Defending the Fortress Women in FM 15 th July Samantha Bowman Senior Facilities Manager

Transcription

1 Samantha Bowman Senior Facilities Manager

2 Defending the Fortress Business Continuity The Terror Threat

3 With the Country now on a SEVERE level of alert meaning that the threat of an attack is highly likely, what are you doing to reduce the risks to your people and building?

4 What are threat levels? The system of threat levels has been created to keep you informed about the level of threat the UK faces from terrorism at any given time. This system helps police and other law enforcement agencies decide how to allocate staff. The threat level represents the likelihood of an attack in the near future. The Home Office

5 The threat levels There are five levels of threat: critical - an attack is expected imminently severe - an attack is highly likely substantial - an attack is a strong possibility moderate - an attack is possible but not likely low - an attack is unlikely

6 Who decides the threat levels? The Security Service (MI5) and the Joint Terrorism Analysis Centre (JTAC) work together to set the UK's threat level. To do this, they consider information gathered through intelligence in the UK and abroad. They also consider how terrorist organisations have behaved in the past. In some cases, counter-terrorism officials have to use their best judgement when deciding just how close a terrorist group might be to staging an attack.

7 What should you do? You should always remain alert to the danger of terrorism, look out for any potential signs of terrorist activity you may encounter. But you should not let the fear of terrorism stop you from going about your day-to-day life as normal. Your risk of being caught up in a terrorist attack is very low.

8 Partnership Partnership is vital to the success of counter-terrorism work. We need to make the most of the expertise and knowledge held by industry and academia and to foster strong, collaborative partnerships. Office for Security and Counter-Terrorism

9 The threat and risk remains not if but when, where and how The security services cannot beat terrorism alone they need our eyes and ears We cannot eliminate risk but we can minimise it Collective action is the key to security and prosperity

10 More needs to be done to encourage personal engagement of business leaders. Not just those from: Critical National Infrastructure ie Utilities, Telecommunication companies Major blue chips Thousands of small business and organisations still need to be engaged: that could be you... That could be your suppliers...you all have something to contribute.

11 So how can you reduce the risks? By promoting; The understanding of good BCM plans Informing and testing the staff yours and your suppliers Developing external partnerships other businesses, neighbourhood schemes, local police Integrating Security with FM

12 Some of the Questions? Are you all engaged with your Security Teams? When did you do your last risk assessment of your building? What were your greatest risks do you have a plan to addresses these? What role does FM play in the companies Security plans in the event of an attack? What role would Security play in the event of a major incident. How much do you tell your staff, your emergency teams or your partners about your plans? Do you have a good current BCM plan that is accessible 24/7? When did you last test you plan?

13 Understanding good BCM plans and bad BCM plans. A good BCM plan has current contact details of your staff and supplier A good BCM plan is looked at and tested regularly in conjunction with your key suppliers A good BCM plan says what you need to do to deal with the crisis A good BCM plan advises you when to escalate and hand over control A good BCM plan helps you to recover the Business

14 Understanding good BCM plans and bad BCM plans. A bad BCM plan is on the shelf, out of date and covered in dust! A bad BCM tells you NOTHING that will help you in your hour of need! Where is your BCM plan???

15 Practice, Practice, Practice A good BCM plan is reviewed constantly and tested regularly Staff should receive relevant training in how to deal with incidents: I have successfully trained both security and FM staff together, it s not about the uniform you wear it s about reducing the risks Role Plays and Scenarios Chemical Biological Response Teams Warn and Inform Systems Emergency Planning and Evacuations

16 Knowing your Partners How Ready are They? If you rely on your partneres then you rely on their plans You must engage them in your planning. It s no good being ready if they are not The co ordination of information can start with you

17 Conclusions No foreseeable end to the terrorist threat It is likely to increase in scope and scale We will constantly need to re evaluate strategy and tactics We must Invest in people and technology Strength and resilience in managing will come from planning and practice

18 A Case Study Business Continuity Plan Gas Leak 12 th July 2009

19 LEVEL 3 Minor H&S issue Local interruption to business activities Potential regulatory breach No or minimal visibility to clients No media involvement LEVEL 2 Significant H&S issue Regional interruption Significant disruption to business activities Minor regulatory breach Local/national media involvement LEVEL 1 Major H&S issue Major disruption to service Significant damage to reputation Significant disruption to service Major regulatory breach National/International Media Involvement EXAMPLE ODS Leak FM Incident, Pipe Burst, Chemical/Oil Spill Potential for; business impact of more than 4hours, loss of trading or restricted access to a business unit or risk cell EXAMPLE FM Incident, Suspicious Package, Major Pipe Burst, Disconnection of a Utility Loss of a business unit capability for up to 4 hours EXAMPLE Loss of all business capability for a location for 4 hours or more FM Site Team Advise Location Incident Management Team who inform head office through normal reporting lines FM Crisis Management Team ( off iste) Tactical & Operational Teams Advise regional Crisis Management Team Business Crisis Management Team Strategic, Tactical & Operational Teams Immediate action

20

21 Lessons Learnt The postal address of Paris Gardens was not widely known both to Acuity and L & G staff. These details are now included in the DAR and in the BCP box. They could also be made a available to staff via the intranet/helpline. A telephone number to contact Paris Gardens would have been useful to aid communications. This could be made available to staff via the intranet/helpline and it has also being added to the UK F BCP Contact List. Those staff who were business critical were unclear of their responsibilities and had not all been briefed on the DR site. A procedure to call off basic stationary requirements ie. Paper, pens, calculators etc should be considered as a minimum. We were fortunate to be able to have access to collect some items. A costed list has been developed and is attached. Reception staff could have been utilised more effectively at the DR site ie providing telephone support, admin and other ad hoc duties.

22 Lessons Learnt Our Sub Tenant, were not contacted in advance to advise of building closure. Consideration has been given to putting in place an escalation procedure that advises sub tenants in advance of any possible disruption to access/egress from the building. This is to be noted in the Acuity Business Continuity Plan. Consideration could be given by L & G into ways in which Service Partners who are not directly engaged by Acuity should be advised. A number of new starters reported for work on the day of the gas leak. They had no formal contact numbers and only names of HR or line manager. Engineers were unable to monitor/alter the status of main building plant remotely. This is currently only possible at the desk through the BMS. The costs to provide for a remote access system have been provided (4.5K). While it was not necessary to do this during this event it we could have turned off main plant that was not needed. This is considered to be something that would be useful in a number of emergency type situations. Acuity staff were unable to log onto the network with only web access to . Consideration could be given to operational FM and deputy having push /blackberry to aid in communications. No access to L & G network files. A suggestion has been put forward for an encrypted data stick to be backed up monthly

23

24

25

26

27 MICAD Major Incident Cordon Access Database