Bulletin / Love your Incident...

Love your Incident Management Support Team!

Author: Charlie Maclean-Bristol

Last week I delivered Incident Support Team Training for an organisation in London and so thought that this week I would talk about that rather than Donald Trump’s Inauguration!

I believe that having one or two people designated as the Incident Support Team (IST) is an essential part of your Incident Management Team (IMT), whether it is a strategic, tactical or operational team. The support team can perform a number of key tasks which allow the other members of the team to concentrate on responding to the incident within their areas of responsibility.

The tasks which I see being performed by the Incident Support Team or admin staff, as some people call them, are as follows:
 
Setting up the incident room before the incident team members arrive. As soon as the incident is declared I think they should go to the incident room and ensure it is ready, preferably before the incident team arrive. This could include:

  • Bringing along an incident team battle box containing all the required documents, stationery, log sheets and equipment
  • Setting up the room
  • Setting out role cards in a set order
  • Preparing incident boards
  • Setting up or testing telephones and laptops if they are being used

Whilst the IMT team is meeting the IST team can do the following tasks:

  • Record who attended each team meeting
  • Record action points from each team meeting. At the end of each meeting read back the action points to the team to check that they are correct. Once the meeting has finished they should be written up on a board or flipchart. As members of the IMT carry out the actions they should tick them off. This allows the team leader to instantly see which tasks have been done and then in the next team meeting they can focus on the tasks which have not been done
  • If key decisions are made during the meeting they may be asked to record them
  • Record key events on boards
  • The team leader may also ask them to record identified issues, risks and decisions, and when the decisions need to be made by
  • During the meeting, a member of the IST team may be designated to answer the team’s mobile phones so that they are not disturbed
  • Act as a gate keeper to prevent ‘incident tourists’ (usually senior managers who are not involved in the incident), disturbing the meeting

In between incident meetings the following roles may be undertaken:

  • Answer the incident room phone and log any incoming calls
  • Provide the team with refreshments and the obligatory incident room pizzas
  • Keep the room clean and tidy. Ensure that the half empty coffee cups are in the dishwasher
  • Photocopy and distribute paperwork
  • Find out information for the team, get hold of people and conduct research
  • Update incident boards and make sure that there is a chronological list of incident events 

Post incident. At the end of an incident all those managing it breathe a sigh of relief and go home. Preservation of evidencee in case there is legal action after the incident should be a key part of the IST. 

This role really needs to be supervised by the Business Continuity Manager and the following should be carried out:

  • Carry out any post incident procedures
  • Collate all documents used during the incident. These could be electronic ones as well as physical ones
  • Ensure that all emails relevant to the incident are collated in one place 
  • Ensure that all information on smart phones is recorded. This could include texts, WhatsApp messages, telephone logs and information from any notification system
  • Make sure that all the information is saved in one place. Legal advice should be taken on where is the best place to store these and how long they should be kept
  • They may also want to save all documents, templates and text created during the incident in one place and ensure they are available to the team so that they can be adapted for future events

Those who have a designated incident support team find that during exercises and incidents they can concentrate on responding to the incident knowing that actions will be logged and incident boards maintained. 

One of the key parts of incident management is information management and the sharing of information amongst the team. The better the information available to the team members, the better the decisions that will be made. I believe that members of the IST should be given training in their role and there should be a pool of them available to be called out to support the team. 
 
To me, this is a key part of the incident team and if you don’t have people designated and trained for this role I suggest you do this now!

You might be interested in the following stories

The Importance of Debriefing

The Role of the Business Continuity Manager

You may be interested in the following course

BCI Incident Response and Crisis Management course

Sign-up to our weekly bulletin

Twitter feed

Bulletin
What lessons can we learn from Marriott’s response to their Cyber Breach?

This week Charlie discusses the Marriott hotel hack and how you can prepare your organisation for a potential data breach.

7 December 2018

“Great course provided by a very good instructor [James McAlister] with above average knowledge and clearly demonstrable experience.”

Lisa Deehan
Hyperion Insurance Group
View further testimonials