Digital Technology Needed to Implement ISO 22398

Digital Technology Needed to Implement ISO 22398

International standard, ISO 22398 describes the procedures necessary for planning,  implementing, managing, evaluating, reporting, and improving exercises, as well as the testing designs needed to assess the crisis-readiness of an organization.

The genesis of a crisis exercise and testing standard

But why such a standard in the first place?

The pandemic proved conclusively that you can’t just  plan for crises, you have to test plans consistently, under  conditions that best approximate the real-world crisis  scenario. The failure to exercise and test resilience is often  given as a reason for the breakdown of business resilience  processes during critical events.

Of course, the issue predates the pandemic. In the 2018  Deloitte study, Stronger, fitter, better: Crisis management  for the resilient enterprise, 90 per cent of organizations  reported confidence in their crisis management  capabilitiesⁱ. Only 17 per cent of those organizations,  however, had performed simulation exercises.

As a result, the resilience community banded together to develop international standard ISO/DIS 22398, which lays out a best-practice framework for performing resilience testing and exercises.

However, with evidence that some of the gains in crisis management made since the pandemic are ebbingⁱⁱ, we thought it was a good time to reintroduce the crisis exercises and testing standard as well as define the digital capabilities needed to implement ISO 22398.

A deep dive into ISO 22398

So, what’s the standard all about?

The standard itself consists of seven sections, in addition to a forward, introduction, and multiple informative annexes.

The introduction sets up fundamental principles for crisis management exercises and testing, such as the need for performance objectives. Objectives, here, include:

Orientation/demonstration

A simulated experience of an expected situation with the intent of increasing awareness of vulnerabilities and the importance of effective action in response to the simulated conditions.

Learning

Acquiring knowledge, skills, or abilities by individuals or groups with the goal of mastery of specific competencies.

Cooperation

Providing an opportunity for people to work together to achieve a common end result.

Experimenting

Trying out new methods and/or procedures with the intent of refinement.

Testing

Evaluating a method and/or procedure in order to assess which components are sufficiently developed.

Further, the standard argues that organizations should codify specific policies stipulating that exercises, testing,  and implementation procedures should lead to corrective action. To this end, organizations should:

1. Develop exercise performance objectives to define the direction and scope of exercises and testing.

2. Implement the procedures that trigger a review based on the critique of an exercise, test, and actual events. Scenarios should reflect the objectives of the exercise.

Establishing the foundation and other key standard sections

Understanding theory is good, what matters, though, is practice. The standard excels in making pragmatic recommendations for tangible actions, too, e.g., what organizations need to do before performing tests and exercises.

In the establishing the foundation section, the standard instructs complying organizations that they need to conduct a needs and gap analysis; the purpose of this analysis is to establish the need for exercises and testing in the first place.

Beyond that, pre-testing analysis effectively signals the role of exercises and testing in managing business risks. The practical import in that is it helps stakeholders (including senior leaders) understand that conducting exercises and testing is needed to manage risks.

What questions might organizations ask to get started with this planning stage of the testing process? Common questions include:

• Does the exercises and testing plan address requirements for exercises and testing?

• Can this plan promote consensus with interested parties?

• Does the plan offer an opportunity to reach and interact with its target group(s) and potentially address their interests?

• Does this plan provide an opportunity to address multiple issues in depth?

• Does this plan focus on key issues?

• Does the plan provide information tailored to the target group(s)?

• Is this plan practical and relatively easy to implement?

• Does the plan provide for information transfer at relatively low cost?

• Is the effectiveness of this plan measurable?

• Is this plan a good vehicle for education?

• Is this plan creating a constructive and supportive atmosphere?

• Is this plan an effective way to get publicity or increase public awareness?

• Does the plan conform to the organization’s constraints?

Indeed, the genius of the ISO standard, here, is that it enables organizations to move away from generic exercises to a more customized testing program better suited to managing their specific business risks.

From that vantage, the gap analysis not only helps make the case for such a best-practice testing program, but it also indicates what kind of exercise (out of the many available options) that that program should be deploying.

Exercises companies might undertake include:

The standard offers even more room for exercise customization than that. Besides type, exercises themselves can be broken down into discussion or operations based. The former helps participants familiarize themselves with existing plans, policies, agreements, and procedures.

Operations-based exercises, on the other hand, help stakeholders validate plans, policies, agreements, and procedures. They also allow for the clarification of roles and responsibilities as well as the identification of resource gaps in an operational environment.

Of course, even these two categories include multiple sub-categories, examples of which include:

Digital exercise management capabilities needed to implement ISO 22398

How, then, to set up a crisis testing and exercise capability efficiently in compliance with ISO 22398?

Organizations that haven’t yet should seek out integrated business resilience software. Using the new digital transformation technologies of analytics and workflows, these platforms help businesses to (1) better anticipate and identify trends, (2) prevent situations that may generate an interruption, and (3) respond more efficiently to disruptions that do arise.

They also work to better fuse the planning and exercise management competencies together within the greater business continuity and resilience management program.

How so?

Well, the platforms in question function as plans. That means when customers need to develop their continuity and resilience plans, all the data they have previously entered seamlessly comes together. This way continuity and resilience managers don’t have to go sifting through documents to find the data they need, eliminating the risk of someone referencing an out-of-date plan during a crisis.

What’s more, because the plan is in the platform, multiple stakeholders can collaborate on the development and updating of the plan, which enables better engagement. All data associated with building plan is managed centrally, in a controlled way. And data points only need be captured once and updated, which reduces the risk of duplication.

The platform as plan approach leads to more efficient exercise management, as does the platform’s own enhanced exercise management functionality.

What are they?

For starters, exercise dashboards navigate users and their teams through each phase of an exercise, ensuring everyone understands what needs to be completed and when. From there, the platform’s automation capabilities ensure the correct teams and/or personnel are invited to participate in the exercise and receive regular updates via automated notifications throughout the exercise.

Once the exercise is activated, all users can easily see what type of exercise is being completed. And based upon the affected assets/activities, the recovery strategies required for the affected assets will automatically be populated for the team.

Built-in communication and collaboration tools, e.g., chat, email, SMS, and voice messages, then, make it easy to collaborate in real time, better coordinate responses, and keep everyone informed.

Finally, the platforms provide the capability to record meetings, minutes, and action items. This is a mirror of the platform’s incident management functionality, designed as such to ensure a consistent user experiment. Which gives practitioners the benefit of familiarity in the event of a crisis.

What does it all mean?

COVID pointed up systemic gaps in exercise management; and post-COVID survey data suggest that those gaps have yet to be closed. In fact, they might be opening up again as gains are reversed.

Best-practice exercise management standards, such as ISO 22398, will get companies part of the way there – but not entirely. Developing a best-practice exercise management program for the full lifecycle of crisis management and resilience testing will take purpose-built software, like Noggin. These platforms fuse planning and exercising together, improving the user experience of each, all the while strengthening resilience.

Sources

1. Peter Dent, Roda Woo, and Rick Cudworth, Deloitte Insight: Stronger, fitter, better: Crisis management for the resilient enterprise.
   
   
2. BCI: BCI Crisis Management Report 2023. Available at https://www.thebci.org/news/new-report-shows-organizations-are-battling-the-complex-crisis-management-landscape-with-confidence.html