9

Emergency Response and Contingency Planning

Abstract

This chapter provides guidance on the development and use of emergency response procedures for an organization in the event of an actual emergency.

Keywords

Bombs; Bomb threats; Business continuity planning; Emergency response; Evacuation; Incident response; Natural disaster; Preparedness; Recovery; Response; Terrorism; Vandalism
Developing and directing the response during an emergency situation is one of the most demanding actions any executive can ever accomplish; however, it has not always been emphasized or practiced. Although emergency planning has always been part of most safety and security plans, the growth of terrorism and the increasing number of security incidents has resulted in the importance of adequate planning of emergency situations to take on a much greater urgency. This chapter will provide you with the preplanning and preparation to potential emergency incidents that can greatly increase your organization’s ability to effectively respond to these emergencies and help to minimize damage, injury, or even loss of life. Over the course of this chapter, we will discuss planning factors that can significantly decrease the impact of these incidents, identify various emergency incidents that your plans should address, and finally will look at procedures that assist in your response to potential emergencies.

9.1. Emergency Response Planning Factors

Emergency response planning factors are considerations that every organization should take into account when developing its own response procedures. These planning factors are designed to accomplish several objectives: provide a safe environment for staff, visitors, and community members; provide guidance for your employees to effectively prepare for, respond to, mitigate, and recover from emergencies or disasters; and reduce the potential for damage, injury, and loss of life in the event of an emergency. With this in mind, the four emergency response planning factors that any good emergency response plan should consider are as follows:
• Mitigations, which are the efforts taken before any type of emergency incident in order to lessen the impact of an event.
• Preparedness, the efforts exerted to prepare your organization’s staff for response and recovery requirements.
• Response, which includes the activities necessary to address situations as they arise in the course of an emergency.
• Recovery, after an emergency has occurred, includes the necessary actions to return the organization to full, preevent operation.
We will be looking at each of these separate planning factors over the next several sections.

9.1.1. Mitigations

Many of the mitigation actions to assist with emergency response planning are accomplished throughout the security planning process; the specific details on these areas have been covered in previous chapters. These include identification and assessment of risks to your organization, which were covered in Chapter 2 – Safety and Security Principles, and security measures that your organization has implemented relating to your physical security, information security, and personnel security programs as discussed in Chapters 57. By identifying the risks that pose the greatest threat to your organization and taking proactive action to mitigate these risks with security equipment and procedures, you have taken a significant jump toward mitigating potential emergencies that could occur.
Once you have accomplished an assessment of risks particular to your organization, you need to ensure you focus on these in order to spend your limited time and effort planning emergency response actions against the most viable emergencies. For example, if your business is located in Phoenix, Arizona, on high ground, it would be a waste of time and effort to take time to develop emergency response procedures against flooding. Although this is a very obvious example, it is amazing how many organizations will try to focus on events that are very far down the priority list of potential risks and vulnerabilities because of knee-jerk reactions based on a recent event in the local area or even the country—this is why it is so important to develop a prioritized list of risks and follow it when developing your own organizational emergency procedures.
The security measures—including safety and security equipment, processes, and procedures—your organization has procured and developed will also assist in mitigating against potential emergencies. The likelihood of a security incident—such as an unauthorized visitor that could evolve into an active shooter or hostage situation—is much greater without any access control systems or procedures within an organization than if there are entry controllers present, employee access cards, cameras, and other systems that can mitigate the potential for unauthorized access into a facility. As discussed in previous chapters, it is prudent to have several redundant layers of physical security measures protecting your facility that can provide greater deterrence and increased ability to lessen the impact of an actual incident—all of which will ultimately help to mitigate any potential emergencies.

9.1.2. Preparedness

Preparedness is the next emergency response planning factor that we will discuss, and there are several areas that should be considered when preparing your organization’s response against potential emergencies. These preparedness areas can be divided into the following five items: command and control, communications, collection and distribution of resources, coordination, and congestion. We will look at each of these areas separately over the following sections.

9.1.2.1. Command and Control

Someone must be in charge of the response to any emergency incident and the command and control area within preparedness ensures this requirement is provided for. This area also provides the designation, regulation, and coordination of the many responsibilities and tasks required to accomplish the emergency response plan. The easiest and clearest method to provide for command and control is to designate an emergency response team within your organization, along with a chain of command that includes a listing of tasks and responsibilities before any emergency. Major tasks and responsibilities that must be included in the emergency response team are:
• Identify the individual responsible for the overall response efforts. This individual is typically called the incident commander (IC). The IC can be any employee, but a member of management with the authority to make decisions is typically the best choice because this individual must have the capability and authority to accomplish his or her responsibilities, which include:
Assume command and assess the situation.
Implement the emergency management plan and activate the organization’s emergency response team.
Be the primary focal point with local law enforcement and fire department first responders.
Determine response strategies and order an evacuation if necessary.
Determine response strategies and oversee all incident response activities.
Declare the incident is “over.”
• Identify the primary communications focal point. This individual will not only work on communication efforts within the organization but will also act as the primary conduit with local press agencies.
• Identify the individual responsible to coordinate any facility or maintenance issues. This person should be very familiar with the overall layout of the facility, utilities, and any mechanical and electrical infrastructure contained within the building.
• Is the individual responsible for conducting accountability of all staff and any visitors. This task is critical if the emergency involves injuries or loss of life, because the primary focus is always on the identification of employees who have sustained any significant injuries or death.
• Individual responsible to oversee any logistics and transportation issues.
This list is a minimum of the tasks that should be identified and will vary based upon the type of business and what functions your organization may have. If, for example, your business is very dependent upon information technology, it will likely be necessary to include an individual response for information systems within the emergency response team. With the addition of any other responsibilities you may identify, it is critical that you also identify a responsible individual before an emergency to ensure awareness of each necessary task.

9.1.2.2. Communications

Communications is the next area within preparedness and refers not only to the equipment necessary to allow your staff to talk to one another in the event of an emergency, but also that allows for understanding regarding the limitations and capabilities of your organization’s communications system before disaster strikes. For example, during many major incidents, the amount of cell-phone traffic will typically overwhelm local and regional communications systems, causing them to crash and become inoperative. Thus, reliance on the use of cell phones during an emergency would not be the wisest course of action. The solution to ensure a viable communications system in the event of an emergency is to have several redundancies. In addition to, or even in lieu of cell phones, plan on using landline telephones; or better yet, purchase a radio and walkie-talkies for use during emergencies if your facility is small enough to use them. Other communication methods that may need to be used in the event of an emergency that compromises normal systems include messengers, FAX machine, local area networks, and hand signals.
Not only should your communications plan include actual equipment, it should also include procedures on how to conduct communications during the course of an emergency, both within your organization and within the community and local area. Some considerations include:
• Notification methods to ensure all employees are aware of the incident. This can refer to either a notification tree to identify any necessary personnel by phone or to a facility-wide notification system such as an audible alarm or loudspeaker. There should also be accommodations to ensure out-of-town employees are contacted or instructed to call their supervisor in the event of an emergency.
• Communications procedures to provide guidance on communications both within the organization and to outside agencies. It is critical that your plan identify what individuals, by position, should be talking with emergency responders (e.g., police, fire) or with the press. By identifying which personnel will accomplish this before the actual event, all other individuals can concentrate on their jobs and provide a more effective response to the emergency.
• Communication with the press and other media sources. Any emergency experienced by your business will likely result in media interest; it is imperative that you consider how your organization will react and respond to the press and community.

9.1.2.3. Collection and Distribution of Resources

Another area that is part of preparing for your organization’s response to an emergency is developing processes to collect and distribute necessary resources during the incident itself. Trying to identify which resources are available and their location cannot be accomplished once the emergency has begun. Instead, it is necessary for you and your team to determine this information before any initiation of an incident.
Some items that must be included in this determination are:
• Personnel. In the event evacuation or transport is necessary, an individual must be designated to arrange for group transportation if necessary.
• Critical company information.
• Medical supplies to provide initial first aid for injured personnel before the arrival of medical responders.
• Emergency food supplies in the event that personnel are unable to leave the facility for an extended period.
• Emergency response “go-bags,” which are preprepared bags for your organization’s emergency response team. Equipment will typically include local area , diagrams of company facilities (including interior and exterior plans), additional radios, and a copy of the emergency response plan and any applicable checklists.
All these items, along with their locations, must be identified before the start of the emergency. Once this has been accomplished, you and your executive team must identify a responsible individual who will ensure this resource is secured and safeguarded until resolution of the emergency incident.

9.1.2.4. Coordination

The area of coordination works in concert with the command and control area in the preparation of your organization’s response to an emergency. To best accomplish this coordination, it is necessary to not only identify the tasks and designate the responsible authority in the event of an emergency, but it is also critical that your organization form its emergency response team with the members discussed earlier. In addition to forming the team, it is also necessary to conduct periodic training and exercises so that this team ensures it develops the necessary coordination and can work together to effectively coordinate its actions during an actual incident.

9.1.2.5. Congestion

The last area within preparedness is alleviating congestion within your organization. Congestion refers to bottlenecks in the workflow of your organization. Within your organization, there may be single-point failures in which critical tasks flow through one individual or a specific section. These single-point failures are normally your superb performers that get an extraordinary amount of work done; however, because of these qualities the work processes become overly dependent upon them and over time the entire process can break down in their absence. During normal operations, this may not be a problem and thus there may be no need to provide for allowances or redundancies so that other work sections are familiar in accomplishing these critical tasks. In the event of an emergency however, this single-point failure can become quickly overwhelmed and the entire organization’s response to the emergency can fail because there is no duplication of effort to assist with this critical task.
The best method to mitigate congestion in the event of an emergency is to identify all critical tasks that would be necessary to accomplish and ensure there are alternate people or sections identified and trained so that they can assist with, or even accomplish the work, should the primary personnel become unavailable or unable to accomplish that particular task.

9.1.3. Response

The next major area involved in an organization’s ability to react to an emergency is response. This area refers to the actions, processes, and procedures that take place once an incident has occurred or is ongoing. The key elements of any response to an emergency are protecting human life, preventing or minimizing personal injury, reducing exposure of your organization’s critical assets, and minimizing loss. To accomplish these elements, it is important to consider the following actions that must be taken in any type of emergency response:
• Command and management of emergency operations.
• Fire management and/or facility evacuation operations.
• Security and traffic control operations.
• Emergency medical operations to include preventive medicine and assistance to coroner operations.
• Staff care and shelter operations.
• Facility management and plant operations to include relocation efforts as necessary and resources and support operations.
• Internal rescue operations.
We will look at each of the actions separately over the next several sections.

9.1.3.1. Command and Management of Emergency Operations

Managing emergency operations provides for the overall management and coordination of the emergency response, whether it is the actual management of the staff in the facility or coordination of your organization’s departments in conjunction with outside agencies supporting the response operation.
We have already discussed the most important task that assists in managing emergency operations—designation of your emergency response team and delineation of each member’s tasks and responsibilities. Upon any notification of an emergency, it is necessary that the IC within your organization determine where the team will operate during the incident and clearly communicate this information to the entire team to begin the process of managing the overall organization’s emergency operations. Another important action in managing the emergency response is to determine how the staff will accomplish staff recalls and communications throughout the response. You must clearly identify who performs the recall and have alternate plans in case the local phone system is down. Additionally, you must have the ability to notify personnel within your facilities to ensure employees take appropriate action. The next task in managing your organizational emergency response operation is the public information officer policy. We had earlier discussed the need to designate a point of contact who will handle all communication with the press. Not only is it important that this individual and the other members of the emergency response team are aware that the press should go through the organization’s designated person, but it is also important that all employees understand this and are aware of any other public information officer policies. This can save a great deal of miscommunication during the actual response to an incident. The final task that is part of managing the emergency response operations is to develop and provide a reporting system for any necessary information during the course of the incident. This process should also ensure the organization conducts a critique and evaluation at the conclusion of the emergency response. With accurate record-keeping, both throughout the response and at the conclusion, your organization can evaluate problems in your current emergency response procedures and correct them. Although this task will be extremely difficult to do at the conclusion of an actual emergency, it is an important aspect of your emergency response and can not only improve your ability to respond to emergencies but can also make your entire organization better.

9.1.3.2. Fire Management and/or Facility Evacuation Operations

Fire management and facility evacuation operations are another area within the management of your organization’s emergency response. This area limits the loss of life and property for your organization. To effectively accomplish this, it is important that your organization liaise with local fire departments before an actual incident to ensure both your company the local fire department are aware of each other’s plans in the event of an emergency. Along with this liaison, your organization needs to designate specific personnel who would assist rescue units as necessary.
9.1.3.2.1. Facility Evacuation Operation Considerations
A significant decision that must be made in any emergency situation is whether it is safer to evacuate personnel inside the facility or shelter-in-place. Although some situations are fairly straightforward—such as a fire that demands immediate evacuation—decisions in other situations may not be obvious. For example, it was thought for some time that in the event of any active shooter situation, the correct decision was for personnel to shelter-in-place and lock down the facility. In a lockdown, all personnel hide in the room they find themselves in at the outset of the incident, lock and barricade any entry points, and attempt to remain in the room and avoid detection by the intruder. From experience with several active shooter situations however, it has become apparent that resolution in the vast majority of these incidents occurs when the shooter either takes his or her own life or is killed by responding security or law enforcement personnel. With this result in mind, the original lockdown response to active shooter situations would place an individual inside the facility in an exposed position for an extremely long period. This has resulted in a revised response to active shooter incidents that directs individuals to evacuate the facility if they can safely do so without coming into contact with the intruder. This solution calls for a minimum number of personnel—specifically those in close proximity to the shooter—to go into lockdown. Although there are still personnel at risk, the number is significantly lessened and because these types of situations have normally been resolved when either the shooter runs out of ammunition or first responders arrive and locate the shooter; this has now become the more accepted practice. Within your own organization, you will need to make the determination on whether employees evacuate or remain in place in the event of not only an active shooter situation but many of the other possible threats your business could experience.
Another consideration in evacuations is to ensure you take into account the distance personnel would need to ensure their safety during the evacuation. To account for all scenarios, evacuation procedures should include both short- and long-distance scenarios. Short-distance evacuations are normally accomplished in the event immediate evacuation from the building is necessary but distance from the building is not necessary to ensure safety—the primary example being a fire drill. Long-distance evacuations are defined as evacuations that, because of longer distances involved, require alternate transportation. These types of evacuations may be due to bomb threats, radiological concerns, or chemical contamination. Long-distance evacuations are considered when walking is impractical because of distances or weather considerations.

9.1.3.3. Security and Traffic Control Operations

Security and traffic control operations are another area within the management of an organizational emergency response. These operations enforce applicable orders and company policies within your facility grounds. Additionally, this function coordinates the activities of security and traffic control staff with local law enforcement agencies, maintains communications with any mobile security personnel, commits available resources, and determines if additional resources are necessary.
Of particular concern within this emergency response area are two functions: traffic control and crowd control. In the event of an actual emergency, many employees will want to get away from the facility as quickly as possible, whereas emergency responders and other agencies will need to get access to assist with the response efforts. It is critical that your organization have plans to ensure employees wishing to leave the area do not hinder access by the inbound emergency responders. To conduct traffic and crowd control, it may be necessary to obtain assistance from additional employees to help control the huge increase you will see both in the amount of vehicle traffic and people in and around your facility during these incidents, and as a result your response plans should account for the added personnel.

9.1.3.4. Emergency Medical Operations

Emergency medical operations provide for the treatment of injured personnel as a result of the incident and, if necessary, assistance to coroner operations. This function must plan for these actions in the event of multiple casualties to include locating, collecting, and transporting injured personnel. Two major tasks are involved in this function: employee accountability and establishment of first aid and casualty collection points.
The first task involved with emergency medical operations is accounting for your employees and identifying casualties. We briefly discussed the importance of employee accountability as part of the human resources point of contact within your emergency response team; however, the importance of this task cannot be overstated. Accounting for all your employees and visitors is critical because the primary focus of many emergencies rapidly moves from the incident itself toward identification of all involved personnel with particular emphasis on the exact numbers and names of individuals who have sustained any significant injuries or death. The best example I can provide in order to emphasize that your organization ensures you have a process in place to accomplish this accountability can be found in 9/11. The vast majority of all communication into the area was focused on obtaining the status of friends and family members. This will occur in every type of emergency that involves the potential for injury and so it is vital that your organization develop a thorough process to ensure accurate accounting of all personnel who were in your facility at the time of an incident. One of the simplest methods to accomplish this accountability is to task all supervisors to account for their personnel in the event of an incident and make notifications on the number of personnel accounted for, any injuries, and the number missing up the chain of command. There is also a need to ensure accountability of any visitors to your business at the time of the incident so your point of contact will need to ensure a process is established that conducts a thorough accounting of all personnel within your facility at the time of the emergency. Accounting for these individuals will also be your organization’s responsibility; using visitor logs or access control processes to help identify these personnel so they can be included in your accounting needs to be taken into account when planning your accountability process.
Establishing first aid and casualty collection points is another important task involved with emergency medical operations. Before an incident, your organization should identify a specific location, or several locations depending upon the size of your facility, where injured personnel would be brought. These consolidated areas allow medical personnel to move to these areas and provide care to more of the injured personnel than could be accomplished by having to move through the entire facility themselves to find any individuals requiring medical care. These collection points should have basic first aid kits to help in initially treating the injured and have equipment to transport the injured such as folding stretchers.
Preventive medicine is another aspect of emergency medical operations and provides for public health and sanitation services during the incident. Two primary considerations within preventive medicine are to ensure drinking water is available and sanitation services are provided in the event that personnel must remain in the facility and public water and sewage is inoperative. Storing bottled drinking water and determining a source of chemical toilets, should the need arise, resolves these concerns.
In the event of any death, the primary assistance an affected organization would need to provide to coroners is the identification of remains and disposition of personal effects. Identification of remains should be accomplished by developing an accounting of all employees through the methods discussed earlier. The other consideration, disposition of personal effects, may likely fall upon your organization, depending upon the area and procedures of local law enforcement. If so, it is important to take an inventory of any items found, collect them into a sealed package, and store them in a secured area—much like the procedures involved with collecting and storing evidence as was discussed in Chapter 8. In this manner, when the employee’s next of kin is ready to pickup his or her effects, they can be provided the inventory and sealed packet.

9.1.3.5. Staff Care and Shelter Operations

A critical portion of this medical operations task is the accountability of your organization’s employees throughout the emergency situation. As we have already discussed, the importance of this task cannot be emphasized enough because most of the initial questions you must answer in any emergency will deal with the number of employees missing, injured, or dead. In addition to the personnel accountability portion of this area, it also covers for basic human needs of the staff throughout the incident, to include lodging, food, and child care as necessary.

9.1.3.6. Facility Management and Plant Operations

This area covers any purchase and construction necessary to bring your company’s facility back to operational status during the actual incident. It also includes relocation efforts as necessary and resources and support operations.
Facility management and plant operations provides for damage assessment, emergency debris removal, shelter construction, and other engineering operations. Damage assessment depends upon accurate record-keeping of the current status of your facility and its equipment, as it is virtually impossible to determine what damage has been done without an initial baseline of what resources your company started with.
Facility relocation operations provide for long-distance evacuation and relocation of persons from the threatened or affected areas of the facility. Several considerations are involved with facility relocation:
• Where will your organization relocate?
• What will it take to accomplish the relocation?
• Who will work at the new location?
• Will any special equipment or services be required at the new location?
Transportation is a key function within the facility relocation operations because a process to transfer personnel to other job sites may need to occur.

9.1.3.7. Internal Rescue Operations

If the emergency situation extends well beyond your own company and its facility and effects your area or even the entire region—such as a natural emergency such as earthquakes, severe storms, or floods—emergency responders will likely be overwhelmed and unable to respond to your location in a timely manner. In this case, your organization will need to be prepared to conduct your own internal rescue operations within the organization. These operations carry out the coordinated search and rescue operations for the location, provide immediate care, and safely remove employees. To conduct these rescue operations, it is necessary to determine and develop a process to locate and mark areas where there may be trapped individuals and establish safety zones in areas where the facility is severely damaged. Considerations include ensuring maps and floor plans are available for searches and designating employees to serve as guides for rescue teams.

9.1.4. Recovery

Recovery is the last major area within emergency response operations. Although an emergency incident can be over relatively quickly, the recovery from such an event may take days, weeks, or even months before your organization is able to match production levels commonly achieved before the emergency. To reestablish full functionality of the business as rapidly as possible, various functions must be accomplished:
• Damage assessment
• Clean-up and salvage operations
• Business restoration
• Customer and client information
• Mutual aid and agreement activities
It is best to task each of these functions to specific teams within your organization to synergize efforts and assist with recovery in the most rapid manner possible. Over the following sections, we will look at what is important for each team to accomplish to ensure that these functions are properly conducted.

9.1.4.1. Damage Assessment

This team refines the initial damage assessment estimates made during the response to the emergency and collects data to set priorities and guide other functions to establish goals and schedule necessary tasks. There are several tasks for this team to properly accomplish damage assessment.
Before any emergency, this team should have completed detailed inventories and surveys of the facility and critical business equipment. During the recovery phase, the damage assessment team must develop itemized lists of all damage, including photographic documentation, as a result of the emergency. These inventories and surveys, along with the itemized lists of all damage sustained, make it possible to streamline the reimbursement process with underwriters and government officials.
After the team has compared the damage against the inventories before the incident, it must identify services, labor, and material necessary to restore operations to preincident levels. It will then determine and prioritize tasks to actually restore these services, labor, and materials. These tasks will then be able to have cost estimates and recovery schedules developed to better divide the various efforts and make them more manageable.

9.1.4.2. Clean-up and Salvage Operations

This team oversees all clean-up of the incident, including decontamination if necessary. Procurement of equipment to assist with this task is also accomplished by this team, including obtaining and placing dumpsters and contracting for decontamination services. The clean-up and salvage team may also be required to seek contractor support to repair damaged utilities and fire protection systems in order to bring these services back to operational status.

9.1.4.3. Business Restoration

The business restoration team is responsible for bringing the business back online. This is accomplished through implementation of the tasks identified by the work of the damage assessment team. This team obtains engineering and architectural drawings necessary for construction and renovation projects and they work with contractors to accomplish these projects. The business restoration team also obtains any new equipment to replace items destroyed as a result of the incident.

9.1.4.4. Customer and Client Information

This team has two primary tasks. The first task is conducted before any emergency incident, and this is to ensure that all contact information for your organization’s customers and clients is kept in a secure location safe from any emergency occurring to the business. This can be accomplished as simply has storing the information on a flash drive or on an external server. The second task is accomplished during recovery efforts by providing the public, and particularly your clients, with accurate information regarding service hours, locations, or any changes in procedures. The customer and client information team provides general information about the best way to use company goods or services during the recovery phase and should provide public updates on the progress to restore services.

9.1.4.5. Mutual Aid and Agreement Activities

The mutual aid and agreement activity team determines what outside agencies can provide assistance with your organization’s recovery efforts and attempts to obtain support from these respective agencies. This team must determine the extent and type of assistance that an external agency can provide and negotiate with these organizations to obtain specific terms for this assistance.
Governmental assistance is a major consideration, particularly if the disaster caused the local, state, or federal government to designate a disaster area that encompasses your company.
Aid can also encompass the expectation that your business will assist the community in the event of a disaster. In community-wide emergencies, business and industry are often requested to assist the local area with personnel, equipment, and shelter. This task should not be overlooked as your organization is working its own recovery.

9.2. Types of Emergency Incidents

There are several types of emergencies that can affect your organization, and your organization’s response can differ based upon the cause and the damage that can result. Emergencies can be categorized into three main types of incidents: natural disasters, man-made incidents, and business-related incidents. We will look at specific emergencies within each of these and discuss actions that have been shown to minimize damage for that emergency.

9.2.1. Natural Disasters

Severe weather accounts for emergencies included within the natural disaster area. These incidents include:
• Tornadoes
• Hurricanes
• Earthquakes
• Flooding
• Snowstorms
The response for many of the severe weather emergencies is similar because these disasters will normally affect your organization in the same way. Severe weather typically results in damage or destruction to your facility and injuries to your employees as a result of the weather. Many of these natural disasters also result in interruptions to utility service and this should always be considered when developing plans to respond to any of these emergencies.
Response for severe weather should include the following actions. Notify staff of the severe weather alert and advise them of actions to be taken (e.g., release, evacuation, shelter-in-place). If the decision is made to shelter in-place, personnel should move to basements or hardened shelter if available. Do not use gyms or other large rooms as shelter during severe weather. At the conclusion of the severe weather, supervisors should account for their teams and report any missing personnel to your organization’s designated point of contact to track accountability.
If your company is located in an area where earthquakes can occur, there are some specific response actions that should be taken during this type of natural incident. Once the shaking starts, personnel should immediately drop, cover, and hold their knees to the chest until the earthquake stops. If indoors, personnel should remain indoors. They should move away from windows, shelves, heavy objects, or furniture that may fall and take cover under desks, tables, counters, and open doorways. In halls, stairways, or other areas where cover is unavailable, personnel should move to an interior wall. Turn away from the windows and remain alongside the wall. The greatest danger from earthquake is injury from falling debris. If personnel are outside at the onset of an earthquake, they should remain outside and move away from the path of falling walls, power poles, trees, wire fences, and rolling rocks. During the earthquake, any individuals outside should lie down or crouch low to the ground. At the onset of the earthquake and if it is possible to accomplish in a safe manner, maintenance staff should conduct checks of utilities, systems, and appliances, and, if necessary, shut off main valves. Once the earthquake is over, supervisors should account for their teams and report any missing personnel to your organization’s designated point of contact to track accountability. Additionally, maintenance staff should determine if any hazardous material has spilled or leaked, isolate and seal off the area, and notify the appropriate agency of the spill.

9.2.2. Man-Made Incidents

Man-made incidents are primarily composed of terrorism and criminal acts, both of which can significantly affect your organization.

9.2.2.1. Terrorism

Terrorism includes hostile acts against your organization by one individual or an organized group. Specific incidents we will look at within this area are active shooter scenarios, hostage situations, violent or uncooperative visitors, and vehicle-borne explosives. Within other sections, we discussed many different measures that can mitigate your organization’s risk to these types of incidents. Specifically, physical security measures such as a viable access control system that includes limited entry points into your facility and entry guards or receptionists and duress alarms for the entry controllers to notify others of an incident can hinder or even deter a hostile intruder from entering your facility. Other physical security measures to include barriers to disable vehicles from getting close, or even entering, your facility can greatly minimize the threat from vehicle-borne explosives. Using these measures, along with others we have discussed, can make your facility a much more difficult target and potentially have terrorists look elsewhere for their planned attack.
9.2.2.1.1. Active Shooter Scenarios
Active shooter scenarios are unfortunately becoming more and more commonplace. Schools, shopping centers, government facilities, houses of worship, and businesses have all experienced this extremely violent act. Planning actions that should be taken in the event this could happen to your organization are as follows:
• In the event of either notification of an active shooter or upon hearing gunshots, each individual employee should make a determination if evacuation is safe for himself or herself and other coworkers. If the area is safe, personnel should immediately evacuate from the building. Once they are clear from the building and in a safe area, they should notify the police by calling 911.
• If evacuation is not possible or it is unsafe because of the location of the intruder(s), employees should initiate a lockdown of their room. As discussed in earlier sections, the goal of a lockdown is to isolate the intruder, whether it is in the hallway or completely out of the facility. Do not give the intruder the opportunity to enter your facility or move freely from room to room and have easy access to employees and visitors.
• Upon notification of a lockdown, personnel should immediately lock the door to their individual room and, if possible, maintenance staff should lock all exterior facility doors.
• In the event of an intruder inside the facility, personnel should move away from the door and attempt to reduce noise and ensure no one is visible from outside the room. Room lights should be turned off and, if possible, the door should be barricaded. If the intruder is inside the facility, it is recommended to keep any blinds open in order to either evacuate through windows if necessary or to provide visual communication to any potential first responders.
• In the event the threat is located outside the facility, personnel should move alongside the exterior walls, out of sight from the exterior. Close window and door blinds and attempt to reduce noise and ensure no one is visible from outside the room.
• As police enter the room, employees should remain on the floor and show their hands. Do not attempt to get up or request assistance as police enter a room. Police will notify personnel once they are free to move once they have secured the area.
9.2.2.1.2. Hostage Situations
Hostage situations can occur at any location, including businesses. Employees experiencing divorce or child custody fights can be the subject of this type of incident. Specific considerations for hostage situation planning include:
• Isolating the perpetrator and the affected area, if possible, from other innocent bystanders or potential victims.
• Securing the perimeter of the area. It is important to prevent anyone else from entering the high-risk zone and add to the number of hostages.
• Evacuate all employees and visitors that can safely be removed from the facility.
• Individuals who are involved in the hostage situation should be trained. Talk to the perpetrator, if possible; however, it is vital that everyone understands they must avoid any heroics.
• The affected room should be monitored by camera or intercom, if available within your facility.
• Building intercoms should not be used to notify employees, as this may only heighten tensions with the perpetrator.
9.2.2.1.3. Violent or Uncooperative Visitors
Violent or uncooperative visitors can occur in any business organization. Employees who experience a bitter divorce, have child custody issues, or suffer abuse can be the victim of situations that require immediate action to remove an unwanted individual. It is important to take the following actions before these situations can result in a more severe incident.
• Remain calm and professional with the individual. Your organization’s employees who monitor the access control system, such as security guards or receptionists, must be trained on how to deal with these types of situations and what actions should be taken.
• Determine the potential threat from the individual and report to the appropriate official or local law enforcement as necessary. Individuals can pose three increasing threats:
Level I threat: An individual who has the means, ability, and intent to carry out an issued threat should be immediately reported to local law enforcement and company executives.
Level II threat: An individual who may have the means, ability, and intent to carry out an issued threat should be immediately reported to local law enforcement and company executives.
Level III threat: An individual who does not have the means, ability, and intent to carry out an issued threat should be reported to company executives. Your executive leadership can make a determination whether to notify local law enforcement.
• Document the offender’s name and description for further reporting and ensure any security guards or receptionists are made aware of the situation so they may immediately report other attempted entries.
• If the individual leaves the building before reporting within your organization, security guards or receptionists should still notify company executives in the event the facility encounters future instances with the same individual.
9.2.2.1.4. Vehicle-borne Explosives
Vehicle-borne explosives have been a potential form of attack used by both individuals and terrorist organizations. Individual terrorist acts using a truck bomb were demonstrated by Timothy McVeigh in Oklahoma City’s 1995 bombing of the U.S. Federal Building. Terrorist organizations have long used vehicle-borne explosives and continue to do so today, with some specific examples including the bombing of the U.S. Embassy in Beirut in 1983 and bombings of the U.S. Embassies in Kenya and Tanzania in 1998.
Because a potential attacker can place a great deal of explosives into a car or truck and ram the vehicle into the building, the primary method to defend against these types of attacks is to establish stand-off distance from your building so that vehicles cannot approach directly up to, and into, the facility. We have already discussed several physical security measures that can maximize this distance through landscaping and other physical barriers, in Chapter 5; however, even with implementation of many of these measures, it is still necessary to plan for your personnel’s response in the event of this type of incident.
• In the event of a vehicle-borne attack that fails to explode, personnel must still immediately evacuate the building and ensure no one approaches the vehicle. The evacuation should ensure all personnel move a minimum of 500 ft away from the vehicle and building.
• In the event of an explosion, move all survivors away from the building a minimum of 500 ft. Do not approach the building or the area containing the initial explosion; a practice of many terrorist organizations that conduct these types of attacks includes placing secondary explosive devices to create further damage and injuries.
9.2.2.1.5. Terrorism Threats
It is critical that all employees are trained to achieve a measure of security awareness. This awareness can include an active Safety and Security Program within your organization that is supported by your senior management team. Having an active program, in conjunction with physical security measures at your facility and well-known procedures for your employee’s response and reaction to potential threats, can significantly deter against any terrorist act against your company.
In the event your business receives any threats of potential terrorist action, this training and awareness will ensure your employees make proper notifications to your security point of contact and take proactive measures and stop any threat before they may occur.

9.2.2.2. Criminal Acts

Criminal acts differ from terrorism in that they will normally be less destructive and in many cases will avoid injuries of your employees are result in loss of life. We will look at various criminal acts that your emergency response planning should take into account, along with considerations to minimize their impact.

9.2.2.2.1. Bombs/Bomb Threats/Suspicious Devices

Bomb threats and suspicious devices can create significant disruptions to your business operations if personnel do not know how to properly react. Safety is always the paramount consideration for any incident involving bomb threats or suspicious devices; however, the first reaction may not necessarily require an organization to conduct an evacuation because of the loss in operations that these events can cause. The potential disruption from bomb threats is highlighted within the education industry. Bomb threats can take significant time away from the classroom and make teaching students extremely difficult and, unfortunately, many of these threats are initiated by the students themselves. During the 1997–1998 school year, one school district in Maryland reported 150 bomb threats and in 1999–2000 South Carolina’s Department of Education listed “disturbing schools,” which included bomb threats, hoaxes, and false fire alarms among its 10 top crimes, second only to simple assaults [1]. With time in any business being at a premium, it is imperative to have procedures to properly react to bomb threats and be able to better determine when evacuation is warranted and when the threat is an obvious hoax. There are several indicators regarding bomb threats that will help your organization maintain efficiency and effectiveness in your company’s operations.
Because of the potential damage and extent of disruption that can be caused by a bomb, it is best to initially respond to any bomb threat on the assumption that a real bomb does exist. The items to consider whether the threat is valid or not relate to the seriousness of the threat and in general, specificity of the actual threat are the best guide to seriousness. Some items that indicate the specificity of an actual threat and ultimately show a more valid bomb threat include [1]:
• Specific time and place indicated in the threat
• Description of the bomb used
• Specific targets mentioned or indicated
• Motive or reason given or implied in the threat
Each bomb threat is a separate event and if your organization receives few to none, it is advisable to simply treat the threat as real and immediately proceed with the response procedures covered in the next paragraph. If, however, you receive a significant number of these threats, your executive management team can make the determination to conduct an evacuation based upon the seriousness of the threat.
Regardless of whether you believe the bomb threat is real or not, in the event your organization receives a bomb threat, considerations and actions for bombs, bomb threats, and suspicious devices after they are received or identified are as follows:
• If the bomb threat is received by phone, the staff member should not hang up the phone. Instead, he or she should notify the appropriate point of contact and call 911.
• The employee who receives the bomb threat should take notes on any information to include the caller’s voice, tone, and the caller’s mannerisms (see Figure 9.1 for sample bomb threat checklist).
image
FIGURE 9.1 Sample bomb threat checklist.
• Staff should conduct a check of their work area to see if any suspicious items are present. If they find an item, Do not touch or move the item, but notify their supervisor or security point of contact immediately.
• Your executive management team should determine if evacuation is appropriate based upon receipt of a valid threat and reasonable suspicion that a bomb is present and if evacuation is decided upon, follow your organization’s standard procedures.
Suspicious packages can also be a potential method to disrupt or attack a business. Your organization should conduct training to employees on how to react should anyone come in contact with a suspicious package and what to do if they receive a bomb threat. Some telltale signs of a suspicious package include:
• No return address
• Excessive postage
• Stains
• Strange odor
• Strange sounds
• Unexpected delivery or unique delivery method (e.g., package arrives by means other than UPS, FEDEX, US Postal Service)
• Poor handwriting
• Misspelled words
• Incorrect or vague job titles
• Foreign postage
• Restrictive notes
For suspicious packages received through the mail, there are some actions to consider that will mitigate some of the risks for this type of incident to occur:
• Provide training for personnel to include emphasis on recognizing all hazards that can be transported through the mail; include bombs, biological, and chemical threats; and ensure employees understand the appropriate response.
• Ensure it is difficult to gain access to much of the facility by limiting building access and funneling visitor traffic through the reception area.
• At a minimum, provide appropriate mail-handling procedures. A further action would be to consider funneling all mail deliveries through a central location or individual who can be trained to identify suspicious packages and react accordingly.
In the event a suspicious package or bomb threat is received, there are several actions to help prepare for these incidents. Place caller ID on your company phones to help identify bomb threat callers and consider blocking incoming calls if it is received from a phone with a blocked ID. Another action is to ensure your security procedures ask that staff members regularly conduct checks of their respective work area and report anything out of the ordinary.
9.2.2.2.2. Vandalism
Preventing vandalism can be a complex issue because there are so many causes. Disgruntled employees, unhappy neighbors, unruly teenagers, or gang activity can all result in minor damage or defacement to your property and facility. The best way to prevent property vandalism is to find out how and why it is occurring and develop a strategy tailored to the situation. When working to combat vandalism, coordination with local law enforcement is necessary to determine what level of response they provide and if they require the damage or graffiti to not be cleaned until they have conducted their on-site investigation. Some methods to combat vandalism are to provide for strong physical security measures in and around your facility—if it is difficult to approach your building because of adequate perimeter boundaries, if there are cameras located in areas that are susceptible to vandalism with which to observe any illegal activity, or if there are alarms on the facility that will alert security or law enforcement to unwanted activity—all these measures can greatly deter potential vandals taking action against your facility.
9.2.2.2.3. Gang Activity
The level of gang activity that effects your organization will depend upon the area your business operates. If you are unsure what the level of activity and the potential for action by gangs operating in your area might be, it is advisable to check with your local law enforcement agency and determine how viable this threat may be. If it is determined that gangs are a problem within your area, primary mitigations and considerations for gang activity include:
• Communicate to your employees, and ask they communicate to their families, that your facility is neutral ground and that any gang activity will receive priority response.
• Coordinate with law enforcement and other criminal justice agencies to assist with gang activity education and training among your organization’s staff. Training should include issues such as gang identification, intervention, and prevention techniques.
• If necessary, institute antigang education and prevention programs.
9.2.2.2.4
Homicide and Other Felony Criminal Activity
Unfortunately, no organization is immune from violent criminal activity. Primary considerations for these types of incidents at your facility include:
• Secure the perimeter of the crime scene as quickly as possible. Not only will this avoid contamination of the crime scene and assist law enforcement in its investigation, it will also prevent your staff from entering a high-risk zone and minimizing the impact of any violence or graphic images.
• Ensure your organization can provide a list of witnesses, friends, and other interested parties for law enforcement investigators as necessary.
• Be prepared to provide counseling services for affected employees.

9.2.3. Business-Related Incidents

Business-related incidents will normally result from the nature of your organization’s function and employee base. If your company handles hazardous materials or has a large workforce, there are risks that may be associated with these unique characteristics that other businesses may not need worry about.

9.2.3.1. Hazardous Materials

If your company must work with hazardous materials or dangerous chemicals, there are many regulations and requirements that must be met. Even with safeguards in place, it can still be possible for an accident to occur, or for an overt act to cause an incident involving these materials. In the event of such an emergency, the primary threat during a hazardous material incident is toxic fumes; therefore, it is important to keep everyone safe by evacuation, decontamination, and sealing the area. If it is determined to shelter-in-place and seal the building, make every attempt to secure all windows, doors, and vents. This can be done by environmental controls designed into hazardous storage areas or by sealing all openings with plastic. Additional considerations to mitigate damage or injury include the following:
• Immediately notify your organization’s point of contact and 911 describing the condition and type of hazardous material (if known).
• Your executive management team, or the responding emergency personnel, will determine if evacuation is appropriate.
• Your maintenance staff should determine as much information as possible regarding the hazardous material (e.g., type of material, location, amount) and provide this information to responding personnel.

9.2.3.2. Foodborne Threats

If your organization has a cafeteria or serves food in some manner, you should account for a foodborne incident such as food poisoning. The best measure against this type of incident is to ensure your food-handling staff actively enforces proper food storage and handling. Your procedures must also ensure all food preparation and food deliveries are accomplished in a controlled and uniform procedure among all your facilities. In the event of a possible foodborne incident, the following actions should be taken:
• The affected location must immediately inform their supervisor and any local health services agencies.
• Your executive management team should close the affected food service facility and make proper notifications to all employees.

9.2.3.3. Protest Activity

Although protest activities are normally associated with unionized labor, it is possible for any organization to be subject to protestors either from inside or outside the organization. For this reason, it is important that all organizations have plans in place in the event this type of incident may occur.
In many cases, protest activities are preannounced and the time and place are known. In this eventuality, your executive management team should coordinate with local law enforcement personnel a few days before the event to advise them of the upcoming protest. Even if a protest occurs with no notice, the following considerations apply for either situation:
• Interaction between the protestors and your staff should be minimal; however, if employees come in contact, they should treat all protestors courteously and professionally.
• Employees should carry on with their normal activities and use a low-key approach with protestors, although all alternate entrances should be secured.
• In the event the protest has the potential to, or becomes, violent, your staff should immediately secure the facility and notify law enforcement.

9.2.3.4. Medical Health Epidemics

Any type of epidemic can create severe problems for any organization because of the large number of employees that come in contact with one another on a daily basis. Typically, any determination of a potential medical health epidemic, along with the notification, is initiated by the appropriate local health organization. If your business receives such a notification, the primary action your organization will need to consider is whether to close your facility until the medical issues are resolved. In this case, continuous coordination with the health department in your area should be done throughout the emergency to make any further determinations regarding continued closure and decisions regarding when it is safe to open the facility to your employees again.

9.3. Additional Considerations Related to Emergency Planning Procedures

9.3.1. Emergency Response Checklists

One of the best emergency response tools to develop before an incident includes checklists that provide key personnel with necessary actions in the event of an emergency. No matter how highly trained a team may be, an emergency incident will overwhelm even the best leaders and managers—particularly during the initial moments of the event. Checklists will provide these personnel with a tool that helps remind them with the overall actions they need to take so they can concentrate on the other decisions and tasks specific to the emergency at hand. Figure 9.2 shows an example of a checklist for a suspicious device or suspected bomb incident.
Checklists such as the example shown can greatly assist in your organization’s response and ongoing actions throughout an emergency. This assistance can pay dividends by minimizing any loss or damage if proper action was taken at the start of any incident.

9.3.2. Business Continuity Planning

A major aspect of emergency response planning is business continuity. Although this aspect of emergency planning can typically be included within the recovery phase of an emergency, it is important enough that we will discuss it separately to ensure your plans take this into account.
image
FIGURE 9.2 Sample of an emergency response checklist for a suspicious device or suspected bomb.
When your business is disrupted, it can cost money, and these lost revenues plus extra expenses means reduced profits. Insurance does not cover all costs and cannot replace customers that defect to the competition, thus a business continuity plan is an essential part of emergency response planning. Development of a business continuity plan includes four steps:
• Conduct a business impact analysis to identify time-sensitive or critical business functions and processes, along with the resources that support these items.
• Identify, document, and implement plans necessary to recover these critical business functions and processes.
• Organize a business continuity team and compile a business continuity plan to manage a business disruption.
• Conduct training for the business continuity team and accomplish testing and exercises to evaluate recovery strategies and the current plan.
A key consideration for any business continuity plan is to ensure coverage of your information technology resources and components. These items, which include networks, servers, desktop and laptop computers, and wireless devices, are critical in running any business operation in today’s environment. With this in mind, recovery strategies for your critical information technology resources must be developed so that technology can be restored to meet your organization’s business needs. Your business continuity plan must also include manual workarounds as part of your information technology plan so business can continue while computer systems are being restored.

9.4. Summary

Throughout this chapter, we have looked at methods for your organization to develop an adequate emergency response plan. This plan should cover the four primary areas discussed; mitigation, preparedness, response, and recovery; we also looked at specific items within each of these areas. Many of the mitigating actions your organization can implement to either minimize or even deter an emergency incident are discussed in one of the three main security program areas: physical security, information security, and personnel security. Implementing measures from these areas can greatly reduce the impact of several of the emergencies we discussed. To prepare for an actual incident, we covered command and control, communications, collection and distribution of resources, coordination, and congestion. A key point from the preparedness area is the designation of an organization emergency response team along with a clear delineation of roles and responsibilities before the initiation of any incident. If personnel understand what action they must take, your ability to respond to any emergency will drastically improve. We also covered the response and recovery aspects of an emergency.
This chapter also looked at specific types of emergency incidents that most businesses should plan for, along with considerations and actions that can be taken to minimize damage and injury in the event your organization could experience these emergencies. Last, we covered some additional considerations for emergency response planning, including use of checklists and business continuity planning.
Overall, there is one major aspect that can greatly reduce the impact of any emergency—this is ensuring your organization has a plan in place before any incident because it is too late to determine how you will respond once the emergency has occurred.

9.5. Emergency and Contingency Planning Checklist

YesNo
Does your organization have an emergency response plan?
Has your business identified “single-point failures” in your critical functions and provided redundancies?
Has your company identified communication methods during an emergency and provided equipment to ensure continuous communications for all types of events?
Table Continued

image

YesNo
Does your company facility have audible loudspeakers or alarms to warn employees of emergency situations?
Has your organization identified all critical resources needed in an emergency and are their locations known?
Does your organization have an emergency response team?
Are tasks and responsibilities for members of your emergency response team specifically delineated?
Has your emergency response plan taken into account the following areas:

• Command and management of emergency operations

• Fire management

• Security and traffic control operations

• Emergency medical operations

• Staff care and shelter operations

• Facility management and plant operations

• Internal rescue operations

Does your organization have personnel designated for the following teams during the recovery phase:

• Damage assessment

• Clean-up and salvage operations

• Business restoration

• Customer and client information

• Mutual aid and agreement activities

Does your organization have an up-to-date inventory and survey of assets critical to your business?
Does your company have a contact list of clients and customers secure from any emergency occurring at your business?

image

Note: All items are listed in priority order so you should ensure each answer is “yes” before expending funds or effort on the next question. This ensures an executive with minimal security expertise can easily move down the list to implement an adequate security program.

Reference

[1] Newman G.R. Bomb threats in schools. 2002.

Recommending Reading for Emergency and Contingency Planning

Erickson PA. Emergency response planning for corporate and municipal managers. Academic Press.

Bullock JA, Haddow G. Introduction to emergency management. Butterworth–Heinemann.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset