Business Continuity Management: Building an Effective Incident Management Plan

Chapter 1

Business Continuity Management Plan

The incident management plan (IMP) is a detailed component of a Business Continuity Management (BCM) Plan. Also known as the enterprise resilience, emergency preparedness, or risk management plan, it forms the advance planning aspects that enable the initial crisis response activities to be conducted in a prearranged and organized fashion. The IMP is designed to support business continuity and incident recovery at the early stages, meeting immediate event response needs as resources are mobilized and more mature and comprehensive management measures are brought into play. The IMP can bridge, or be part of, more detailed crisis response plans such as evacuation management, disaster response, and reputational recovery, as well as dealing with kidnap and ransom situations and pandemics. However, these stand-alone plans are often better served as comprehensive components within the overall Business Continuity Management Plan (as they will likely be more oriented to specific divisions, fields, or regions), whereas the IMP addresses more common and generic risk types that the organization might face at the outset of a crisis event. The IMP at the basic level supports immediate tactical considerations and management functions, rather than long-term risk management and business recovery needs. Where feasible, the company should seek to transfer decision making to the lowest levels possible for the initial response requirements, as this will strengthen and empower local managers to contribute effectively to the management and early resolution of a crisis event.

Business Continuity Planning Terms

Contingency planning and crisis management

Enterprise resilience

Emergency preparedness

Enterprise risk management

Emergency management

Critical situations management

For the purposes of this book, incident management focuses not on the strategic, specialist, or sustained response measures, but on more granular and tactical support mechanisms that are the precursors to more complex and corporate-driven crisis management and business recovery policies and plans: the first 24 to 72 hours of an emergency. This book touches on the broader aspects of risk management in order to support the reader in placing the IMP within an understandable context. However, the book is principally designed to discuss the first stages of crisis response where incident management will play an active part in bringing an emergency situation under control, as well as feeding crucial information to company officers. The IMP is a tool for a wide spectrum of users, not only security professionals or corporate leadership. As such, the IMP supports local management in collating accurate information and following simple response guidelines to reduce the initial impacts of an emergency event, bringing control to a situation and further mitigating the risks that could escalate out of control from a problem, or be created as secondary or peripheral effects as a result of the initial crisis event. The IMP in these terms is also a short-term measure, allowing a degree of organized control to be implemented while the company mobilizes resources and specialists during the early stages of an emergency.

Companies should be aware that the social fabric of a culture or an area can be quickly undermined by a crisis situation, resulting in unique and challenging risks to commercial organizations, their employees (and families), facilities, and business activities. Even within Western countries, the speed at which deteriorations in governance, basic amenities, and societal rules can be surprising. The implications can be widespread and catastrophic, or localized and disruptive. Crisis events may result from a natural disaster: a flood, earthquake, hurricane, or pandemic. They may result from widespread civil disorder: a coup, political instability, insurgency, or war. Or a crisis event may be localized: a riot following a football match, aggressive measures over farming disputes, fuel shortages, a focused labor dispute issue, or directed attacks against individuals, groups, or facilities.

The following list illustrates some macro-level considerations companies should incorporate into their strategic planning for crisis management:

Governance. The loss of governmental control and policing authority can be swift and widespread. Government offices may be directly affected or overwhelmed by a crisis event, and officials may not have the knowledge, capacity, or resources to quickly support the affected populace. Government offices dedicated to dealing with a crisis situation may also be undermined as personnel respond to personal emergencies or to care for families, diminishing a government's expected capacity to respond to a crisis effectively.

Social Fabrics. The social norms that regulate our societies can be quickly lost or undermined as the effectiveness of governance is diminished. Rioting, thefts, looting, and other social crimes can quickly spread to otherwise law-abiding sections of the community. This is a cyclic effect and can create a further loss of governance which might exacerbate a crisis and add additional elements of risk to the original crisis event.

Utilities. Common utilities and services can be disrupted, such as power, water, sewage, and communications, during a crisis. Basic amenities like food availability, financial services, and fuel provisions can also be affected. Modern cultures are not best engineered to weather a loss of power or disruptions to food, fuel supplies, or utilities, and often struggle to manage if common services are disrupted, and such losses can also result in secondary crisis events.

Movement. Movement can be affected by crisis situations, whether due to man-made risks presented by hostile or disruptive groups, or due to damaged infrastructures or the unavailability of fuel or power supplies. This can affect every aspect of emergency management, from those dealing with emergencies at the point of crisis to those attempting to respond in support of the emergency or evacuate from an affected area.

Critical Services. Critical services, such as fire response, medical provisions, and health care, or critical infrastructure power and utilities can be seriously undermined with the loss of basic utilities, undermining the ability for such groups to respond to or support an affected population. Infrastructure damage and affected supply chains of critical materials or resources can quickly devalue otherwise effective critical service providers.

Communications. Communication mediums may be affected by a crisis event disrupting or preventing the effective passage of information and instructions which might support an understanding of the crisis event, as well as the effective response to an emergency. Communication systems may be damaged, or overwhelmed by a surge of use. Often voice mediums are lost before text and this can affect both government entities' ability to mobilize and respond to a crisis, as well as a commercial organization's respond measures.

Crisis Definitions

A crisis is (1) an unstable condition, as in political, social, or economic affairs, involving an impending abrupt or decisive change, or (2) an abnormal or unique event that threatens groups or individuals, as well as their goals and enterprises, through disruptive or harmful effects.

A crisis event can also be considered in terms of the micro- and macro-level crisis. The micro crisis is the point of the event: a collapsed building, fuel leak, or roadside fatality. The macro crisis consists of all of the risks that originate and ripple outward from that event: threats posed to surrounding buildings, recovering trapped persons, bringing control to the oil leak, dealing with the media, and reducing reputational and liability risks. In these terms, the IMP typically focuses on the micro-level crisis: the event itself. The IMP does, however, play a fundamental role in supporting the company in dealing with macro-level considerations and threats. Therefore, the IMP may be considered the first of many steps within a broader crisis response plan, acting as a precursor to the fuller crisis response measures being implemented by the company, as well as the transition point at which a company goes from managing the incident to controlling the effects of the wider crisis. This is a subjective delineation and will of course be influenced by the nature of the event, the composition of different management teams involved within the emergency, and the operating environment in which a company is performing work. An effectively designed and implemented IMP reflects the level of effort a company invests into ensuring the safety and welfare of its employees, protecting its business interests and brand value, and maximizing operational productivity through pragmatic contingency planning measures that enable effective, immediate, interim, and long-term crisis response mechanisms and methodologies to be implemented.

Given the ease at which organizational control and governmental support can be lost during a crisis, companies should seek to design and resource a degree of self-reliance within their crisis planning that takes into consideration these factors, while still leveraging and exploiting external governmental and other resources to support their response measures and capabilities.

Crisis Management

For the management of risk within a nonspecialized industry or more tangible fields such as construction, development, power and water, fuels, maritime and air, consulting, and training, the company's or its security vendor's crisis response team typically comes from a military or law enforcement background where the concept of incident management and crisis response has been an integrated aspect of their careers. In addition, subject matter experts within areas such as health and safety, engineering, administration, and legal considerations will also support critical crisis response decision making. Where risk elements are more market sector focused, such as business, financial investments, and mergers and acquisitions, more specialist risk managers may be required within defined fields such as information technology (IT), investments, and business intelligence. Typically, outside of pure investment and business risk areas, the initial point of a crisis event will be operationally oriented and occur at a point or location away from such expertise, although more nebulous risks will result from a physical event. The IMP should be designed to withstand a lack of experience or knowledge by users who operate outside of the risk and security management field. It should be a pragmatic, simple, and user-friendly tool; and the design and testing of such a plan should incorporate users as well as managers and specialists in order to ensure that plans are logical and unambiguous, reflect the operating conditions, and, most importantly, are implementable and understood.

Companies should seek to leverage the capabilities, knowledge, and resources of both in-house experience and knowledge, as well as that of their security vendors to provide, supplement, or augment their business continuity policies and plans. When operating within more challenging environments where the probability or impact of risk is higher, companies should consider the value of transferring both the risks and the resources required for establishing the Business Continuity Management Plan, as well as its various subcomponents such as the IMP and evacuation plans, to their security vendors or outsourced consultants in order to offset both risk exposure and development effort. That said, integration for any crisis planning should be established to blend outsourced and company requirements and activities at all levels. The scope of work for any security contract in such regions should include clear requirements for the vendor to provide contingency plans and crisis management protocols as part of the overall service-level agreement. While the company can never fully defer crisis management responsibility to a subcontractor, corporate and field risk managers can establish policies and procedures by which much of the burden of dealing with a crisis event can be transferred onto an appropriate vendor, while strategic decision-making authorities are retained by the company, as well as corporate risk response measures. These agreements should be understood and the plans and responses clearly articulated and practiced in order to ensure that the most effective risk management approach is in place.

The Value

The investment in terms of time, money, and resources in developing a Business Continuity Management Plan can be seen both in tangible terms of safeguarding personnel and facilities, as well as in often bringing less visible or hard values and benefits to the company, such as increased profits and productivity, market confidence, reputational protection, and employee morale. Business Continuity Management Plans can provide companies greater supply chain assurance; be a market differentiator in terms of effectiveness, agility, and the overall competitive value; and often enable the company to identify, understand, and offset risks prior to their occurrence, as well as perhaps operate within business environments in which they would be otherwise prevented from engaging. Such focus can also be migrated to vendors, ensuring that their approach to business resilience best supports the company, and can also assure investors or clients that the company can weather a crisis effectively—without unduly disrupting business services or operational delivery. A Business Continuity Management Plan can support the company in winning as well as undertaking work through the alignment of risks to business interests and activities, as well as reducing insurance premiums and liability exposure.

What Is Risk Management?

A system that defines an organizational structure, as well as team roles and responsibilities, to enable a company to react to situations ahead of an emergency.

A bridge between risk mitigation (business protection), risk management (business resilience), and crisis recovery (business resumption)

A holistic solution meeting the requirements of all corporate needs and activities, whether related to brand, operations, reputation, or ethos.

A tool that helps companies negotiate fluid and challenging risk environments, effectively dealing with unpredictable events.

An insurance mechanism that supports business continuity and recovery when risk mitigation measures fail.

Risk management should be considered a supporting element of business development and operational conduct, regardless of the industry sector or geographic region a company might operate in. It should be considered best practice for companies, safeguarding both corporate and employee interests through well-developed policies, procedures, and plans. The following summarizes some of the benefits that the development of a Business Continuity Management Plan may bring to companies or groups:

Establishes a corporate agenda and strategic approach.

Brings awareness and understanding of corporate risks and liabilities.

Establishes a culture that embodies a common vision and taxonomy for risk.

Supports better business planning and practices.

Enhances business discipline and internal controls.

Protects directors and officers against liability charges and claims.

Ensures informed decision making to strengthen strategic plans and responses.

Aligns business with risk management to ensure effective business.

Reduces reputational and liability risks, and protects brand and investor confidence.

Protects business activities, resources, and personnel.

Strengthens business continuity and recovery—improving productivity and profit levels.

Demonstrates duty of care and sound management practices.

Reduces insurance premiums and liability claims.

Improves management and employee confidence and morale.

Ensures the identification and best use of organic and external resources.

Provides an evidence chain for investigations and audits.

Meets industry, governmental, and other regulatory requirements.

Defines the business strategy, including expansion, new market entry, and downsizing.

The value of developing an effective Business Continuity Management Plan, as well as an accompanying IMP, is illustrated in Exhibit 1.1. It highlights how enterprise resilience and recovery measures can:

Map risks and guide management responses.

Protect the company's business and corporate interests.

Bring order out of chaos in order to depict a true reflection of an organization's ability to deal with a crisis.

Provide confidence to managers, employees, clients, and investors.

Integrate recovery measures across disparate and dispersed organizations.

Leverage organic and external resources to manage and respond to crises.

Increase profits and productivity, and reduce costs and liabilities.

Protect facilities, resources, and human life.

Meet specific regulatory and industry standards.

EXHIBIT 1.1 The Value of Business Continuity Management Plans

A well-resourced Business Continuity Management Plan will also include forms of information or advisory feeds, whether intelligence or environmental or political scanning, in order to ensure that crisis management policies and plans are triggered prior to an event occurring. Such measures will ensure that the plan, or parts of it, are set in motion before the event occurs (i.e., warning of localized flooding, notifications of civil gatherings, and so on). Contingency planning and crisis response investment in terms of money, time, and resources should be considered a fundamental aspect of sound business practice, not a cost center. While difficult to quantify in terms of cost savings, business resilience statistically increases long-term business productivity and operational recovery from crisis situations and should be considered a central aspect of corporate strategic policy and planning functions.

Common Failings

Designing and maintaining a Business Continuity Management Plan can be fraught with problems and can often result in a significant waste of time, resources, and energy in the creation of policies and plans that quickly lose their value and applicability in terms of supporting the company's strategic and tactical interests. Plans are also frequently prepared at significant cost, only to then be ignored, be poorly distributed, or be underutilized during an emergency. It is therefore useful to understand the common failure points in the development and utilization of such plans in order to design and sustain a business continuity architecture that is created—from the outset—to meet the group's long term needs, and that gains management buy-in, is kept current and applicable, and is embraced and understood by the users and stakeholders in order to be effective. The following outlines some key areas in which Business Continuity Management Plans often fall short of potential success:

Management Support. A Business Continuity Management Plan that lacks high-level support is likely to fail from the outset. Corporate leadership needs to fully embrace the value of developing such policies and plans and has to ensure that different company divisions are supportive both of the strategic corporate requirements, as well as their individual areas of group interest. Support should cascade from the top downward in order for plans to be successful. Clear directives should support the plan, ensuring that each group and individual adheres to corporate policy.

Ownership. Ownership of the plans should be established to ensure that participants understand and are accountable for their part within a Business Continuity Management Plan. In addition, a sensible appreciation of who should own certain aspects of the plan should be evaluated, with appropriate managers being empowered to develop, maintain, and manage elements which best reflect their areas of expertise. Company politics should not drive ownership issues—functional capability should be the defining factor.

User Buy-In. The user audience must also be supportive of the Business Continuity Management Plan. Otherwise, the value of application will be undermined, local managers will be prone to use their own approaches and methodologies, and the ability of users to apply the plan's principles and guidelines during an emergency will be hampered by a lack of awareness, understanding, and enthusiasm for the Business Continuity Management Plan. Seeking user buy-in from the outset will ensure the plan reflects the user and stakeholder needs, and so encourage their support and active participation.

Structure and Design. Often plans are designed that are cumbersome, confusing, and difficult to maintain. Consistency of design and structuring is often quickly lost, and individual divisions or regions are prone to developing their own unique approaches, which can undermine the plan, create confusion, and result in redundancy—or at worst, lead to erroneous directives and guidelines that increase the potential threats. Plans should be designed to be simple, efficient, and easy to maintain or adapt. Consistency in layout, content matter, and generic directives should not prevent regional or activity-specific requirements to be met, but will ensure a clear and logical format for approach.

Applicability. Plans can quickly become redundant as personnel change over, the threat environment shifts, and business activities progress. The structuring and design of plans can make sustainability of plans difficult, causing plans to rapidly become inaccurate or completely redundant—placing the company at risk, as well as incurring unnecessary costs. Plans should be designed in a manner that allows live sections to be easily updated, with static sections to remain constant where applicable. The use of supporting tables, diagrams, and other out-of-plan data feeds will help satisfy this requirement. Plans should have periodic reviews to ensure that adjustments are made and the plans are updated using internal projects, as well as corporate quality assurance mechanisms.

Training and Education. The plan is only as good as the users who implement the policies and procedures within it. A failure to adequately advise, train, and rehearse personnel will significantly devalue the Business Continuity Management Plan, making its use disjointed, difficult, and confusing during an emergency. Companies must budget time, resources, and capital to ensure that managers and personnel are educated as to the plan's function, how it will be employed, as well as how to support its development and maintenance.

Leveraging Resources. Business Continuity Management Plans should seek to leverage organic as well as external resources as efficiently and effectively as possible. Often plans fail to capitalize on the raft of support that is available, diminishing potential value as well as incurring unnecessary costs and risks to the company. Plans should be aligned to all possible resources available at corporate, country, and project levels.

Accessibility and Maintenance. Often risk and crisis policies and plans are not accessible to the various users and stakeholders, and as such changes are difficult to undertake and track. Version control of policies and quality assurance can be problematic. Hosting policies and plans on web-based systems can support accessibility as well as the use of a central document to support version control management.

The development of a clear corporate agenda and well-structured goals prior to work commencing on the Business Continuity Management Plan will enable its design, development, and ultimately its sustainment to be achieved more effectively, and with least frustration. The plan should be considered a living and pan-organizational tool that requires group support and buy-in in order to be successful. Time spent on planning is seldom wasted, and companies should develop frameworks for their objectives and requirements fully before commencing work.

Business Continuity Goals

The veneer of safety and security, and indeed in some cases civilization, can be quickly stripped away during, or following, an emergency situation. Common social norms may be temporarily suspended, and governance and basic amenities may be disrupted—leading to unique and challenging risks for individuals and organizations. Companies should therefore have clear goals when designing a Business Continuity Management Plan, seeking to meet strategic, operational, and tactical needs. Considerable time and investment is often wasted through a poorly planned, structured, and implemented approach to designing and implementing Business Continuity Management Plans. Business continuity can be broken into three main areas:

Contingency Planning. Seeking to avoid a crisis through risk mitigation, as well as preparing for a crisis through the development of plans, agreements, and policies.

Crisis Management. Utilizing preestablished contingency plans practically in order to manage a crisis event most effectively.

Recovery. Utilizing preestablished contingency plans to quickly and effectively recover from a crisis and resume operations.

Alternatively, Business Continuity Management can be reflected in the three R's, Ready for an emergency, Response to an emergency, and Risk recovery. In order to be most effective, the Business Continuity Management Plan should address the following objectives as a guiding framework when developing such policies and plans:

Intelligent. The Business Continuity Management Plan and associated policies, protocols, and plans reflect all layers and levels of need. They take into account the corporate ethos, strategic goals and agendas, shareholder interests and perceptions, marketplace and risk environment, as well as individual programmatic issues, organizational structures, cultural influences, resource limitations, and teammates' and vendor's interests.

Persuasive. The Business Continuity Management Plan (where possible and appropriate) gains buy-in throughout the management and user and stakeholder population and is integrated and embraced throughout the group. Integration also occurs with supporting or leveraged agencies and organizations to make the Business Continuity Management Plan operate seamlessly with both internal and external groups.

Transparent. The organizational structure, roles, and responsibilities, as well as communication and decision-making authorities and practices, should be transparent to all managers and users in order for the plan to be effective. Elements of the plan should also be shared with external groups who might be stakeholders or who might be expected to perform specific functions during a crisis event.

The following are four recommended characteristics that form the basis for the effective development of a Business Continuity Management Plan:

Comprehensive. Establishes contingency measures that meet the holistic threats facing a company and its activities, and manages the entire life cycle of a crisis.

Integrated. Unites all appropriate organizational divisions, external agencies, vendors, teammates, and other parties into an integrated system.

Flexible. Can match the tempo and direction of a fluid business and risk environment, allowing all threats to be appropriately mitigated or managed.

Benchmarked. Is developed using mature and quantified (where possible) evaluations of the risk natures and probable impacts a company might face.

Defining a Crisis

The term crisis is subjective and fluid. It is important when developing a Business Continuity Management Plan, with its various components (including the IMP), to first define what is considered a commonplace problem against what might be considered significant enough to warrant the titlecrisis. Each company should consider the implications of applying such terminology, as inaccuracies may result in crisis events being ignored, or conversely, common issues resulting in disproportionate levels of management attention and resource allocation. Common sense and experience will play a key role in guiding managers; however, some simple tools and definitions will support a common understanding across an organization. Such definitions might include:

Problem. An everyday occurrence that does not affect an individual's safety, the integrity of critical infrastructure, or the protection of sensitive materials or information, and does not undermine significantly the operational productivity of a project, nor devalue the business interests or reputation of the company.

Crisis. A singular event that places employees at personal risk (whether physical or psychological), threatens the integrity of critical infrastructure, may lead to the loss of sensitive materials or information, hinders the operational productivity of a project, and presents a threat to the business interests and reputation of the company.

Many large corporations have grown through mergers with or acquisitions of other organizations, or operate within the market space through joint ventures and teaming agreements. In these cases, there is a rapid assimilation of multiple organizations' approaches to risk management, which adds a significant degree of complexity to definition and subsequent management of risk. Aligning different approaches, requirements, and expectations is critical to ensuring that complex and integrated organizations can best manage a crisis event.

Mapping Risks

Mapping risks should occur as a layered approach to enterprise resilience. It should be a top-down driven approach, meeting strategic, operational, and tactical risks in a logical and pragmatic manner. Enterprise resilience should consider the following key questions when designing the strategy:

What is the company's risk tolerance? How can perceptions be formalized?

How can risks be measured, tracked, and monitored? Who is responsible and how do they do this?

What are the company's key earnings? What market and financial risks are there?

Where does the company operate? What environmental risks are there?

What is the company's cultural approach to risk? What are the ethos drivers?

What liability and reputational risks are there? What impacts could result?

Are there pan-corporate risks? What are the pockets of singular risks?

How effectively are traditional and strategic risks being managed? Is there any supporting information?

What knowledge, experience, and capability does the company have? Where are the gaps?

Companies can then develop a framework for designing a risk management architecture in order to manage both the tangible and nebulous risks facing their corporation and business activities. During the design of the Business Continuity Management Plan, companies should consider:

What capabilities are available in-house, and which must be outsourced?

What information does the board require to manage risks, and what can be delegated?

How are risk management groups to be structured, and what interfaces are required?

How can threats be mitigated? What impacts could result if a risk event occurs?

How will communications be channeled? What authorities and permissions will be sanctioned?

How will policies, plans, and systems be managed? Who takes the lead?

How will quality assurance and monitoring be conducted? What are the metrics?

How are supporting agencies managed? What agreements are in place?

During the implementation of a resulting risk management system, companies should ensure that the approach is supported at all levels and keep current with the fluid risk environment. Implementers of corporate risk management should consider:

How does the corporate board ensure that it has the information it needs? How does it monitor the group's performance?

What sensing mechanisms are in place? How are risks identified and forecast?

How are risks measured and tracked? What metrics trigger a response?

How can policies, plans, and systems be kept current? What investments or resources are required?

How does the corporate culture support and sustain the risk management approach?

How are policies shared and empowered? What training is required?

How does information technology and other resources support implementation? What infrastructures are required?

What are the cost benefits to risk management? How much capital investment and indirect costs should be apportioned?

The development of a strategic risk management approach will support individual business efforts across widespread operating theaters. By establishing a strategic appreciation for risk, companies can then better support singular project activities through a unified and mature and appropriately organized approach.

Critical Dependencies

The Business Continuity Management Plan should map out the critical dependencies that will affect the company's ability to operate under crisis conditions. Critical dependencies may also affect the safety and security of personnel—and might include the supply chain assurance of critical materials or services; the ability of the company, its vendors, partners, and clients to undertake or receive services; or any effects an emergency might have on the company's personnel.

The following areas of critical dependency are offered as sample considerations when designing a Business Continuity Management Plan:

Power and Utilities. The reliance and risk exposures that might result from the disruption to power and other utilities on which the company, its activities, or personnel might be dependent.

Supply Chain Assurance. The risk exposure and business disruptions that might occur if critical materials and supplies are delayed, damaged, or stolen—in terms of safety and security as well as business performance.

Critical Materials or Structures. The risks that might be present if critical structures, facilities, or materials are lost, damaged, or stolen—in terms of performance, liability, and physical risk natures.

Employee Confidence. The implications of a loss in employee or workforce confidence should they be exposed to risks that undermine their ability or willingness to work.

Vendor or Teammate Performance. The degree of dependence a company has upon vendors or teammates should they be affected by risks or disruptions that might not directly affect the company.

Governance. The importance of governance and social stabilities within an operating region as a holistic component of operational success and risk and security management.

Technology and Information. The risk implications and impacts should technologies be damaged, corrupted, lost, or stolen either from the company or from its clients or vendors.

The examples provided are in no means exhaustive and demonstrate only some of the generic dependencies that can curb, disrupt, or stop safe and effective business operations—either directly or as a secondary effect resulting from a crisis.

Tactical Risk Evaluations

The Business Continuity Management Plan should also seek to map the common traditional risks faced by the company within different operating environments. Risks are fluid and can change rapidly due to unforeseen circumstances. However, by structuring a risk evaluation framework, the company can better place its business interests and operations into an understandable context. Risk evaluations are complex and subjective assessments, and clear and consistent matrixes for evaluating impact and probabilities are required.

By conducting such evaluations, companies can more clearly identify where their greatest risks may lie, as well as where finite resources should be focused in order to mitigate postulated threats to personnel, facilities, operations, and business interests. Risk evaluations can be conducted at a strategic level to gain a macro perspective of where challenges may lie, but should also be conducted at a local perspective, as the risk landscape within a country may differ significantly from region to region, from city to city, and in some instances from neighborhood to neighborhood. The company may also wish to consider the following points when mapping and assessing risks:

Hard and Soft Targets. Is the company an easy target compared to similar businesses or operations within the region, or are hostile groups more likely to achieve success focusing on less protected companies?

Common or Unique. Are certain risks common within a particular environment, or would they be considered unique or unusual if they were to occur?

Incentives and Objectives. What are the incentives and objectives of hostile individuals or groups? What are they trying to achieve, and how might they best achieve their goals?

Capabilities and Trends. What are the realistic capabilities of hostile groups—do they have the knowledge, technology, and funding to be successful, or are they unable to launch sophisticated attacks? Do any trends support this analysis, or suggest future risks?

Mitigation Reliability. What mitigation measures have been created to deal with risks against the company or its personnel? What gaps remain, and how effective are the