SEC Faculty Advisor

Planning and Preparing for a Possible H1N1 Pandemic

Q.  What is security’s role in planning and preparing for a possible H1N1 pandemic that could impact business continuity?  For instance, should security be involved in decisions regarding possible travel restrictions? What do you think about developing a policy or guideline in the event of a contaminated employee and what are the pros and cons of stockpiling supplies?

A.  The best answer is a company already has in place an established crisis management team, consisting of key company components for critical incident planning and response.  This same crisis team concept is important in developing contingency plans for H1N1.  Joint planning creates an understanding of each department’s area of responsibility, reduces duplication of effort, confusion or conflict and addresses the ongoing situation quickly.  Any H1N1 planning and response must also include input from local and state health departments and information from the Center for Disease Control (CDC)  www.cdc.gov .  Local and state contacts are important since the impact of an outbreak will vary across geographic locations.

As in any crisis planning, security must be an integral partner with other company entities (human resources, medical, operations, legal, etc.,) in planning for a possible H1N1 pandemic.  As a part of the planning team, security can provide advice and guidance on procedures that will have an impact on the protection of company assets (people, property, information and reputation).  Security must be involved in decisions for alternate work environments and/or locations for employees, work from home strategies, increased social distancing in the workplace, restriction or cancellation of non-essential business travel, and possible disruptions while traveling overseas.  Security must have an understanding of human resources, legal, and operational concerns prior to implementing their security procedures.

Prior to travel overseas travelers should be provided with information on what to expect if they are confronted with a suspected pandemic flu situation while in travel status and plans should be in place for the care of business travelers infected while traveling.  The company should have arrangements with their travel department or contract agency on the number of employees in travel status and procedures for conveying important pandemic flu information to them. 

It is important that communication be provided to employees on what to expect if the company and community are impacted by H1N1.  There will be many issues outside the control of the business that may impact operations.  For example, if schools are closed, what impact will this have on the workforce?  If other businesses in the community close will this impact the company’s supplier or customer base, and will employees want to know why their company is not in sync with the community?  With these external conditions influencing the business, the senior security executive should have networking in place with other corporate security executives and their counterparts in the public sector.  Employees must have confidence in the information they are receiving and this can only be accomplished with good coordination between company components and also with outside agencies.  Confusion can be eliminated if company employees have an understanding of company policies and procedures prior to a pandemic.

Since Security needs to maintain its staffing levels and its capability to protect company assets, consider the impact the pandemic may have on security personnel.   Security personnel should be thoroughly briefed on company policies,  personal protection, how to respond to suspected flu cases, and be provided with appropriate protective gear. A good idea is to conduct a tabletop exercise on a pandemic scenario with key members of the team to discuss responding to a pandemic.  This will help to improve the team’s response and also to illuminate any deficiencies in the plan.

Resources:

The following government website is a good resource that contains extensive planning documents, including checklists for businesses as well as individual and family planning guides: www.pandemicflu.gov. 

The decision to stock pile influenza antiviral drugs during a pandemic must be made on a company by company basis.  Guidance in the decision making process can be obtained from:  Considerations for Antiviral Drug Stockpiling by Employers in Preparation for an Influenza Pandemic (www.flu.gov/vaccine/antiviral_employers.html).

Security can obtain information from the Overseas Security Advisory Council (OSAC) http://www.osac.gov/  or the CDC travel website www.cdc.gov/travel on overseas travel situations. 

Answer provided by Rad Jones, Security Executive Council Emeritus Faculty.

Unified Risk Management

Q. Why should I care about all this talk about convergence?

A. In today’s complex global economy, CEOs have a fiduciary responsibility to shareholders to ensure that a unified risk management process is established.  Risk is oblivious to organizational boundaries and transcends the organization both internally and externally. Critical business processes that were traditionally controlled internally are commonly now reliant on third party suppliers that may be in some far flung corner of the globe.  A single point of accountability and leadership responsible for assessing, monitoring and recommending mitigation for the entire portfolio of risks the business enterprise faces is vital to the survivability of the entire entity.  The security executive is the natural strategic leader for this effort, since they normally head the effort to collect and analyze intelligence on the broad range of risks the corporation faces globally and commonly are responsible for oversight of business continuity planning and crisis management.

While the term convergence has been utilized primarily in the context of merging the narrow bands of physical security and information systems security, it must go much further than that.  Without accountability being truly converged, the security executive is left blinded to the totality of the broad issues that potentially impact the viability of the entire business enterprise. Convergence must be redefined to move beyond including these narrow bands into ensuring that all interdependent elements of the business assurance program are integrated. The business assurance program must address the safeguarding of all business enterprise processes, assets, resources and people wherever they are situated around the world. Failure to effectively address business assurance through a unified risk management process results in creating unacceptable levels of legal and regulatory exposure for the business enterprise.

Answer provided by Lynn Mattice, Security Executive Council’s Chairman of the Board of Advisors

Training and Awareness Initiatives During Budget Reductions

Q: With massive budget reductions and travel restrictions, can you give me some pointers on how I might continue to implement training and awareness initiatives?

Whenever organizations restrict spending, alternative means of delivering work must be considered carefully. Fewer budget dollars generally means having to eliminate or reduce projects and services.  Training and awareness initiatives are often cut back, especially those with high costs. To continue to offer these programs, I would recommend conducting a simple exercise to view each program against the following criteria. First, rate how the intended program supports the company’s overall current goals. Next, rate the program against the company’s principles (such as maintaining a safe and secure workplace); and finally, does the program offer a value for meeting any legal or regulatory compliance.

Once this is completed, the options for delivering the “vital” security employee training or awareness methodologies can be considered. These should include a logical range of options from in person instructor led training to the use of online meeting applications to facilitate training long distance. E-mail campaigns and the company Intranet may also serve as excellent sources for disseminating awareness information to employees. Whatever the delivery form, by aligning efforts to highest needs of the organization, security programs can continue to implement training and awareness in all but the most dire business conditions.

Answer provided by Joseph C. Nelson, Security Executive Council Emeritus Faculty.

Preparing for Security Career Opportunities in the Private Sector

Q. I am ex-military. I would really like to get into private security, specifically in the area of protection more than anything else. I need to be pointed in the right direction so that I can actually apply the skills I have gained and know something about.

A. At the present time there are a number of opportunities for individuals in the area of employee or executive protection. You need to think about the following questions to help guide your path as you make plans for your future career in private security:

1. When you were in the military, what was your specialty and what branch of the service were you in?
2. How old are you now? 
3. Are you willing to work anywhere in the world?
4. How much travel are you willing to do...25%, 50%, 75%?
5. Since leaving the military what defensive/offensive martial arts skills, weapons qualifications, and evasive driving or other skills have you acquired?
6. Have you passed any evasive driving or protective detail training programs similar to those found at the following web sites: < www.safehouse.com > or <  www.rloatman.com  >  and if so what was the most recent course you attended?

The above questions may seem like a lot, but in the field of executive or employee protection they are the criteria organizations look at as part of their screening process.  One of the most difficult challenges is dealing not only with the travel, but also the amount of time away from family.

As you do your research, make sure you do due diligence when checking web sites, schools, and other opportunities in this exciting field.  I would caution you NOT to send any money or subscribe to any "service" until you have checked them out and are satisfied they are legit!  In this area of employment there are lots of scams just like everywhere else. 

If you have broader interests in transitioning into the security area you may want to take a look at my new book, From One Winning Career to the Next, which deals specifically with issues moving from the public sector (law enforcement, military, or intelligence fields) to the private sector of business and service organizations.  

I hope the above helps to point you in some new and positive directions.

Answer provided by J. David Quilter, Security Executive Council Faculty Emeritus.  David’s new book, "From One Winning Career to the Next," is available for purchase at https://www.securityexecutivecouncil.com/secstore/index.php?main_page=product_info&cPath=77_65&products_id=320

Higher Education for the Next Generation Security Leader

Q. I have read the Council’s series of articles in the Knowledge Corner on the Next Generation Security Leader. The article about acquiring security training and knowledge, including academic degrees, prompted a question in my mind. I understand that experience in core programs is essential; however, I was wondering if you could give some insight into how higher education is addressing the needs of next generation security leaders.

A. There are a number of institutions of higher learning that offer undergraduate, graduate, and certificate programs in “Security Management.” Unfortunately, the current curricula in these programs tend to focus on traditional issues including: personnel management, loss prevention methodology, investigations, legal aspects and liability, IT security, emergency management and terrorism. While all of these topics are important, they don’t adequately address the breadth of business competence that will be the hallmark of the next generation security leader. As recent surveys have shown, those selected for high profile security positions are increasingly coming from business backgrounds. This is in large part because CEOs, CFOs, and Boards of Directors want individuals in those positions who understand the company’s business objectives and can make risk management decisions within that context.

One of the most effective ways to protect and preserve a company’s business and reputation is to prevent bad business decisions. A security professional can add value to that process by understanding and being able to provide risk related input on issues such as product development, marketing, business development, advertising, regulation and compliance, and emerging markets. However, to be regarded as credible, the security leader must be viewed as a business professional whose risk management recommendations and actions are based on sound business judgment.

What is the role of institutions of higher learning in helping to educate future security professionals? The challenge is to evolve programs to support the changing requirements of security leadership. This means developing degree and certificate programs that include multidisciplinary content drawn from business, IT and criminal justice programs. For working professionals, this also means programs that are offered mostly or completely online. I am aware of one university that is considering such a multidisciplinary program, but it is still at least a year from being launched. Hopefully, other institutions are looking at similar programs. For now, students will have to choose elective courses within existing programs that give them the knowledge foundation they will need to be successful.

Editor’s note: See the Council’s guide: Security Training Resources, for some education and training options

Answer provided by Dan Rattner, Security Executive Council Emeritus Faculty.

Business Continuity Plan Certification

Q. We are a medium sized business and as such my team is having a hard time showing a cost-benefit to have our business continuity plan certified to a standard as recommended by Public Law 110-53. We are not a heavily regulated industry and to follow one of the recommended standards and go through the certification process seems like overkill. Can you give some examples of benefits to becoming certified?

A. The United States Congress made it quite clear that the program is to be voluntary and what it refers to as "market based."  Simply put, there are no clear cut financial incentives on the front end to have a company's plans certified.  However, as the concept of Enterprise Risk Management takes hold in the private sector, many believe market forces will virtually mandate certification due to pressures from Boards of Directors, the financial rating agencies, the plaintiff's bar and individual investors.  Furthermore, simply going through the certification process will enhance overall business resiliency, thereby allowing an organization to recover more quickly after the inevitable crisis is past. 

Answer provided by Don L. Hubbard, Security Executive Council Emeritus Faculty.

Helping Management Understand the Value of Your Security Organization

Q. I have been in charge of security for only a few years after leaving government and have no idea how to proceed in developing and presenting a plan to management.  What are some of the specific areas that I should highlight to emphasize the importance of security’s role?

A. Great question. As the person asking the question you understand the critical issue. The critical issue is, of course, creating a context or framework in which your business leaders can understand how security adds value.
 
Here are a few ideas to think about as you put your plan together.
 
How does security help the business leaders achieve the company's goals?  For example:  An "employees at risk program" helps protect all employees in a number of different ways. Working with the company travel department and human resources (HR) a review of all hotel properties where employees may reside while traveling should be done. This would include analyzing crime statistics,  speaking with the hotel chain about security at that specific hotel, interviews with employees after trips, maintaining a travel monitoring program, providing international travelers with country warning notices twice a year and conducting educational awareness training. In very difficult markets like Mexico a company may decide to use security car services to move employees around town and from/to the airport. They may also provide an emergency hotline number to all employees in the event of an emergency.  From a metrics standpoint, HR should conduct an annual employee survey to gauge feedback on the program.
 
Another example:  Working with legal counsel and HR, security may want to establish a background verification process for new employees. HR should track percentages of all applications that contain inaccurate information and the attrition rate of the new hires after verification.  Using this data HR can track hiring costs, employment law costs, disruptive employee costs and even training costs with the goal that these should trend down as a result of hiring the right people. If a drug testing program is set up along with the applicant verification, rates of applicants who screen positive for illegal substances should be tracked as after time the company may see a drop in employees with substance abuse issues because they are avoiding applying to the company.
 
These two examples are easy and almost everyone has these programs, but there are numerous other examples that can and should be used to tell the value story.  Remember this is a great opportunity to add a slide that says, "if resources were available we would be doing the following to reduce risks and costs in order to better achieve our company's goals.”

Answer provided by Richard Lefler, Security Executive Council Emeritus Faculty.

Developing a Security Strategic Plan

Q. I have recently been put in charge of defining the direction that security will take going forward within our company. Our group has already identified a department vision and mission.  Can you give me some pointers on developing a strategic plan and communicating it to management in a manner that shows the value that it will bring to the company?

A. First, congratulations on developing your vision and mission before tackling the task of creating a strategy.  A mistake often repeated is the misunderstanding of the differences between a mission, vision, strategy, and goals.  Quite simply, the strategy is the “how” or means in which you will fulfill the “what.”  Goals are the measurable activities you perform to get to the end result or the “what” – your vision and mission.

Your strategy must align with your company’s form, language and values.  Take the time to get input from trusted peers who have had success in developing, gaining approval and implementing strategic plans within your organization.  There is usually a common thread amongst all companies in what they want to achieve and how they achieve it.  However, priorities and emphasis will differ depending upon the company’s overall business strategy, culture and mission.  If your management and organization is known for its fiscal strength and emphasis, then be sure to include these as key ingredients in your strategic plan.  If personal growth and responsibility are emphasized, then ensure your plan reflects this value.

Leave yourself some options.  Devise and communicate your preferred plan with several different options in mind for management to consider and approve.  So often there’s the temptation to believe that a plan is so great that it’s presented with only one of two options – take it or leave it.  You are competing with other important functions for attention and resources.  Your ability to plan for this and have options for management to consider gives you credibility.  Your three-year strategic plan may end up taking five years to complete, but you have gained favor with key decision makers by putting yourself in their shoes and seeing the big picture.  Be very clear to inform them of the risks associated with their decisions, but be ready to be a team player.

Finally, be concise in your documentation and delivery.  Choose three to four memorable cornerstones to build everything around.  For instance, my most recent strategic plan was developed around four key ideas.

1. Create security ownership at every level of the organization
2. Partner with other functions to gain traction and integration of security solutions
3. Raise security issues to appropriate levels to gain quick and decisive action
4. Create solutions that are understandable, affordable, and align with business objectives.

Developing a successful strategic plan can be challenging; however, you will be rewarded for your efforts.  It’s your group’s roadmap to success.

Answer provided by Mark Lex, Security Executive Council Emeritus Faculty.

Defining the Value of Security During the Current Economic Downturn

Q. My company has done fairly well through the growing pressures of the current economic downturn but it has been made clear that we need to be in for the long haul; management is asking us to identify prioritized targets for cost reductions.  Where should I focus my efforts?

A. Even when our mission is clearly understood and accepted, it is unrealistic to believe we will be exempted from the commitment to contribute to expense reductions.  In both good and hard times we need to have data to support what we believe is valued and essential work.  Good data will provide support to a business case that demonstrates which programs, if eliminated or gutted, would reduce protection below an acceptable threshold of risk.  Your metrics need to support the concept that cost reduction efforts that fail to discriminate between programs that provide clear risk reduction results versus less productive activities will add to cost rather than reduce cost of doing business.

Regardless of the state of the economy we demonstrate value when we enable the business to do what would otherwise be too risky.  Consider what programs you now have in place that clearly address the specific risks you have identified for your company while implementing a contraction strategy.  Then consider how you propose to address the currently unaddressed vulnerabilities that could be exploited, including the greatest threat during this stressful time -- the disgruntled and knowledgeable insider.  Working with your HR and other business unit colleagues develop a protection strategy to mitigate potential threats based on the data you have gathered on the ability of your safeguards to detect and respond to likely risk events.

Answer provided by George Campbell, Security Executive Council Emeritus Faculty.

For more information on metrics or measures that may be applied to reliably define and communicate the value security, visit our store at:
https://www.securityexecutivecouncil.com/secstore/index.php?main_page=product_info&cPath=77_65&products_id=180

Security Leadership Career Transition from Public to Private Sector

Q. As a retired law enforcement officer who would like to continue working for 15 more years, I am considering whether a career in corporate security would be a good option.  What steps do I need take to determine if there are enough opportunities in security to make this a good decision? Can you offer some advice on a career path for me?

A. This is "THE" question posed from law enforcement, military, intelligence and other public sector leaders to senior security leaders in the private sector and business. The opportunities for hard-working and dedicated law enforcement professionals to excel in corporate security are everywhere around the globe.  As a start here are four key questions you can ask yourself:
 1.    Are you flexible enough for such a career?
 2.    Do you want to manage or do you want to lead?
 3.    Do you have the stamina to meet the needs of a large or global corporation?
 4.    Are you a life-long learner?  What is your personal work ethic and are you smart enough to know what you don't know?

Before addressing these four questions there are a few other things you need to consider and take time to ponder.  First, the most important action to take is to start your quest well before any possible or expected date of departure from your current position.  I consistently recommend everyone start 24 to 36 months (or earlier if you can) to learn everything you can about business.  A significant shortfall when moving from the public to private sector is not having a clear understanding of the cultural and organizational dynamics of the environment in which they hope to succeed.  A good way to start is to join security organizations, such as:
• ASIS International (formerly American Society for Industrial Security)
• ACFE (Association of Certified Fraud Examiners)
• CSI (Computer Security Institute)
• SEC (Security Executive Council)

You will enhance your business acumen by becoming professionally certified with credentials like a CPP (Certified Protection Professional), CFE (Certified Fraud Examiner) or CISSP (Certified Information Systems Security Professional). This is what I refer to as the academic side of a security career and is similar to going though a good law enforcement academy.  When any of us came out of our basic training or academy we knew it was simply a starting platform; our real learning was going to be on the street.  Real success in corporate or private security goes well beyond finding leading organizations and having the right credentials. 

The key component to becoming a really successful corporate security leader comes by finding industry security mentors with proven security management, operational know-how and skills that have been honed in the business world.  Finding this person, or persons, is the equivalent of having a great FTO (field training officer), supervisor and experienced "rabbi" all rolled into one.  Having worked with and helped several "rookies" to enter corporate security and go on to grow into global security leaders themselves is really something special.  Some of them have themselves built great security teams that deliver real results to the business bottom line.  That said here are a few comments on our four questions.

1.    Are you flexible enough for such a career?  Just like other aspects of business the security function may contract or expand.  Everyone looks forward to the expansion, but what about the contractions?  In the past five to ten years there has been a switch from hiring those with "backgrounds" in law enforcement and the military to hiring those with proven security skills and business know-how.  There are exceptions, but today most businesses are not likely to hire someone right out of a law enforcement agency to be their senior security leader.  In most cases you need to be willing to start off as a supervisor or manager on a corporate security team.  
2.    Do you want to manage or do you want to lead?  Although strong management skills are necessary to be an effective public sector leader, this does not necessarily translate to success in corporate security.  It is essential to determine if a business is looking for a security manager to maintain the status quo -- if that is the case be sure to ask the question: What does managing the security function look like and what are the business’ expectations?  Security leadership takes a lot of creativity and thinking outside of its traditional roles for today’s business environment; that is, are you going to help deliver positive bottom line business results?  Most organizations will say they want leadership – don't be foolish and take that at face value.  Have the business leaders give you examples of what they visualize as security leadership.  Dig behind both their questions and, more importantly, their answers to get a better sense of the direction they foresee security being operationally productive across their enterprise. 
3.    Do you have the stamina to meet the needs of a large or global corporation?  If you are coming from a big department or agency where you have lots of manpower and resources to attack a problem you are likely in for a surprise, if not a shock.   You have to be prepared to work 10-14 hour days and sometimes seven days a week.  Starting over you will likely be dealing with lots of tactical issues (at times its like herding cats) and almost always without the manpower and resources you have come to expect.  This is very wearing if you did not anticipate and prepare for this in advance.
4.    Are you a life-long learner?  What is your personal work ethic and are you smart enough to know what you don't know?  Highly successful leaders in today's businesses are constantly learning.  To stay current in today’s fast moving business environments security leaders have to be learning new material at about 20 to 25% each year or they will find themselves literally obsolete in four to five years.  As a senior security manager or leader are you willing to meet that learning expectation or hopefully exceed it?  Every aspect of what a security professional delivers to the business needs to be right on target.  In building my teams I have always hired people smarter than me, with different skill sets than mine and all had to have a primary focus on being a business partner (not a security geek or security “expert.”)  They all knew they had to be self-starters, pushing themselves intellectually and creatively to foresee and anticipate the legitimate security needs of the business.  As I often say:  in business it's not about security, it's about business! 

The great thing is you are in control of where you spend your resources and time as you ponder the above.  You have to decide what kind of position you are seeking.  It is essential you find a level of support that is meaningful well before you begin to think about interviewing for opportunities you are seriously considering.  To cross the business world threshold without significant preparation is akin to beginning a journey to places unknown. 

The business world offers wonderful opportunities for those seeking a second career from the public sector.  This will require a lot of flexibility on your part as you transform your knowledge, skills and abilities into the marketplace of the entrepreneur. 

Answer provided by J. David, Quilter, Security Executive Council Faculty Emeritus.  David’s new book, "From One Winning Career to the Next," is available for purchase at https://www.securityexecutivecouncil.com/secstore/index.php?main_page=product_info&cPath=77_65&products_id=320