Data Centers

Setting up a crisis communications center

Reestablishing your organization's IT capabilities takes ample planning before a disaster or a crisis happens. Here's how to plan for putting together a crisis communications center when you need to connect your business with the rest of the world.

The crisis communications center (CCC) is the nexus for all communications among the teams involved in disaster recovery. It serves to eliminate confusion, establish confidence among working partners, and act as the single point of contact between the organization and all external bodies. Not all communications will be routed through the CCC, but it will set the rules by which all disaster recovery communications will be conducted.

Although the term "crisis communications center" evokes images of banks of phones and swarms of bustling clerks, its primary attribute is simplicity. The CCC is a single point of contact between the affected organization, its leadership, and the outside world. Most of the time this will be a single trusted individual connected to the organization by phone, Internet, or personal contact.

The CCC establishes the three most critical communications needs in the event of a disaster: control, veracity, and authority.

Prerequisites

Three things are needed for any crisis communications center: the equipment to operate it, the personnel to staff it, and the rules by which it will operate. Location is not a primary concern. If the disaster is limited to a portion of the site affected, the CCC will be on the premises. If the disaster prevents the whole site from being used, the CCC will be located at a preestablished backup site specified in the organization's disaster recovery plan.

Equipment

A CCC will need to include the following equipment:

  • A landline phone, multiple lines optional, with a voicemail system
  • A PC running the applications needed by management as specified in the disaster recovery plan
  • An e-mail program compatible with the company standard and with a known and verifiable address, preferably within the company's domain and firewall
  • A fax machine and copier
  • Furniture for the equipment and operator(s)

Typically this equipment will be available at the affected location outside the disaster zone. If the disaster encompasses the entire site, it must be provided at the backup location, if present, or at a temporary crisis communications location determined by management. Note that all e-mail addresses, phone and fax numbers, and other contact information will be in the disaster recovery plan that each manager must have with them.

Personnel

The crisis communications center will be staffed by at least one senior administrative assistant who is knowledgeable in the disaster recovery plan. Above all, this person must know the command structure and be familiar to all the management teams involved in disaster recovery.

Depending on the size of the organization and its disaster communications needs, more personnel may be required, particularly for multiple shifts. Whenever possible, all personnel should be internal to the organization.

Rules

The most basic rule is this: The crisis communications center is responsible for establishing and maintaining control over communications, for the veracity of the information, and for speaking with the authority of leadership. The following documentation must be present:

  • The disaster recovery plan for the affected unit and all contact lists—verified and dated—for management and the affected teams
  • Guidelines in the crisis communications policy for establishing and controlling internal and external communications

Additionally, any requirements established for the particular situation by management and senior management, which must be documented when they are received and used, need to be at hand.

Setup: in-house

For most disasters, the crisis communications center will operate out of the senior manager's administrative assistant's office. When the contact numbers and addresses are known, the authority and veracity of the person do not need to be established, and control is not an issue. Equipment and information will be in place or provided as per the disaster recovery plan. The most critical part of the setup of any CCC is establishing its role in the handling of disaster recovery-related communications. It is far easier to do this from the original location, even if it must be done from a side office on borrowed equipment.

If several staffs occupy the same location, leadership may move to have a single common crisis communications center established to be manned in the event of disaster involving one or more staffs. The common CCC needs to be established under the leadership responsible for all the staffs sharing the facility, so that responsibility and costs are centralized. No one staff should be made to bear the full cost, even if the common CCC is located in its area. This location, once established, should not be changed, and it should not be used for any other purpose.

A common CCC has the advantage of having common hardware—including fax machines, copiers, and phone lines—and common software. Maintenance and upkeep of the equipment should be the responsibility of the leadership over all the staffs sharing the facility. If specialized hardware and software is required, provisions for installing those items at the time of the disaster should be made in each affected disaster recovery plan and should be tested at the same time as the rest of the plan (the same goes for deinstallation at the conclusion of testing or actual disaster.)

Check with your telephone and security representative to insure there is no problem with multiple crisis communications center personnel having access to the same voicemail account.

Setup: alternate location

Some disasters are so extensive that use of the original facility is not permissible. For such situations, two possibilities exist: a permanent alternate site, with equipment and furniture in place, or no permanent alternate site, and the crisis communications center must be reconstituted. A permanent alternative site will need to have been established by agreement with the permanent residents of that site; often these are reciprocal agreements, where Group A agrees to share its space and resources with Group B in the event of displacement due to disaster, and Group B agrees to do the same if disaster befalls Group A.

Rarely an alternative site will be available without a current occupant; the disaster recovery plan will specify what the alternatives are.

Permanent alternative site

If within the same company, even if not the same division, the first task of the CCC will be transmitting to all disaster recovery participants the declaration of disaster, along with the CCC contact information, including e-mail addresses (if different) and who will be on the phones. The CCC contact will have this information captured on the crisis communications center information sheet, ready for transmission. While this information needs to be captured in the disaster recovery plan, circumstances may require different locations or phone numbers. The CCC contact needs to capture and document this information as soon as possible.

No permanent alternative site

Establishing the crisis communications center is top priority, along with reestablishing communications among the leadership as provided in the disaster recovery plan. The minimum requirements are a phone number and an e-mail address that will both be available throughout the duration of the disaster. If no provision has been made for alternates within the same company prior to disaster, then these must quickly be established and promulgated to leadership.

In most cases, none of the required equipment will be immediately available. Procurement can be expected to be a problem.

For that reason, in the absence of alternatives, the crisis communications center may need to be located in a residence. At short notice the existing computer, if any, must be brought up to the standard on the CCC information sheet, and other necessary equipment, hardware, and software must be provided as listed.

This solution is less than optimal. Communications cannot be secured, computer hardware may not be upgradeable to the needed standard, access cannot be controlled, and as a result, corporate information needed for disaster recovery may not be placed in this location without violating company confidentiality or data security.

Because of this, leadership is encouraged to work with senior management to provide a common crisis communications center. The costs for equipping and staffing this common CCC can be shared, while data security is not compromised and the company's phone system, e-mail system, and computer assets may be used with minimal hindrance.

Please note that while a common crisis communications center can reduce costs for several staffs, it should not be used across large regions where the staffs may be separated by several miles, making transportation a problem. Nor can they be used vertically—that is, a common crisis communications center should not be used for multiple reporting levels of an organization, but only for staffs at the same reporting level. This avoids communication mistakes that would be easily avoided by routing through the respective levels of leadership.

Activation checklist

In the event of a declared disaster, getting the crisis communications center up and running is the first activity. To make sure no errors exist that would hamper communications and recovery efforts, the CCC contact is responsible for the steps needed to get the CCC operating in minimal time. The activation checklist poses a series of go/no go questions to insure a smooth launch. Top management should have the CCC contact test the activation of the CCC at least once a quarter using the activation checklist to make sure all preparations are in place and to identify any problems.

The steps are numbered and are used as follows:

1. Disaster declared?

Has management made the formal decision to declare a disaster? This step must precede all others, even in a drill.

2. CCC location available?

Is the physical space for the CCC accessible, and can the CCC contact actually enter it? If this space is normally secured, a member of the building support or security team may need to open it. This step should be documented in the disaster recovery plan and added to this activation checklist as necessary.

3. Information sheet confirmed?

Is all the information complete and current? Any gaps must be filled for activation to be successful.

4. Equipment sheet confirmed?

Is all the equipment listed on the sheet present or on its way? This should be a quick visual check. Any missing equipment that cannot be quickly replaced can hamper or limit activation and operation.

5. Primary phone live?

Is there a dial tone? Is voicemail active? Can voicemail be accessed? Any problems must be noted and dealt with as soon as possible.

6. Secondary phone live?

The same questions for any secondary phone. Skip if none, or if fax access is critical, test it now.

7. PC functional?

Does it boot normally? Does the desktop or security screen appear as normal?

8. Password/ID functional?

If the CCC computer is not tested more often than the default ID deactivation interval set by the company's information security policy, the ID may not be functional and access to the system will not granted. Make sure this does not happen. If reset is not possible, document the fact and the reason.

9. E-mail functional?

Does the e-mail package launch normally and present its logon screen? For corporate onsite systems, this is not a major point of failure. However, this is critical for offsite locations.

10. E-mail password functional?

If the CCC e-mail account is not accessed sooner than the ID deactivation interval set by the company's information security policy, the onsite CCC may not have e-mail access. For offsite locations, e-mail security may need to be established to prevent access by other persons. Such security should be applied before an actual disaster occurs to avoid errors during activation.

11. Web access present?

Does the primary browser launch and show the homepage? Internet access is more and more a critical business need, and a source of news and information is important for the crisis communications mission. If this is a test, note the present status of the firewall and antivirus software and whether they are up-to-date.

12. Contact list available?

The test of any communications plan is how well it works when it is broken. The contact list from the disaster recovery plan or even the normal company directory is absolutely vital to reestablishing communications and the chain of command. Ideally, the CCC contact should have a fresh copy in hand.

13. DRP present?

The disaster recovery plan, along with the critical communications policy, directs how communications in a disaster should be handled and what expectations are on the actors. The CCC contact must have a copy, preferably a duplicate of the master copy with all subdocuments possessed by the business unit manager.

14. Top manager alerted by phone?

The top manager needs to be informed at this point that all technology and information assets are in place for the crisis communications center to operate.

15. Top manager alerted by e-mail?

The top manager is sent confirmation by e-mail that electronic crisis communications are now active. An active response should be required for acknowledgment of function.

16. Direct reports alerted by phone?

The top manager's direct reports are now phoned and informed that the crisis communications center is now active and to expect confirmation by e-mail that they need to acknowledge on receipt. If voicemail group lists are used, they must be reviewed for completeness and recency during testing. Any failures must be logged and reported to the top manager.

17. Direct reports alerted by e-mail?

The direct reports are sent confirmation by e-mail that the electronic crisis communications are now active and that they need to acknowledge receipt. Any failures must be logged and reported to the top manager.

18. Additional equipment in place?

If additional computer hardware or other fixtures (burn bag, portable hard drive, portable CD burner) are needed for the CCC mission, their presence or arrival and installation should be noted here after communications have been sent. Any delays in testing should be noted for improvement later.

19. Additional information in place?

If additional information (electronic, paper, or other media) is required for the CCC mission, its presence or arrival should be noted here after communications have been sent. Any delays or missing information showing up in testing needs to be noted for improvement later.

20. All questions answered?

The final step of activation is to review any questions that came up in the course of activation and whether or not they have been satisfactorily answered. All questions not answered by the time Step 19 has completed need to be recorded and presented for improvement and possible modification of the disaster recovery plan. Otherwise, the crisis communications center is now active until management declares the disaster is over.

Crisis communications center deactivation

The final action of disaster recovery is for the crisis communications center to announce the formal end of the effort and to declare the crisis communications center closed. At deactivation, the crisis communications center contact should review the activation checklist, steps 2 through 11 and 19, and make sure the equipment and access needed are still present and functional before closing the physical site. Please note that your company information security policy may require an audit of any offsite computing devices to make sure no proprietary data is left behind. Any noted defects in the machinery, the protocols, or the process should be preserved for the next disaster recovery plan review.

Everything should now be ready when disaster comes again.

Editor's Picks