the importance of helping family, friends, and loved ones recognize the signs of cardiac arrest. Related Episodes & Blog Posts Blog Post: Personal Preparedness: Steps You can Take Today to Improve the Safety of Your Family When Disaster Strikes Blog Post: Four steps you can take today to improve your personal preparedness Episode #6 – Personal Preparedness Episode #69: National Preparedness Month Episode #71: Pet Preparedness Episode Transcript Hello, and Welcome to the Managing Uncertainty podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in this week’s episode, I want to tell a more personal story than I usually talk about here on the podcast with a little bit about an experience I had in this past week. I was awoken last Thursday morning by a phone call from my younger brother. I live in Minnesota, but I grew up about 10 hours from here in rural Indiana, where my parents and my brother, who is about five years younger than I am, reside. And my brother called to tell me that my mother had had a medical emergency and was en route to the hospital in an ambulance. It turned out that my mother had her first heart attack, her first real medical emergency in her 71 years of life. Fortunately, she’s on her way to a full recovery and is doing all of the normal post-cardiac issues and challenges that you need to work through after having a life-threatening medical emergency. Like many women, my mother didn’t recognize that the signs and symptoms that she was experiencing were a serious cardiac issue because she thought of a heart attack as, I’m going to have searing chest pain and pressure. And that, that means I’m having a heart attack, and I should call an ambulance. Instead, she had this enormous shortness of breath that continued to get worse over several hours until she felt like she couldn’t get up off of the couch. She’d actually been up most of the night. Finally called my father on his cell phone. He was asleep at the far end of the house. After having this severe shortness of breath, she never had a feeling of great pressure or any searing chest pain. And we were fortunate that when she awoke my father, who is 74, after several hours of discomfort, that my father recognized the situation for what it was and immediately called 911, which dispatched paramedics. Now, my parents live in very rural Indiana. It was a great place to grow up, in that there was very little crime, and there were plenty of people that cared about you, and a true sense of community. But it also means that you’re a long way from good medical care. At the time that I was growing up there 25 plus years ago, calling EMS meant that you got a basic life support capability, an EMT, two EMTs, and an ambulance. But now, they have paramedics. But it’s still a 12 to 15-minute wait for them to show up. So, as the paramedics arrived, they recognized the situation for what it was. They were out of the house in less than five minutes en route to the emergency room where she received some treatments, an

Managing Uncertainty Podcast - Episode #122: A Personal Story

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses the key metrics to measure the success of your business continuity program. Topics discussed include business continuity program metrics, maturity models and measurements for continuity programs, strategic metrics that your c-suite wants to see, and operational metrics that show the day-to-day progress of your program. Related Episodes & Blog Posts Blog Post: ISO 27031: Looking at ISO’s Disaster Recovery Standard Blog Post: Business Continuity as a Service: How to Outsource Your Continuity Program Episode #113: Roles and Responsibilities in a BC Program Episode #116: Tools We Use At Bryghtpath (2021 Edition) Episode Transcript Hello, and welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, principal and chief executive here at Bryghtpath. In this week’s episode, I would like to talk about key metrics to measure the success of your business continuity program. I’ve been doing this for about 25 years and the question… One of the questions that just makes me cringe is this question: Are there metrics we should be tracking? In short, the answer is yes. Hell yes, there are. What metrics should you be tracking? Well, it depends. Do you really want to know where your program is working? That your organization’s resilience and actually prepared to respond to the next disruption? Or you just want to make sure the boxes are checked. It’s really not a trick question. I think everyone wants to know if their program and plans would actually work. But if you can’t grasp the difference between these two questions, you’re not alone. We frequently encounter confusion about the fact that merely tracking business continuity program compliance (i.e. checking the boxes) is not the end game for business continuity program success. It takes more than just know the requirements, do the thing, check the boxes to gauge whether your program is effective, and helping move your organization forward towards its resiliency goals. Employing the right combination of metrics, operational compliance, plan quality, and program maturity are all equally important to understand your organization’s true resilience. Implementing a system that measures all three will give your company the insights it needs to move your program to full maturity, long-term sustainability and success in responding to the next disruption. Let’s talk about how to understand program metrics. The first is operational compliance metrics. And as I just said, these really only tell you part of the story, but there’s still a foundational starting point for measuring the success of your program. At the very least, you should be looking at progress at the business unit or plan level for BIA completion, business continuity plan completion, whether new plan creation or revisions to plan on whatever your cycle is, completion of exercises and then whether after-action items that have been identified in exercises or actual incidents have been addressed and the improvements implemented. You can get more detailed here. You could track like policy compliance and attestation of the plan at the next leadership level. You could track… I think I already mentioned training, but you can track all the different elements of things that your program r

Managing Uncertainty Podcast - Episode # 121: Metrics for Success in your Business Continuity Program

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses making the case for your business continuity program with your senior executives. Topics discussed include:  bridging the gap from aspiration to action as a business continuity leader in your organization, positioning your argument, using metrics and benefits to bolster your argument for investment, aligning your program against organizational objectives, and overcoming objections in the discussion. Related Episodes & Blog Posts Blog Post: How to sell your business continuity program to senior executives Blog Post: Making the Case for your Business Continuity Program Episode #81: When to bring in a consultant and use them effectively Episode #84: Making the case to Leadership Episode Transcript Hello, and Welcome to the Managing Uncertainty podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. I want to talk, in today’s episode, about making the case for your business continuity program. You may not know this, but by 2025, 70% of CEOs, according to Gartner, are predicted to place organizational resilience as a top priority for their company’s strategic basic objectives. That means your CEO is likely, in the next few years, going to place organizational resilience as a top priority for your company. So with resiliency being thrust in the limelight in the way that it is, many business continuity professionals see their next step … might see their next step to sit back and wait for budget money just to rain down on the program, because that’s how it works, right? I think your wait might take longer than you may expect. I can’t deny it excites me to see our profession gain a new level of visibility and traction as resiliency becomes more important to CEOs. But having spent 21 years in the trenches of corporate America, I know there’s a lot of work to be done to get from the idea of a resiliency mandate like this, to building a business ecosystem that’s prepared to respond to tomorrow’s next issue, your next disruption. A lot of work, a lot of that work centers around convincing the people at the top, your C-suite executives, your top management, as the ISO standards call it, and your board of directors to invest money where it’s needed. Your board knows what they want strategically, but are they really ready to make that spend in support of your program? So it’s your job as a business continuity leader, to help them bridge the gap from aspiration to action. I want to talk about exactly how to do that. Let’s talk about perspective. If you talk to any marketer, they will tell you the key to making the sale is to get deep into the mind of your target audience. What keeps them up at night? What particular challenges and concerns are facing them at the moment? If they could just press an easy button, the Staples Easy Button, what does it do? If you can answer those questions, you’ll have the insight you need to perfectly position your program, your product, or service as the answer to their woes. It’s not any different, as we think about that when it comes to selling your business continuity program to your executive leaders and board in your organization. The first step is to get buy-in for your business continuity program strategy is to ensure that it ladders u

Managing Uncertainty Podcast - Episode # 120: Getting to Yes on Continuity Program Investments

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser shared best practices to follow in an investigation of sexual harassment or hostile work environment in your organization. Handled improperly, this can be one of the most critical reputational crisis situations you will ever face. Topics discussed include employing neutral, third-party investigators, investigation best practices, and the need to take allegations seriously to protect the victims and the organization’s reputation. Topics discussed include the response from leadership in your organization and the role of a neutral third-party investigator. Related Episodes & Blog Posts Episode #22 – When sexual harassment comes to the C-Suite Society for HR Management:  How to investigate sexual harassment allegations Episode Transcript Hello and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in today’s episode, I want to talk about something that’s been in the news a lot here in Minnesota, over the last couple of weeks. And that is the issue of sexual harassment and allegations of assault that have gone on. Here in Minnesota, there’s a number of allegations happening towards the culture at the Republican Party of Minnesota. Now, the purpose of today’s podcast episode is not to talk about the actual political scandal that’s going on. I just give you that for some context. What I want to talk about is how to appropriately manage these kinds of situations as a leader in your organization. Before I started Bryghtpath in 2014, I spent 21 years in various roles in corporate security, in a Fortune 50 organization. A lot of that time was spent in crisis management and business continuity, but I also spent time in investigations and I spent time running large security teams in the field in New England and New Jersey and in Baltimore, and in Ohio, before I wound up at a corporate headquarters environment for the last nine years of my career there. And I was a part of many sexual harassment investigations as an investigator and security leader, working with my partners in human resources and employee relations. So I want to talk just a little bit briefly here about best practices when things like this happen. In most organizations, human resources is responsible for investigating such complaints when they’re made. But often, security leaders, even physical security leaders, are often involved for a number of different reasons. It might be because HR’s not available. It might be because they need additional witnesses or they need another interviewer. It might just be because as a security professional, you have more experience in interviewing and talking with individuals in this context than an HR leader may in some cases. The professional trade association, if you want to call that for human resources is the Society for HR Management, often called SHRM. Their website is shrm.org. And SHRM has a list of best practices, which we’ll link in the show notes, about how to investigate sexual harassment allegations and these best practices with a little bit of my experience is what I want to talk about today. First, SHRM recommends that you begin by making an investigative plan when these allegations are made. The plan should outline who will investigate, preferably a neutral outside investigator. That could be you as a security professional or an HR leader or an employee relations leader. It could also be an outside counsel in organizations or where that&#8

Managing Uncertainty Podcast - Episode# 119: Best Practices in Harassment Investigations

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses one of the biggest threats facing businesses today: ransomware. Bryan discusses steps you can take to manage and survive ransomware attacks and crisis situations that can have deadly serious consequences to your organization’s operations, continuity, and reputation. Related Episodes & Blog Posts Blog Post: The Importance of Having a Crisis Communications Strategy Blog Post: Insider Threat Webinar: The Threat Lurking inside your Organization Episode #59: All roads lead to one – Crisis Management Framework Episode #115: Ransomware and Backups Episode Transcript Hello and welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And today I want to talk about one of the biggest threats facing businesses, small, medium, large, Fortune 50 sized organizations, and that is ransomware. And I want to emphasize the need to plan your ransomware attack response now. That there is no time to wait based on thinking about how you will manage this as a business continuity, crisis management, information security professional, as a chief security officer, or as a leader or owner of a business. If you think about what we’ve seen in just the last six months, food manufacturing and food processing fuel pipelines, police departments, a transportation authority, cities and counties in terms of government. Those are just some of the largest targets that have been hit with ransomware attacks in the United States so far this year in 2021. But for every ransomware story in the news that we see, there are dozens of incidents that go unnoticed, unmentioned because either the company is too small for news outlets to care, or because the organization wants to handle that situation quietly on its own and usually by paying the ransom. And ransomware is paying really good money. In 2020, the amounts that victim’s paid to regain the use of their data went up more than 300%. I bet your margin didn’t climb 300%, but theirs did. So it’s not surprising that the Washington Post is now claiming that the frequency of attacks have more than doubled from 2019 to 2020. And it seems to be a case of not if a company will be hit, but when a company will be hit. Also, the perfect storm has been created with the pandemic. The growth of remote work has really created the perfect condition for cyber attacks. Although mobile work and mobile devices have increased for more than a decade now, companies really didn’t proactively communicate the urgency of hardening home-based information security, your home network the way that we should have. Billions of homeworkers during the pandemic have provided multiple entry points through insecure home routers possibly that are still running older encryption like WPS instead of WPA2 or WPA3 and wifi networks that may not even have password protection. Now companies can shore up home-based offices, but you also need to change the attitude towards ransomware attacks. Tactically, we often focus cybersecurity efforts around regulatory and framework compliance and those are important, NIST, CSF, high trust, direct trust, PCI, and more. These are important, but we also need to build cybersecurity capabilities to withstand a determined adversary.

Managing Uncertainty Podcast - Episode # 118 - Plan Your Ransomware Attack Response Now

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses what successful crisis management looks like inside of an organization – including some philosophy about how the team at Bryghtpath thinks about leading in a crisis. Related Episodes & Blog Posts Blog Post: How 3 companies have managed the COVID-19 pandemic Blog Post: The Importance of Having a Crisis Communications Strategy Episode #59: All roads lead to one – Crisis Management Framework Episode #88: What is the goal of crisis management? Episode #93: Crisis Management Plans – What your executives really want Episode #96: Crisis leadership in the time of Coronavirus Episode Transcript Hello, and welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, principal and chief executive here at Bryghtpath. And this week, I want to talk a little bit about crisis management philosophy. I want to hit on really two big topics. One is, as we’re demonstrating to clients in a lot of conversations, what does successful crisis management look like? When you’re inside of a company and you’re watching the company react to a crisis situation and go on to manage that crisis well, whether it’s an IT disruption, it’s a natural disaster like a hurricane, a violent attack like an active assailant, or active shooter situation or it’s a reputational crisis, what does that successful crisis management effort look like inside of a company? The second is I want to talk a little bit about our crisis management philosophy here at Bryghtpath, how we think about structuring crisis management programs and leading through crisis situations. I’m going to have kind of five key points to make as we talk about that. So let’s start by talking about what successful crisis management looks like. So, again, you’re inside of a company and you’re watching the company react to a crisis and if you’re managing it well, there are some core key factors that you’re going to see. There’s going to be some key things that will really stand out to you. The first one is rapid response. The company is going to quickly move to react to the situation. And if they can, if it is a situation where they can prepare for it, if they can be on the left side of the boom, as Harvard professor Juliette Kayyem likes to say, like a hurricane where you know it’s coming, you have three, four, five, maybe even seven days to prepare for that, you’re going to position that response in advance of that incoming storm so you can move as quickly as you can. But no matter what the crisis is, you’re going to see the company respond rapidly. They’re going to get geared up and they’re going to activate their crisis process and they’re going to start to prepare and react. The second thing you’ll see is that inside of the organization, there are clear roles and responsibilities. Again, there are clear roles and responsibilities. Someone is in charge of the response, the incident leader or incident commander if you want to use an incident command s

Managing Uncertainty Podcast - Episode #117: What Successful Crisis Management Looks Like Internally

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses some of the tools we use here at Bryghtpath each and every day to manage our business and work with our clients. Tools we discuss include: Monday.com Notion Slack Salesforce Sales Cloud Professional Superhuman Google Workspace Drip ConvertKit Pandadoc WordPress Zoom Avoma Quickbooks Related Episodes & Blog Posts Blog Post: The Importance of Having a Crisis Communications Strategy Blog Post: What is a Business Impact Analysis (BIA)? Episode #109: Business Continuity as a Service (BCaaS) Episode #111 – The Value of a Trusted Advisor Episode #114: Mental Health in our Profession Episode Transcript Hello, and welcome to The Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in this week’s episode, I want to talk about a question that we get asked all the time. And that is what are some of the tools that you use there at Bryghtpath to manage your business, to manage collaboration, to work with your clients? And so I want to walk through a couple tools in our suite of tools that we use that really help us do the work that we’re here to do. And then I also want to talk about a couple outside services that we would recommend for consultants or small businesses to have in your back pocket as well. So let’s start with project management. As a consultant, as somebody who does client engagements on an ongoing basis, one of the tools that we use is our project management tool. And we have been on for most of the past year, a platform called monday.com. You may have seen ads for this on YouTube or Facebook. It’s a newer platform, but one that’s quite interesting that we’ve enjoyed using because of the flexibility that Monday provides. The way that we use Monday within the organization is that we have two types of workspaces, which you can think of as a collection of project boards and reports. Our main workspace is a base of sorts for Bryghtpath, where we have our internal efforts that are going on. These could be projects, it could be maintenance here in the office. It could be administrative and financial things that I need to manage as the CEO. So we have separate kind of project boards for those. And then we have workspaces for each of our clients. So for each organization that we’re currently working with, we have a workspace. So let’s say we’re working with Acme Inc. There’s an Acme Inc workspace. And within that workspace will be different boards. I think of boards as a

Managing Uncertainty Podcast - Episode #116: Tools We Use At Bryghtpath (2021 Edition)

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses Brian Kreb’s recent article “Don’t wanna pay ransom gangs? Test your backups”. Topics discussed include dealing with ransomware as a disaster recovery and business continuity problem. Do you have the proper backups in place? Do you really know what recovery will require in the event of a large-scale ransomware issue? Related Episodes & Blog Posts Blog Post: 6 times business continuity and disaster recovery plans mattered Blog Post: 10 Ways An Effective Crisis Manager Survives a Crisis Episode #50: Conducting an Effective After-Action Process Episode #63: Prioritizing Top Risks Episode #82: Speed in a Crisis Episode Transcript Hello, and Welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in this week’s episode, I want to talk about ransomware specifically about backup strategies and ransomware. And what raised this to my attention earlier this week is an article by information security journalist, Brian Krebs who writes at KrebsOnSecurity.com, and his article is entitled, Don’t Wanna Pay Ransom Gangs? Test Your Backups. And Brian hits upon some really important facts and underlying issues with the way we think about ransomware right now. And we’re thinking about ransomware, I think we think about ransomware primarily as an information security problem, and it is, but it’s also a disaster recovery and business continuity problem. And it’s bigger. It’s more of an issue. It’s a bigger issue than we think of in the BCDR space. So, I want to kind of talk through some key points that Brian makes then I’ll add a little bit of other contexts to wrap up this episode. Krebs writes, look at the comments on almost any story about a ransomware attack and you’ll almost surely encounter the view that the victim organization could have avoided paying the extortionist, the ransom working if they’d only had proper data backups. The ugly truth, as he writes, there’s many non-obvious reasons why victims wind up paying even though they’ve done nearly everything right from a data backup perspective. His story, he points out is not about what companies are doing in response to cyber criminals that are holding their data for hostage and that’s become a best practice now. And in an approach on how they’re going to, how you respond, how do you do this? But rather why will victims pay for a key? The key that’s needed to decrypt their systems, even when they already have the means to restore anything from backups on their own. What experts are saying according to Krebs is the biggest reason that ransomware targets are, why ransomware targets or their insurance providers are still paying, even when they already have reliable backups. Is nobody at the victim organization has bothered to test in advance how long that data restoration process might take? Krebs quotes Fabian Wosar, the chief technology officer at Emsisoft, perhaps. And Fabian says, in a lot of cases companies do have backups, but they have never

Managing Uncertainty Podcast - Episode #115: Ransomware and Backups

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses mental health as a Business Continuity, Crisis Management, and Corporate Security Professional. Topics discussed in this episode include stress and anxiety, the impact of the pandemic on business continuity and crisis management professionals, how to find help in an emergency, and where to go to talk about the last several months. Related Episodes & Blog Posts Blog Post: Four steps you can take today to improve your personal preparedness Blog Post: Making Decisions in the Midst of a Crisis Episode #94: Personal and family preparedness for Coronavirus Episode #105: Taking care of yourself during a crisis Episode Transcript Hello, and welcome to the Managing Uncertainty podcast. This is Bryan Strawser Principal and Chief Executive here at Bryghtpath. And, in this week’s episode, I want to talk a little bit about mental health. Mental health for you as a business continuity and crisis management, corporate security, professional, and everything that we’ve been through over the last 18 to 20 months as we’ve guided our organizations, our clients, our families through this global pandemic that has driven almost everything that we’ve had to deal with over the last almost two years now. And, I approach this from the standpoint that I don’t have all the answers. I’m not asking for help here or crying out for help. I’m not trying to be brave or anything like that as I talk about mental health and these challenges we’re faced with, with our own resiliency, with our own challenges. As we think about what we’ve all been through in the last 20 months or so with this pandemic and the role that we’ve had to play as business continuity and crisis management and security professionals. But, I do think that we need to do a better job as an industry, as individuals, as people normalizing talking about struggles like this. Struggles that we have as we work through challenging situations. Struggles that we have, we may have, with depression or anxiety, both of which are issues I’ve been faced with in my teenage years and adult life. But, also just the stress that we face in these situations that we have to deal with. In my own career, I have dealt with all of the issues related to managing crisis situations where lives were at stake. I have lost fellow employees in shootings and violent crime. My team, when I worked in a Fortune 30 company, regularly dealt with homicides and suicides of their fellow workers. We managed and helped to manage situations where an employee had killed another employee. Sometimes people that we knew and had interactions with. And, all of the stress that is created in that and all of the trauma that impacts us. And, I think that all of those are things we should acknowledge, but then we look at what we’ve all dealt with in the last two years dealing with the pandemic. Where whether we’ve had support within our organizations or not, whether we’ve had resources, maybe not even the resources that we need within our companies to have dealt with the myriad of issues that we’ve been faced with over the last year and a half, as we’ve dealt with the pandemic. Our companies

Managing Uncertainty Podcast - Episode #114: Mental Health in our Profession

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses roles and responsibilities within a business continuity program.  What roles should be established?  What are their responsibilities? Topics discussed include the benefits of having clear roles and responsibilities in a business continuity program,  assessing the best talent for key roles in your program, and how the various proposed roles help advance and mature your business continuity program. Related Episodes & Blog Posts Blog Post: Business Continuity Program Roles & Responsibilities Blog Post: Before the Crisis: The Value of a Trusted Business Continuity & Crisis Management Advisor Episode #102: The Bryghtpath Business Continuity Framework Episode #104: Supporting the team in a prolonged crisis Episode #106: Rethinking Business Continuity in the age of COVID-19 Episode Transcript Hello, and welcome to the Managing Uncertainty podcast. This is Bryan Strawser, Principal and Chief Executive here at Bryghtpath. And in this week’s episode of our podcast, I’d like to talk about roles and responsibilities within a business continuity program. Folks come to us all the time with questions about their business continuity program. Wondering about roles and responsibilities, if you’re wondering about roles and responsibilities, you are not alone. When we talk to businesses about their continuity planning, we get asked every time, and every thing from what is one at the most basic level. A lot of companies don’t understand about business continuity plans, or BCPs and how that’s fundamentally different from disaster recovery planning or crisis planning. Whereas, business continuity plans are about keeping your business running through a disruption. In the latter, disaster recovery plans are about resuming IT operations and bringing back critical technologies and infrastructure. But we also get questions that are on a more granular level. Like what are the most important roles in a business continuity planner program? What do those roles and responsibilities mean? How do roles interrelate? And how do we ensure we have the right people in these roles? As risk management and continuity experts here, at Bryghtpath, we help companies cut through all this confusion and get clear about the path you need to be on for business continuity planning and program success. When we talk about business continuity planning, we’re talking about the process of creating a framework that effectively allows you to respond to organizational disruption, minimizing the impact of that disruption on your organization, and ensuring operational continuity and resiliency. Let’s talk about the benefits of having good continuity planning, and then we’ll transition from that to talking a little bit about the roles and responsibilities. When we take a step back and examine the why of business continuity planning and programs, if the pandemic has taught us anything it’s that the unexpected can and absolutely will happen to our organizations. One client of ours shared a debrief of their experience and how having a solid continuity plan was critical to their response

Managing Uncertainty Podcast - Episode #113: Roles and Responsibilities in a BC Program

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses the Business Impact Analysis (BIA), how we approach the BIA process at Bryghtpath, and the value it can provide to your organization. Topics discussed include the Business Impact Analysis (BIA), the ISO 22301 Standard for Organizational Resilience, our approach to the BIA here at Bryghtpath, and the value of the Business Impact Analysis. Related Episodes & Blog Posts Blog Post: What is a Business Impact Analysis (BIA)? Blog Post: Validating your Business Impact Analysis Results Blog Post: Why failing to validate your business impact analysis results is a huge mistake Episode #24 – The Traditional Business Impact Analysis (BIA) Episode #25 – To BIA or not to BIA Episode Transcript Hello, and welcome to the Managing Uncertainty podcast. This is Bryan Strawser, principal and Chief Executive here at Bryghtpath. And in this week’s episode, I’d like to talk about the business impact analysis or BIA. We’ll talk a little bit about what it means, how you go about doing one, our approach in doing so and what the value is in doing the BIA in your organization. I started off with kind of this question, which is how many days of payroll can you lose? How many days can your payroll function in your company be down before it impacts your business? What about the servers that power your product or platform that you provide to customers? Or what about your virtual private network, your VPN, that employees use the connect to your secure resources and work remotely, that you probably use a lot during COVID. An hour, a day, a few weeks a month? If you’re like many companies, we talked to you, you may not know how long your business can survive without critical systems and business processes. For that reason, a thorough business impact analysis or BIA is one of the most important steps that we take when we work with new clients. Here’s what a business impact analysis is, why it’s important and what you’re going to learn by doing one. So, what is the BIA? Well, the formal description of a business impact analysis from the ISO 22301 standard on organizational resilience is the process of analyzing the impact over time of a disruption to the organization. The process of analyzing the impact over time of a disruption to the organization. To say it more clearly, a BIA is a thorough examination that exposes the likely impact a business disruption will have on your revenue, expenses, operation, and reputation of your organization. On our blog post that accompanies this article, you’ll see an example of what our business impact analysis report might look like, including the impact over time across several different factors. The example we show is impact on compliance and regulatory obligations to your organization&#821

Managing Uncertainty Podcast - Episode #112 - The Business Impact Analysis (BIA)

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses in detail the value of working with a Trusted Advisor before there is a disruption or crisis in your business.  How can having an expert guiding your every move related to business continuity, disaster recovery, crisis management, and crisis communication be of value to you and your program? Topics discussed include the value of a trusted advisor, coaching & advisory services, how a trusted advisor can help mature your program, and ways in which you might utilize a trusted advisor in a critical moment. Related Episodes & Blog Posts Blog Post: Before the Crisis: The Value of a Trusted Business Continuity & Crisis Management Advisor Blog Post: Evaluating Business Continuity Programs: Is your Business Continuity Program ready for the next Disruption? Episode #50: Conducting an Effective After-Action Process Episode #63: Prioritizing Top Risks Episode #81: When to bring in a consultant and use them effectively Episode Transcript Hello and welcome to the Managing Uncertainty Podcast. This is Bryan Strawser, principal and chief executive here at Bryghtpath. With today’s episode, I want to start off by kind of illustrating a situation and then getting into the real meat of this episode. And that is, I’ve been in this space about 30 years. And during that time, I’ve always been in some way, shape, or form on call. Sometimes a Bryghtpath client will call me late at night or early in the morning and they’re not checking in. It’s not a social call. They’re not out having a drink and calling me to check in or have some discussion about family or anything like that. Something’s happened. Something’s happened at their company and they’re calling to ask for help. In my three decades in working in business continuity and crisis management, I’ve gotten calls because of workplace fatalities, active shooter incidents, data breaches, employees stranded in a foreign country because of civil unrest or geopolitical disruption, for natural disasters, hurricanes, earthquakes, tornadoes, executive malfeasance, and just many, many more. If it’s happened, I’ve probably have dealt with it in some way, shape, or form. And that doesn’t count national and global disruptions like COVID. These are the ones that prompt phone calls and emails from every company we work with, and they’re all looking for help with their response. Every company deals with business disruptions and crisis situations, and no one wants to think about… For the most part, no one, other than us who work in the space, but no executive really wants to sit and think about how to manage a crisis situation at their business. But I can tell you this, you will face crisis events and major business disruptions at your company. I don’t care where you operate, what industry you’re in, what country you’re in, what your supply chain looks like, sooner or later, you will face a crisis, a major business disruption, and your company will be on the line.

Managing Uncertainty Podcast - Episode #111 - The Value of a Trusted Advisor

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser asks how you can know if your business continuity program is ready for the next disruption? In other words, how can you evaluate your current business continuity program and tell if you’re ready for what’s next? Topics discussed in this episode include industry standards such as ISO 22301, business continuity program evaluations, business continuity maturity models, and more. Related Episodes & Blog Posts Blog Post: Evaluating Business Continuity Programs: Is your Business Continuity Program ready for the next Disruption? Blog Post: ISO 27031: Looking at ISO’s Disaster Recovery Standard Episode #91: Roles and Responsibilities in a Business Continuity Program Episode #93: Crisis Management Plans – What your executives really want Episode #96: Crisis leadership in the time of Coronavirus Episode Transcript Hello, and welcome to the Managing Uncertainty Podcast this is Bryan Strawser, principal and chief executive here at Bryghtpath. And in today’s episode, I want to start off by setting the stage for the discussion that we’re going to have about understanding if your business continuity program, your crisis management program, is truly ready for the next disruption. So, I want to take you back to August and September of 2017, the beginning of the most recent run of crisis situations of business disruptions around the world. We had a series of hurricanes that tore through the Caribbean and the southeastern United States. We had Hurricane Harvey, Hurricane Irma and Hurricane Maria, three of the strongest hurricanes in recent memories. They took hundreds of lives and inflicted $210 billion in combined damage between the three storms, between the Caribbean and the southeastern United States. We fast-forward just two years later as we’re still recovering, in some cases, economically from the impact of those three hurricanes and even, logistically, still challenges in Puerto Rico and other parts of the Caribbean. And now, we’re faced with the COVID-19 pandemic, March 2020. March 11th, 2020, the National Basketball Association postpones its season with no clear idea if or when that it could resume. And then within days, companies across the country and truly around the world, sent their employees home, many of them with no clear plan of how to do their job remotely, all of this due to COVID-19 and the pandemic that we’ve all been faced with the last 15 years. And that hurricane season in 2017 and the pandemic of the last year and a half are just two of many recent examples of crisis events that have drastically disrupted business operations. So the question is, in the event of a disaster, how will you respond? And nobody enjoys thinking about crisis management or disaster recovery, outside of those of us that work in this space and do it because we enjoy the work, but nobody really wants to sit and think about these things, certainly not at all your senior executives. But the questions that business leader

Managing Uncertainty Podcast - Episode #110: Is your BC Program ready for the next disruption?

Welcome to Managing Uncertainty, a podcast series discussing global risk, crisis management, business continuity, and crisis communications. You’ll learn strategies, tactics, and resources about preparing for, responding to, and recovering from all sorts of disruptions and critical moments. Will you be ready to lead through your company’s critical moment?

hubhopper

Managing Uncertainty

hubhopper