It's too late to start thinking about responsibilities when the service has already been disrupted, says Timo Uola, Head of Security at Helen Electricity Network Ltd, which distributes electricity to Helsinki residents.
Uola examined the issue in his course project for the Aalto PRO Diploma in Safety and Security Management program. His purpose was to develop management and communication during severe incident situations. The result was a guideline for command center operations in emergency situations.
Electricity distribution companies are critical for the society and have statutory obligations regarding distribution reliability. However, many tasks and roles related to incident recovery are universal and apply to most companies.
Usually, when an incident occurs, the company's entire executive board often gathers to the command center. That is pointless."
One of the central conclusions of Uola's project was the need for a clear definition of roles, as without a pre-specified operating model it takes too long to get organized. Usually, when an incident occurs, the company's entire executive board often gathers to the command center. That is pointless, says Uola.
"Ideally, the command center is occupied by a group of people relevant to the situation. The most beneficial areas of expertise have to do with communication and knowledge of the task at hand."
Furthermore, it's essential that the command center is led by a designated person.
"The place may be full of experts, but the situation requires clear leadership and someone to say who's to do what," Uola says.
Role-specific areas of responsibility are listed on task cards
Uola's project revealed a number of essential command center functions. In addition to leadership skills, expertise in internal and external communication, and knowledge of the task at hand, the situation calls for people who attend to various support functions, such as maintaining situation awareness and IT.
If the situation drags on, someone must also take care of catering and regular rest periods.
Uola supplemented the guideline with printed task cards modeling command center operations. The cards describe fourteen different roles. Each command center operator gets a card defining his or her area of responsibility. There are even cards for the rescue authorities and external service providers.
Don't overlook internal communication
The importance of communication in incidence management cannot be exaggerated, says Uola. Being proactive pays off.
"Sometimes the fault can be detected even before it becomes a problem for end-users. In such cases, it's good to convene the command center operators, prepare press release templates, and create an action plan in case the situation escalates," Uola advices.
Uola recommends fast and open communication."
Maintaining situational awareness is an essential part of communication. Someone must make sure that both the command center and all employees are kept up to date of the situation. Uola says that internal communication is easily overlooked and staff left to rely on what the tabloids have to say.
"That creates a risk that people working on the field give the press incorrect information. The basic assumption is, of course, that all communication is handled by the command center."
Uola recommends fast and open communication. Otherwise there's a risk that fake news starts to spread in the social media and ends up as "facts" in the press. The resulting reputation risk may be difficult to repair.
"Today's digital media sets an altogether different challenge for communication that what it was ten years ago. The faster you get out your first press release, no matter how brief, the more likely the media is to rely on it, instead of rumors circling in the social media," Uola says.
Emergency planning exercises simulate real situations
Guidelines and roles alone are not enough. Severe incidents are rare in Helen Electricity Network's operating area – on average, a Helsinki resident experiences a power cut only once every ten years
– so even good plans and models tend to be forgotten without regular practice.
As part of his project, Uola organized an emergency planning exercise based on the new guideline. It simulated a cyber attack against the network's automation system causing power cuts around the city. A command center assembled for the exercise was tasked with discerning what has happened and with communicating the situation both externally and internally.
The participants included not only Helen's own employees but also communications students who contacted the other participants as would-be journalists and created social media updates, news clips and sensational headlines for practicing media monitoring.
"They even set up a fake Twitter account for the company's CEO and published strange tweets that the command center had to refute," Uola says.
"In case of incidents that affect the society at large, such as severe floods, we would have our own representative at the rescue authority's command center to make cooperation between the different actors as smooth as possible."
Uola is currently developing a model for regular emergency planning exercises and training. Another item on his to do list is making sure that there are appropriate technological operating conditions for the command center to function without hiccups.
"The next exercise is on the calendar, too, but its content is still a secret," Uola says.
This article series presents the projects done as part of Aalto PRO's Diploma in Safety and Security Management program. Over 500 safety and security professionals have already participated in the program. Read more (in Finnish).