ISMA is publishing this op-ed from an anonymous member representing a multi-national company in the manufacturing sector.
“The definition of insanity is doing the same thing over and over again but expecting a different result.”
As the circumstances surrounding the COVID-19 pandemic have dictated new reverse trigger points for many organizations to begin operating “normally” again, I am reminded of the events following 9/11 where we finally returned to a new normal. Our old ways of operating evolved in recognition of new threats. We once again can create opportunity from the current crisis.
The plans many of us had in place pre-COVID were based on a management structure where the focus was on a hierarchy designed for efficiency in risk mitigation. Our chain of command facilitated the transfer of information in a vertical path to allow for analysis and additional inputs at each step for a holistic picture of the situation at hand. The corresponding approvals for action were then transferred back down the chain. While the process was efficient from an informational standpoint, it was encumbered by numerous choke points which lengthened response times.
These types of structures are no longer successful frameworks for dealing with this new threat; the variables that impact the organization are evolving too rapidly to invoke an effective, swift, and agile response. We can no longer operate the way we have in the past. The answer to our new problem is a flatter organizational structure, one which facilitates a more nimble and adaptable response to the daily – sometimes hourly – changes that occur.
For maximum adaptability, new structures should be comprised of distinct cross-functional teams (e.g. incorporated members of security, human resources, environmental health and safety, public affairs, etc.) that are organized to handle specific tasks. These tasks include responsibilities such as access control, decontamination, virus prevention, reoccupation training, and communication, among others. To maintain the agility necessary for rapid response, each team must be empowered to make decisions based on the information it has at hand. This will require that each team fully understand the overall strategy, risk map and guidelines for engagement. It will also require trust in individual leaders to carry out their functions independent of traditional oversight. The guidelines should also be nimble enough fit the new structure – for example, if the action to be taken is legal, ethical and benefits the organization, then it is approved without running up and down the chain of command. This flexibility will allow individual leaders to adapt to each situation quickly without the complications of trying to navigate complex plans. Actions taken by the teams are passed to leadership as notifications for awareness and guidelines can be modified based on what has been successful.
The key to success among independent teams is communication and transparency. Not everyone on a team needs to know the members of the other teams, but there should be at least one individual crossover; those individuals should understand the purpose of each team and have open lines of communication among themselves. This horizontal communication network and the common knowledge of the strategy is the glue that holds the structure together.
Lastly, we need to curb our expectations. These are new circumstances and we are sailing in uncharted waters, so it is unreasonable to anticipate a 100% solution. As speed is the critical factor in our adaptability, a partial solution today is better than a full solution tomorrow – especially since a full solution may not even be possible. Embrace experimentation and innovation each of the teams will bring to the table. As successes and failures are shared among the teams, a better understanding will emerge of what works, what does not, and why. This shortens our learning curve and makes the organization more capable of evolving with the threat.
It is incumbent upon security practitioners and organizational leaders to meet the new challenges we face by identifying and implementing new methods and learning each day how to adjust them to respond to threats. As leaders, we need to provide our people with the tools, training, and opportunity for success and realize perfection is rarely achievable, but progress is. Speed is of the utmost importance, so we should not sacrifice it for the sake of relying on past successes that were built on frameworks to address entirely different threats.