The crisis communications center (CCC) is the nexus for all
communications among the teams involved in disaster recovery. It serves to
eliminate confusion, establish confidence among working partners, and act as
the single point of contact between the organization and all external bodies.
Not all communications will be routed through the CCC, but it will set the
rules by which all disaster recovery communications will be conducted.

Although the term “crisis communications center” evokes
images of banks of phones and swarms of bustling clerks, its primary attribute
is simplicity. The CCC is a single point of contact between the affected
organization, its leadership, and the outside world. Most of the time this will
be a single trusted individual connected to the organization by phone,
Internet, or personal contact.

The CCC establishes the three most critical communications
needs in the event of a disaster: control, veracity, and authority.

Prerequisites

Three things are needed for any crisis communications center:
the equipment to operate it, the personnel to staff it, and the rules by which
it will operate. Location is not a primary concern. If the disaster is limited
to a portion of the site affected, the CCC will be on the premises. If the
disaster prevents the whole site from being used, the CCC will be located at a
preestablished backup site specified in the organization’s disaster recovery plan.

Equipment

A CCC will need to include the following equipment:

  • A landline phone, multiple lines optional, with
    a voicemail system
  • A PC running the applications needed by
    management as specified in the disaster recovery plan
  • An e-mail program compatible with the company
    standard and with a known and verifiable address, preferably within the company’s
    domain and firewall
  • A fax machine and copier
  • Furniture for the equipment and operator(s)

Typically this equipment will be available at the affected
location outside the disaster zone. If the disaster encompasses the entire
site, it must be provided at the backup location, if present, or at a temporary
crisis communications location determined by management. Note that all e-mail
addresses, phone and fax numbers, and other contact information will be in the disaster
recovery plan that each manager must have with them.

Personnel

The crisis communications center will be staffed by at least
one senior administrative assistant who is knowledgeable in the disaster
recovery plan. Above all, this person must know the
command structure and be familiar to all the management teams involved in
disaster recovery.

Depending on the size of the organization and its disaster
communications needs, more personnel may be required, particularly for multiple
shifts. Whenever possible, all personnel should be internal to the organization.

Rules

The most basic rule is this: The crisis communications
center is responsible for establishing and maintaining control over
communications, for the veracity of the information, and for speaking with the
authority of leadership. The following documentation must be present:

  • The disaster recovery plan for the affected unit
    and all contact lists—verified and dated—for management and the affected teams
  • Guidelines in the crisis communications policy
    for establishing and controlling internal and external communications

Additionally, any requirements established for the
particular situation by management and senior management, which must be
documented when they are received and used, need to be at hand.

Setup: in-house

For most disasters, the crisis communications center will
operate out of the senior manager’s administrative assistant’s office. When the
contact numbers and addresses are known, the authority and veracity of the
person do not need to be established, and control is not an issue. Equipment
and information will be in place or provided as per the disaster recovery plan.
The most critical part of the setup of any CCC is establishing its role in the
handling of disaster recovery-related communications. It is far easier to do
this from the original location, even if it must be done from a side office on
borrowed equipment.

If several staffs occupy the same location, leadership may
move to have a single common crisis communications
center established to be manned in the event of disaster involving one or more
staffs. The common CCC needs to be established under the leadership responsible
for all the staffs sharing the facility, so that responsibility and costs are
centralized. No one staff should be made to bear the full cost, even if the common
CCC is located in its area. This location, once established, should not be
changed, and it should not be used for any other purpose.

A common CCC has the advantage of having common hardware—including
fax machines, copiers, and phone lines—and common software. Maintenance and
upkeep of the equipment should be the responsibility of the leadership over all
the staffs sharing the facility. If specialized hardware and software is
required, provisions for installing those items at the time of the disaster
should be made in each affected disaster recovery plan and should be tested at
the same time as the rest of the plan (the same goes for deinstallation at the
conclusion of testing or actual disaster.)

Check with your telephone and security representative to
insure there is no problem with multiple crisis communications center personnel
having access to the same voicemail account.

Setup: alternate location

Some disasters are so extensive that use of the original
facility is not permissible. For such situations, two possibilities exist: a
permanent alternate site, with equipment and furniture in place, or no
permanent alternate site, and the crisis communications center must be
reconstituted. A permanent alternative site will need to have been established
by agreement with the permanent residents of that site; often these are
reciprocal agreements, where Group A agrees to share its space and resources
with Group B in the event of displacement due to disaster, and Group B agrees
to do the same if disaster befalls Group A.

Rarely an alternative site will be available without a
current occupant; the disaster recovery plan will specify what the alternatives
are.

Permanent alternative site

If within the same company, even if not the same division, the
first task of the CCC will be transmitting to all disaster recovery
participants the declaration of disaster, along with the CCC contact
information, including e-mail addresses (if different) and who will be on the
phones. The CCC contact will have this information captured on the crisis
communications center information sheet, ready for transmission. While this information needs to be captured in the disaster recovery
plan, circumstances may require different locations or phone numbers. The CCC
contact needs to capture and document this information as soon as possible.

No permanent alternative site

Establishing the crisis communications center is top
priority, along with reestablishing communications among the leadership as
provided in the disaster recovery plan. The minimum requirements are a phone
number and an e-mail address that will both be available throughout the
duration of the disaster. If no provision has been made for alternates within
the same company prior to disaster, then these must quickly be established and
promulgated to leadership.

In most cases, none of the required equipment will be
immediately available. Procurement can be expected to be a problem.

For that reason, in the absence of alternatives, the crisis
communications center may need to be located in a residence. At short notice
the existing computer, if any, must be brought up to the standard on the CCC information
sheet, and other necessary equipment, hardware, and software must be provided
as listed.

This solution is less than optimal. Communications cannot be
secured, computer hardware may not be upgradeable to the needed standard,
access cannot be controlled, and as a result, corporate information needed for
disaster recovery may not be placed in this location without violating company
confidentiality or data security.

Because of this, leadership is encouraged to work with senior
management to provide a common crisis communications center. The costs for equipping and
staffing this common CCC can be shared, while data security is not compromised
and the company’s phone system, e-mail system, and computer assets may be used
with minimal hindrance.

Please note that while a common crisis communications center
can reduce costs for several staffs, it should not be used across large regions
where the staffs may be separated by several miles, making transportation a
problem. Nor can they be used vertically—that is, a common crisis
communications center should not be used for multiple reporting levels of an
organization, but only for staffs at the same reporting level. This avoids
communication mistakes that would be easily avoided by routing through the
respective levels of leadership.

Activation checklist

In the event of a declared disaster, getting the crisis
communications center up and running is the first activity. To make sure no
errors exist that would hamper communications and recovery efforts,
the CCC contact is responsible for the steps needed to get the CCC operating in
minimal time. The activation checklist poses a series of go/no go questions to
insure a smooth launch. Top management should have the CCC contact test the
activation of the CCC at least once a quarter using the activation checklist to
make sure all preparations are in place and to identify any problems.

The steps are numbered and are used as follows:

1. Disaster declared?

Has management made the formal decision to declare a
disaster? This step must precede all others, even in a drill.

2. CCC location available?

Is the physical space for the CCC accessible, and can the
CCC contact actually enter it? If this space is normally secured, a member of
the building support or security team may need to open it. This step should be
documented in the disaster recovery plan and added to this activation checklist
as necessary.

3. Information sheet confirmed?

Is all the information complete and current? Any gaps must
be filled for activation to be successful.

4. Equipment sheet confirmed?

Is all the equipment listed on the sheet present or on its
way? This should be a quick visual check. Any missing equipment that cannot be
quickly replaced can hamper or limit activation and operation.

5. Primary phone live?

Is there a dial tone? Is voicemail active? Can voicemail be
accessed? Any problems must be noted and dealt with as soon as possible.

6. Secondary phone live?

The same questions for any secondary
phone. Skip if none, or if fax access is critical, test it now.

7. PC functional?

Does it boot normally? Does the desktop or security screen
appear as normal?

8. Password/ID functional?

If the CCC computer is not tested more often than the
default ID deactivation interval set by the company’s information security policy,
the ID may not be functional and access to the system will not granted. Make
sure this does not happen. If reset is not possible, document the fact and the
reason.

9. E-mail functional?

Does the e-mail package launch normally and present its
logon screen? For corporate onsite systems, this is not a major point of
failure. However, this is critical for offsite locations.

10. E-mail password functional?

If the CCC e-mail account is not accessed sooner than the ID
deactivation interval set by the company’s information security policy, the onsite
CCC may not have e-mail access. For offsite locations, e-mail security may need
to be established to prevent access by other persons. Such security should be
applied before an actual disaster occurs to avoid errors during activation.

11. Web access present?

Does the primary browser launch and show the homepage? Internet
access is more and more a critical business need, and a source of news and
information is important for the crisis communications mission. If this is a
test, note the present status of the firewall and antivirus software and
whether they are up-to-date.

12. Contact list available?

The test of any communications plan is how well it works
when it is broken. The contact list from the disaster recovery plan or even the
normal company directory is absolutely vital to reestablishing communications
and the chain of command. Ideally, the CCC contact should have a fresh copy in
hand.

13. DRP present?

The disaster recovery plan, along with the critical communications
policy, directs how communications in a disaster should be handled and what
expectations are on the actors. The CCC contact must have a copy, preferably a
duplicate of the master copy with all subdocuments possessed by the business
unit manager.

14. Top manager alerted by phone?

The top manager needs to be informed at this point that all
technology and information assets are in place for the crisis communications
center to operate.

15. Top manager alerted by e-mail?

The top manager is sent confirmation by e-mail that
electronic crisis communications are now active. An active response should be
required for acknowledgment of function.

16. Direct reports alerted by phone?

The top manager’s direct reports are now phoned and informed
that the crisis communications center is now active and to expect confirmation
by e-mail that they need to acknowledge on receipt. If voicemail group lists
are used, they must be reviewed for completeness and recency during testing. Any
failures must be logged and reported to the top manager.

17. Direct reports alerted by e-mail?

The direct reports are sent confirmation by e-mail that the
electronic crisis communications are now active and that they need to
acknowledge receipt. Any failures must be logged and reported to the top
manager.

18. Additional equipment in place?

If additional computer hardware or other fixtures (burn bag,
portable hard drive, portable CD burner) are needed
for the CCC mission, their presence or arrival and installation should be noted
here after communications have been sent. Any delays in testing should be noted
for improvement later.

19. Additional information in place?

If additional information (electronic, paper, or other
media) is required for the CCC mission, its presence or arrival should be noted
here after communications have been sent. Any delays or missing information
showing up in testing needs to be noted for improvement later.

20. All questions answered?

The final step of activation is to review any questions that
came up in the course of activation and whether or not they have been
satisfactorily answered. All questions not answered by the time
Step 19 has completed need to be recorded and presented for improvement and
possible modification of the disaster recovery plan. Otherwise, the crisis
communications center is now active until management declares the
disaster is over.

Crisis communications center deactivation

The final action of disaster recovery is for the crisis
communications center to announce the formal end of the effort and to declare
the crisis communications center closed. At deactivation, the crisis
communications center contact should review the activation checklist, steps 2
through 11 and 19, and make sure the equipment and access needed are still
present and functional before closing the physical site. Please note that
your company information security policy may require an audit of any offsite
computing devices to make sure no proprietary data is left behind. Any noted
defects in the machinery, the protocols, or the process should be preserved for
the next disaster recovery plan review.

Everything should now be ready when disaster comes again.