National Security: LC-39A and Beyond...

As SpaceX launched two U.S. NASA Astronauts into orbit on Saturday from LC-39A, many of us were joyful.  We are experiencing the outcomes from a long journey back to true collaboration, between government agencies and the private sector industrial complex.

The new problem-sets ahead of us and the continuous ability for dual-use technologies to span both the government sector and the commerial markets will be challenging.  One thing is certain.

We will persevere in this "Infinite Game" and the U.S. will utilize the best and the brightest methods of innovation to achieve our ambitions for space travel ahead.  Our imagination will carry us far beyond any horizon we can visualize, especially in creating more effective public-private partnerships.

How might a "Moonshot and Beyond" way of thinking across America, accelerate us towards a new future state?  What will we do to utilize the way our brightest minds think and do almost everything different today?

The combination of decades of experience with "Baby Boomers" integrating with the ingenuity and "Will Do" aspirations of our new Generations that are just getting their wings, is our real opportunity.

The opportunity to forge substantial break throughs in engineering, software development and a variety of autonomous vehicles.  The opportunity to develop expendable sensors and low cost tools, to continuously protect our nation.  The chance to put a man on Mars and beyond.

Legacy platforms of the past, that have kept us from a true technological revolution, must finally go to the grave.  Our National Security and livelihood now depends on it.

Open minds and investment capital in the hands of the right organizations, will propel us into a future we all know is possible.  Academia fusion with venture mind-sets builds the stage for innovation.  Yet what real-world problems from government and industry can be solved?

The emerging use-cases are vast and requires only our continuous imagination...

Memorial Day 2020: Understand | Decide | Act...

Walking through Section 60 at Arlington National Cemetery on Memorial Day weekend is a stark reminder of the Operational Risk Management challenges we have faced these past 19+ years.  One example can be found in the budget at the Pentagon, on how to defeat the IED.

Billions of dollars are devoted to the strategies and tactics to keep U.S. "boots on the ground" on foreign lands from becoming KIA, an amputee or another invisible wound such as Traumatic Brain Injury or Post Traumatic Stress.

Regardless of the dollars devoted, many grave markers in Section 60 have birth dates in the 1980's and 1990's.  Standing there remembering Neil, a tear rolled down a cheek and the wind quickly blew it away...

"Memorial Day is a United States federal holiday which occurs every year on the final Monday of May.^[1] Memorial Day is a day of remembering the men and women who died while serving in the United States Armed Forces.^[2] Formerly known as Decoration Day, it originated after the American Civil War to commemorate the Union and Confederate soldiers who died in the Civil War. By the 20th century, Memorial Day had been extended to honor all Americans who have died while in the military service^[3]."

If you are currently in the military we will thank you for your courage of service on Veterans Day, as we have before.  This day however, is for those in the U.S. forces who have died while serving.

Simultaneously, we must thank all of the other "Operational Risk Management" subject matter experts.  The "Quiet Professionals" who operate everyday in the shadows.  We hope that their decisions will continue to be the right ones.  They live each day with the burden of managing risk decisions, that could send another U.S. patriot on their way to Section 60 or a remembrance "Star" on the wall at Langley.

Whether you are a Mother, Father, Brother, Sister, Family or Friend, this Federal Holiday is your day of memorial to your loved one(s).

Some would say that our country is currently at a degree of War.  Even though there is no official written declaration, that has been written and published to the world.

Yet, these three words, in this order, and in that continuous "Chain," means everything to those who have served and will serve our United States. 

    > Understand.

    > Decide.

    > Act.

Until the day, that all our military and all of our true "First Responders" decide, that America is no longer worth fighting for, these three words will consume them.

Thank you for being there...

ORM: Your Life Could Depend On It...

"In America, we celebrate the virtues of the quiet hero--the modest man who does this duty without complaint or expectation of praise; the man who listens closely for the call of his country, and when she calls, he answers without reservation, not for fame or reward, but for love."  John McCain - This I Believe

Is it better to be smart, than lucky?  Be prepared: know your limits, know your surroundings and be safe. Your life and your team depends on it.

Thinking through the risks you will take on your next mission, in business and personally, can sometimes provide new insights and learning for a more positive future.

When was the last time you and your team, worked through all of the potential hazards or risks to a particular project? Are you just operating on luck?

Deliberate Operational Risk Management (ORM) uses a verified process, that can be applied in many day to day scenarios.

Whether you are in the Board Room, the Conference Room, the Locker Room or the Ready Room, you have to think ahead about your intended mission and plan for all contingencies.

In general, these are the key steps to the ORM process:

• Identify hazards:  Conduct an operational and preliminary hazard analysis.
• Assess hazards:  Determine the degree of risk in terms of severity and probability.
• Make risk decisions.
• Develop controls for the hazard to reduce the risk while determining residual risk. Once the controls are in place, make the right decision to determine whether the risk is acceptable for the benefit.
• Implement controls:  If the benefit of the mission is worth the risk, apply the controls to the lowest risk level.
• Supervise:  The decision maker should enforce the controls set and remain alert for changes.

Anticipate the risks and hazards. Prepare for the possible. Prevent the inevitable.  Share relevant stories.

"The most sobering story came from the next person in our circle, who told us about a kayaking trip he took on his 21st birthday. Again, the notice was short, and he didn’t give himself time to prepare.

The river got choppy shortly after he and his friends began their adventure, and his kayak flipped. Rolling over in a kayak is a common occurrence, but he was not adequately trained to recover. After three failed attempts to right himself, he reached for the pull cord to get out of his kayak.

The pull cord was nowhere to be found. In his haste to prepare for the trip, he had tucked the cord inside the rubber skirt of his kayak.

“At the time, I thought, ‘that’s it, I’m dead,’” he said.  He had been submerged for about 45 seconds.

He changed his mind a few seconds later and tore frantically at the kayak’s skirt to free himself. After struggling for several more seconds, he pulled himself out and swam to safety."

And maybe even more important, relive those times and events where it all came apart and you were in danger of missing the deadline, losing the game, or risking injury or worse.

That is when you truely realize, that "Operational Risk Management" (ORM) is something that has to become almost second nature.

Your life and your colleague to the left or right of you, could depend on it...

Mother's Day 2020: Are you a Daughter or Son?

Every year when "Mother's Day" approaches in May, our thoughts for her, are ever more present.

Mother's Day is just not another special holiday designed by a greeting card company or a florist.  It is also a day of reflection.  It is a day to say thank you.  It is a day of wonder, that is different for each one of us.

If and when you are having that baby and you are now a Mother for the first time, you understand.

You have experienced even more, what that truly means.  You begin to learn what it was really like for your own Mother to raise you, teach you, forgive you and love you.

Most likely, in the first few minutes after a baby is born, you as a Mother start to realize the miracle of life itself.  You may one minute be totally in love and then minutes later totally in fear.

When you think about your own Mother and your life so far, you realize that you are part of her.  You may have some of the same looks or color of eyes and you are so much more.

Think about it.  What is it about you, that makes you like your Mother, yet she didn't really teach you, it's just innate?

One thing is certain.  You alone have the ability to become who you really want to be.  No matter what or how your Mother taught you or treated you growing up.

Guess what.  If you are reading this now.  You are enough.  If you are a Son or a Daughter, your life is completely up to you.  Who you are becoming and who you will be in life, is enough.

One more thing to remember.  Your Mother's love for you, will always be there.  Even after she is gone.

Love you Mom...

OS!M's: Where is Your Courage Today?

Fear is a paralyzing condition. What sometimes can paralyze some people, often motivates others. Think about it. What are you afraid of?

When was the last time you felt so paralyzed with fear that you either couldn't move or it pumped you up so much that the adrenaline took over and made you do things that you never thought were possible.

"Where is your courage today? Hiding out for the day it seems safe? You are going to be waiting a long time. There is no such time or space where it is safe. In the board room or on your battle field, the world is looking for leaders and people with courage. Often times the answer is action, regardless of the threat. This in itself is a sign to show your foe that you are aware of the threat and will not only respond, but retaliate.

It takes courage to pursue the unpopular agenda. Whether it is to save lives, save investors, or save precious physical or digital assets, the game is the same. Those who decide to do nothing in the face of an obvious threat have nothing but paralysis. Those who decide to do something dig deep to find the purpose and justification for their actions. Once you find courage, it's very hard to turn the other way. Paralysis becomes so foreign that whenever you feel even a little unresponsive, you compensate the other direction almost by instinct.

If you spend enough time around courageous people it starts to rub off on you. If you still don't have the bug, then you must not be surrounding yourself with those who can take fear by storm. What are you afraid of?"

As Steve Farber would say, you need some more OS!M's....

Once you have enough of these to know that you won't freeze, then you are well on your way to really making a difference on this rock.

If you are not there yet, then now is a good time to start speeding up your OS!M's.

FIRST Responders: Our New Age of Learning...

“Vulnerability is the birthplace of innovation, creativity and change.”
― Brene Brown

What will we learn during this COVID-19 crisis?  How did we learn as a result of the incident known as 9/11?

Our vulnerability this time, is far beyond scanning luggage and the new processes for ID check or travel analysis.  Brene Brown has been trying to educate us, in so many important ways.

In all our years of an "All Hazards" Homeland risk management philosophy, what have we learned?  How will we Assess, Prepare, Respond and Recover even better, from this point forward?

What have you discovered about your organizations ability to adapt, innovate, create and change during this first quarter of 2020?  Will you even survive?

One key item may have revealed itself in your experience so far.  How would you improve your organization, when it comes to "Incident Response"?

One truth is, that our individuals who have a "C" in their title acronym, (CEO, CSO, CIO, CTO, CISO, CMO, CRO) have been challenged in new ways.  These same leaders have not trained enough, or long enough in this past decade.  Complacency is now becoming apparent again.

Our leadership skills have all been exposed to the vulnerabilites of people, processes, systems and external events.  We have been caught off guard on a spectrum of challenging global incidents just these past 24 months.  A crisis spectrum that spans our physical world.  Also to our invisible virtual digital world.

Our growing "Incident Response Spectrum" is wide and vast.  It still requires specialized skills and knowledge to address the kind of change, that will now increasingly be required, in Fortune 500 Global Companies, Mid-Market INC 500 emerging businesses and especially, our Small-Medium Businesses (SMB).

How will we continuously Adapt, Create and Change from this point forward?

You almost could have predicted, how well our cities and our local municipal governments would fare in the COVID-19 crisis?  An invisible threat vector.  How?

Look at just one example.  How well have our cities and Critical Infrastructure organizations performed during their "Incident Response" from the dozens of Ransomware Attacks?  Digital malware, that has plagued our cities these past few years.

Ask Baltimore, MD about their particular learning curve, on what they have learned since discovering their own vulnerabilities.  How they discovered the real value. of effective Incident Response.

Look at another emerging example.  How well have our U.S. companies been exercising their "Incident Response" plans with disruptions to our Supply Chains?  Issues with the availability of critical equipment and commodities, that previously would never have thought to be so vital to our ongoing response?

America.  This new era going forward, is going to be about our innovation age all over again.  It will be all about creativity.  And it will be much more about dramatic change.

Most of all, it will be about finding grace.  About our compassion.  You see, we are Americans.  Our endurance and our leadership, is inherent to our people and all of the U.S. organizations, that will rise up to meet this crisis and others in our future.

So what?

Our Incident Response and Security Teams will be learning even more now.  Our organizations will be "Up Skilling" or "Skilling Up," with new found tools, processes and policies.

Our supply chains will become even more resilient.  Our Critical Infrastructure and essential services will be gearing up for the "W" curve of recovery.

So what will you be doing to innovate and create a new mechanism to make us even better?

How will you do it with grace and compassion while working towards collaboration with others, instead of just being competitive?

Our American tragedy, will not just be about how many people have died.  This alone is enough.

Yet, it will be about our FIRST Responders.

This new spectrum of FIRST Responders, is so much wider than you ever realized.  Who is a FIRST Responder in your organization?  In your entire community.

The skills and knowledge of our FIRST Responders from this point foward, must improve, will expand and we will do this all together.

This next paradigm, is about Communication, Cooperation and ongoing Collaborative Education.

Will you join us...

Single Points of Failure: Interdependencies Unknown...

Organizations such as WashingtonDCFIRST exist in our Nations Capital to address the need for a coalition of private sector companies and people to work on being proactive, not reactive.

"Defend Forward."

This requires leadership to focus on the critical interdependencies you share with your large corporate neighbor down the street or around the corner.

Do you both share the same Central Office from Verizon? Do you have the same pumping station for DC Water? Do you have a shared sub-station for power from Pepco?

If you do, then you both know some of your Single-Points-of-Failure.

While you may never be able to establish walls, or fences high enough and virtual ICS locked gates to totally protect your single-points-of-failure, you can create an architecture that deters attacks and detects changes.

And if you do have an alert or alarm go off, then you must investigate the incident no matter how insignificant it may be. Those organizations who believe that they are not in the bulls eye of some worthy adversary, should pay attention:

• Shape behavior  - The United States must work with allies and partners to promote responsible behavior in cyberspace. 
• Deny benefits  - The United States must deny benefits to adversaries who have long exploited cyberspace to their advantage, to American disadvantage, and at little cost to themselves. This new approach requires securing critical networks in collaboration with the private sector to promote national resilience and increase the security of the cyber ecosystem.
• Impose costs  - The United States must maintain the capability, capacity, and credibility needed to retaliate against actors who target America in and through cyberspace.

Your competitors and even your neighbors realize that this game, is not always about eliminating threats to your own corporate assets. It's about making sure that the attackers choose a much more vulnerable target than your own...

Experiential Learning on Easter: 2020 & Beyond...

There you are.  We have been waiting for you.  You are a miracle and we have so much to learn from you...

As you experience your day, look around.  Look up.  Our world is an amazing place to live and to experience life.  Yet full of so many challenges, along the way.

How will you learn about all of the parts of life that are invisible?   You will only know more about it by experiencing it and by encountering all of the heart break and hopefully all of the joy.

You see, learning something new and experiential learning, is how you will grow each day.  This is not in inches or feet, this growth is exponential and infinite.

Have you read the book about how to ride a bicycle?

Don't worry.  You won't have to, as your Mother, or Father or even your GrandPa or GrandMa, will be there to guide you.  They will be there to help you balance.  They will help you learn, by experiencing it together.

You will first find out, that it is not easy.  That you will encounter falls and some tears.  You will feel the pain.  Yet at some point in your experiential journey, one day, you will feel the joy.  You will feel the freedom.  The wind in your face.

Those who have a birth day in 2020, are joining a world that is under seige right now.  They will not remember.  Yet it is all of our love and our faith together, that will allow you to endure.

We all will be watching you grow.  Taller yes and we wonder who you really are.  Who you will eventually become.  We know that you will be a curious one.  You will seek new knowledge and learn new skills, just as your closest teachers have experienced with you.

Yet always remember, so much of the joy, faith and wonder of your life, will come from places you can not see...and can only feel in your heart and thoughts...until someday you get there on your own.

Godspeed on Easter Sunday 2020!

Crisis Leadership: Our Unison of Human Endeavor...

For I am about to do something new.
See, I have already begun!
Do you not see it?
Indeed, I will make a way.
In the wilderness.
Rivers in the desert.  --Isaiah 43:19

On this particular Sunday in history, look around. Who do you see?  Who is looking to you for answers?

What are you doing to anticipate?  To Prepare.  To Activate.  To Respond.

You see, our current state, is an opportunity to act.  By all of us.  In "UNISON".

If you have learned anything in these past several weeks to a month, this particular crisis has uncovered our gaps.  Our weaknesses.  Your vulnerabilities.

So what are you going to do about it?  Today, tomorrow and the day after.  To Act.  Do you not see it?

Your family and closest friends are watching.  They expect your leadership.  They want your expertise and your experience.  You have the skills and the knowledge our country needs this week.  And the next week after.

It will require your inner strength.  It will test all that you have trained for.  It will be the actions you take soon, that will ensure our future.

What will you do this week to make a difference?  With your family, with your neighbor, with your colleague, with your organization, with your country...

You can see it in your minds eye.  Remember, there are others who will be there to support you, to assist you in your "Human Endeavor".

Our resilience is so much greater than you realize.  We are listening...we have the courage to act!

24: Lessons in Resilience...

Flashback to 2007.  It's going to be a busy day for Jack Bauer this season. Last night's episode of 24 ends like this:

9:58 A.M.
Numair completes work on the suitcase nuke. One of the guards sees the TAC teams and gunfire erupts. Ray ducks to the ground. Amid the shooting, Numair detonates the nuclear device.

From where he is, Jack can see the mushroom cloud in the sky.

The White House team is in shock. Wayne orders Karen to put the entire military at the disposal of the Los Angeles response teams.

9:59 A.M.
As CTU watches the video in horror, Milo alerts them to a warning from the FBI. An Arabic phrase was overheard at one of the detention centers. Nadia translates it: “five visitors.” There are four more nuclear weapons out there.

The WMD scenario is now being played out by focusing on the infamous "Suitcase Nuke" that has been talked about for years. The question remains how the remaining part of Jack's day will go now that he will be searching for four more devices during what is certain to be mass panic. And whether the incident is of the sudden magnitude of this 24 thriller or the sudden onset of a contagious virus, our hospitals and healthcare system will be immediately challenged.

Continuity of Operations and Contingency Planning is starting to get the funding it requires in the healthcare systems across the globe. We can only hope that it comes long before the first wave of Pandemic or the radioactive WMD event.

What would happen if you woke up at 2 a.m. with chest pains but the area hospitals were overwhelmed because of a COVID-19 outbreak? What would happen if you couldn’t get lifesaving blood work because the labs couldn’t process the results or your health insurance provider couldn’t process the authorization? What would happen if you were scheduled for surgery but the computer network containing your patient records was down due to a computer virus?

These are just a few of the scenarios that keep business continuity planners at hospitals and healthcare organizations across the country up at night and focused on the task at hand. Healthcare is the one thing you hope you will never need, but when the time comes, the availability of healthcare in this country is often taken for granted. Business continuity planning (BCP) professionals in the healthcare industry want to keep it that way.

This is a clear example of where the Critical Infrastructure sector we call Healthcare and it's sister the First Responders / Emergency Services Sector, is still behind in funding and increasing it's resilience to sudden disaster. Public - Private partnerships are working with diligence on an "All Hazards" mindset to help address the lack of preparedness in many of our metro regions.

It's vital to really understand the mission for not just the healthcare sector, but the government, law enforcement and first responders combined:

MISSION: To provide a forum that fosters communication and cooperation between industry and government security, law enforcement and emergency responders at the federal, state, local and tribal level to protect America's citizen's and critical assets.

It's been said that we could never be totally prepared as there will always be some degree of residual risk in any prudent planning or testing exercise. The only real truth is that working towards the worldview of increased Business Resilience creates a different perspective.

Business Resilience
Even resolving these shortfalls and misunderstandings really is only part of the picture when seeking to create true resilience – we really must focus more broadly than on the technology and the facilities. Business resilience should be our goal. IBM has articulated its concept of business resilience as:

“The ability of an organisation’s business operations to rapidly adapt and respond to internal or external dynamic changes – opportunities, demands, disruptions or threats – and continue operations with limited impact to the business.”

The paradigm shift from a defensive posture to an offensive posture is the first leap of faith. To see the opportunities and upside not just the cost of protection and overhead. Mitigating Operational Risks, thinking through all possible contingencies and creating new strategies for the future success scenario is what this mindset is all about.

I wonder what's going through Jack Bauer's head right now? Defense... I don't think so.

Human Factors: Pandemic Fear & Y2K...

"Most people have the will to win, few have the will to prepare to win."  --Bobby Knight

Organizations are running around looking for quick answers to COVID-19 "Pandemic Planning."

Is this the next SARS? Many agree that it is not the same threat and more are convinced that specific losses to personnel, will have significant long-term cascading effects on other operational risk factors.

And yet there is a standard and lessons learned waiting for any organization who wants to increase it's overall "Business Resilience", regardless of the origin of the "Virus."

Organizations who are now waving the panic flag for increased resources and funding to address the future of our current "Pandemic," should look closely at the behavior that drove them to the brink of another bug problem two decades ago, known as Y2K.

A world wide panic, millions of dollars invested in redesigning software applications and then at the apex of the millenium, a huge sigh of relief.

And in the after action reporting and for the next two years, an Internet revolution was born. Our applications were reengineered and the next generation of innovation was born, for companies to serve customers in ways they had never dreamed.  We can do it all over again.

A strategic investment today in "Pandemic Planning" and Continuity of Operations, will have the long-term benefit of creating a stronger, resilient and more survivable organization. In fact, this time the emphasis will not be so "Tech-Centric" but "People-Centric".

Who is "Core" to our business? What processes are necessary to run the business and who are the people we really need to support those processes?  Now is the time to truly understand your "Team of Teams".

Everytime you run a new preparedness exercise or test your contingencies, you are learning how and what, are the fundamental items that have been overlooked.

The real "Human Factors" are in play this time. That makes it more unpredictable and more unreliable.

More importantly, perhaps it becomes necessary to put your employees through some of the most stressful training they have ever had to endure. What if?

Imagine telling your "Core," they can't leave work for the next month, instead of ordering them to work remotely.

What people do you have on your team, that will give up that much time and isolation from their close family members? The fact is, you won't know, until you see them under fire.

You won't know, if all of the training and preparedness has made any difference, until you see your people perform under the most demanding and emotionally challenging circumstances.

You better start now. And you should be prepared to see some of the most shocking human behaviors you have ever witnessed.

The people you never expected to be heroes will be. The most brave and macho people on the outside are often the first to run and hide.

Fear is a phenomenon that enables some and paralyzes others. Your job is to find out how it affects those you choose to lead your organization, during the multiple waves of "Pandemic Attacks" just over the horizon...

Operationalizing Defend Forward: A Paradigm Shift...

In light of the recent and overwhelming global state-of-affairs, it is now timely to enter into a dialogue on operationalizing "Defend Forward".

Is it possible to increase your organizational, personal or nation state resiliency to the active threats you can't yet see, hear, or feel?  You understand that it depends on what the adversary actually is and what medium or environment it is operating in.  So here are just two examples that are difficult to see and detect with only the naked eye:

1. Ransomware
2. Coronavirus

Number One is a threat operating in a virtual environment of vast Information Technology infrastructure propagated across the Internet by adversaries who seek to infest a host and produce a potential outcome as the threat infects vulnerable computing assets.

Number Two is a threat operating in a physical environment of vast geographical and human-based populations propagated across our planet Earth by biological adversaries who seek to infest a host and produce a potential outcome as the threat infects vulnerable human assets.

Fortunately Number One does not have a "Zoonotic" origin.

"Defend Forward", entails the proactive observing, pursuing, and countering of adversary operations and imposing costs in day-to-day competition to disrupt and defeat ongoing malicious adversary infectious campaigns, deter future campaigns, and reinforce favorable international norms of behavior, using all the instruments of national power." --Dr. Erica Borghard

Think about your particular 1) organizational, 2) technological and 3) human-based ecosystems.

How much have you invested in operationalizing a "Defend Forward" strategy for all three?

You see, in the year 2020 and beyond you will need to be thinking differently.  You will need to be investing in a cohesive and strategically balanced Operational Risk Management (ORM) paradigm.

Yes, paradigm.  For those of you reading this, who do not understand the true definition, look it up.

What is currently going on in "Cyberspace" is not that much different than what is going on in our current "Healthcarespace".

Yet one is commanded by human behavior and the other one is commanded by human behavior.

Godspeed Mother Earth!

Scenario Vs. Resource Planning: All Hazards...

"Strive not to be a success, but rather to be of value" --Albert Einstein

This article by Saul Midler on Scenario Planning Vs. Resource Planning recently caught our eye and for a good reason. The link between Corporate Risk Management and Operational Risk Management is Business Continuity Management. Brilliant!

More importantly as he indicates:

"The danger of undertaking an operational risk assessment before the BIA / RDA activity is that a business case may be built to remediate the biggest operational risk without realising that impact or the consequence is low. This is essentially defining a solution before identifying a problem.

Think about 9/11 where 320 companies FAILED to return to business, 2800 workers DIED and 135,000 workers lost their jobs. By contrast a number of organizations did recover and continued operations. These include:

• Cantor Fitzgerald who lost 658 staff and resumed operations two days later;
• Marsh & McLennan with 3,200 staff over 8 floors;
• Morgan Stanley with 3,500 staff over 17 floors;
• NY Port Authority with 2,000 staff over 23 floors.

New school thinking saved these organizations. No one could possibly have thought of the scenario that two airplanes could cause structural integrity failure of both World Trade Centre skyscrapers resulting in the collapse and complete destruction of the precinct. The businesses that did survive did so because they adopted a resource loss philosophy that included office facilities, technology systems and, of course, staff.

While the scenario of airplanes being used as weapons of mass destruction is not a new concept for planning purposes, (in fact it was hypothesized long before 9/11) the fact is that organizations today have adopted an "All-Hazards" mind set. As a result of the new worldview, "Business Continuity Management" as previously mentioned, has provided a much needed conduit between Corporate Risk and Ops Risk."

What does this "All-Hazards" mentality mean for the cure to unplanned disruptions or untested scenarios? It means that you move to the proactive side of the line and away from the reactive mode that so many organizations are still coping with. The old "It will never happen" to us syndrome.

Global 500 public organizations, small private businesses and non-governmental organizations have true stories and cases that are considered a security risk crisis. Confronting a crisis in one organization will be completely different at another, based upon the type of organization, number of employees, geographic locations and their senior executive process for dealing with a significant disrupting event.

The following question was asked at “Company A” and the top answers were:

What are the top five incidents/events that could cause a significant crisis within your organization?

• Fire or Flood
• Violent weather/damage to facility
• Workplace violence
• Industrial accident
• Terrorism 

"When the question was asked a different way, to a different group at the same company, the results were even more telling:"

What are five incidents/events that have caused your organization significant crisis in the last three years?

• Counterfeit products or major disruption in the supply chain
• Alleged ethics violation of Foreign Corrupt Pracctices Act (FCPA)
• Geopolitical unrest in key overseas markets
• Extended loss of electricity at a manufacturing plant
• Data Breach/intellectual property theft by a nation state

The company is a multinational manufacturer of communications components. Senior executives charged with a “Duty to Care” in todays global enterprise, require new thinking, enhanced skills and relevant solutions to improve crisis leadership.

What is your current readiness factor for the potential of environmental or natural disaster, supply chain disruption, economic espionage, ethics scandal, data breach, employee kidnapping, sabotage, terrorism, workplace violence and other legal risks?

Throughout the enterprise the functions of physical security, information security, legal and financial liability have all become specialized and these same security risk professionals, have become subjected to the potential for a blindside incident.

For example, the HR recruiter is more focused on the security risk of hiring a person with a criminal record of violence and substance abuse problems.

The Chief Security Officer (CSO) is more focused on the physical and information security of facilities and the Chief Operating Officer (COO) may be more focused on daily operations and securing the resilience of the supply chain.

How will you provide your senior executives with the knowledge, skills and strategic solutions that enables global enterprise business resilience for years to come?  Leadership of Security Risk Professionals...

Workplace Violence: Maximize Dialogue and Anonymity...

Proactive vs. Reactive. The argument goes on in many organizational departments when it comes to budgeting for preparedness vs. response. How do you detect the next employee "Gone Rogue" as they say?

What is the early warning indicator that tells you that you need to train employees on the detection of "abnormal behavior" or out of context business transactions?

If we are to continue the path of handling disruptions in business and emergencies with personnel with the idea of mitigating the risk post incident, then increase the number in the budget for the line items under outside counsel, litigation and insurance.

However, the idea that a corresponding increase in the line items in the budget under the heading compliance, security and training will decrease risks prior to an incident, is prudent thinking.

In the battle for finite dollars to be spent across the enterprise in all categories that have significant risks, there will always be an argument on where the investment of resources will have the biggest payoff or return on investment.

"Yet, how will you ever know whether this is the year of the earthquake, the cyclone or the employee who becomes hostile or potentially lethal?"

The point is, you will never know, for certain...

This is why an investment in enterprise risk management dialogue requires that every department and each process, factor in additional costs for mitigating risks.

Each person who is closest to the work being done knows where the greatest potential is for a loss event. The place that is most vulnerable.

Just ask the HR specialist what employee they have hired over the past year represents the most lethal threat to the company. Just ask the IT Security Engineer what system or application is on the verge of a melt down and they can tell you.

Or just ask the executive who they think the middle manager is that is getting ready to move to the competition, with all the latest Intellectual Property (IP) secrets. Most likely, they can tell you.

Being proactive in managing operational risks sometimes means that you have to ask your employees risk related questions on a continuous basis. You have to document and collect the answers and feedback so that you can detect trends in behavior or potential eruptions in behavior.

Finally, you need to figure out how to do all of this using new tools and processes, to protect privacy and anonymity. Get started!

Analytical Decisions: Navigating to a Trusted Future...

"For those of us who are decision makers, these are huge problems. With growing velocity, we are losing our ability to trust digital information to be factual, accurate, reliable, and authentic. But we also are losing something far more important—trust in the quality of our own decisions and our confidence in those we trust to make good decisions"  Jeffrey Ritter-Achieving Digital Trust

Think about all the Trust Decisions that you made this morning.  This week.  This month.

Countless decisions to act upon your experience, your current information or the live scenario unfolding almost instantly in front of you.  "Trust Decisions".

Is this a discipline or process that you can truly learn and improve upon?  The question is, do you think it is important enough to learn more and to devote precious time to making this a priority in your life?

Where are you in your particular "Life Cycle" right now?  At the beginning, near the end or somewhere in between?  Yet it is never to early, to study and learn more about the science of Trust.

SpaceX is looking to raise around $250 million in new funding according to a new report from CNBC’s Michael Sheetz. The additional cash would bring SpaceX’s total valuation to around $36 billion, according to CNBC’s sources — an increase of more than $2.5 billion versus its most recently reported valuation.

The rocket launch company founded and run by Elon Musk is no stranger to raising large sums of money — it added $1.33 billion during 2019 (from three separate rounds). In total, the company has raised more than $3 billion in funding to date — but the scale of its ambitions provides a clear explanation of why the company has sought so much capital.

Building trust with a new person, new organization, new project, new government or new ecosystem requires a sound and thoughtful strategy.  A strategic approach to reaching your vision, completing the transaction and achieving your outcome.

Trust is the affirmative output of a disciplined, analytical decision process that measures and scores the suitability of the next actions taken by you, your team, your business, or your community. Page 49 - Achieving Digital Trust - Jeffrey Ritter

Godspeed on your particular TrustDecisions ahead.  Onward!

Open-Source Intel: Future Preemption...

Flashback fourteen years ago...

The methods of Intelligence gathering and sharing for the 17+ agencies that comprise the DNI is evolving to new Web 2.0 capabilities. In fact, they are putting these new tools to work to break down the silo's and connect the dots faster than the embedded and legacy systems have been capable of in the past.

Intelligence heads wanted to try to find some new answers to this problem. So the C.I.A. set up a competition, later taken over by the D.N.I., called the Galileo Awards: any employee at any intelligence agency could submit an essay describing a new idea to improve information sharing, and the best ones would win a prize. The first essay selected was by Calvin Andrus, chief technology officer of the Center for Mission Innovation at the C.I.A. In his essay, “The Wiki and the Blog: Toward a Complex Adaptive Intelligence Community,” Andrus posed a deceptively simple question: How did the Internet become so useful in helping people find information?

Yet even those who have implemented the use of new Web 2.0 collaboration and social networking to try and break through those typical information sharing barriers have another problem. Getting everyone to make a seachange and cultural shift to the use of these new tools and processes. The question is that even if you get everyone to use it and there is not anything "Secret" for fear of it ever being known by the wrong person, will it work? Thomas Fingar, the patrician head of analysis for the D.N.I.:

Fingar says yes, for an interesting reason: top-secret information is becoming less useful than it used to be. “The intelligence business was initially, if not inherently, about secrets — running risks and expending a lot of money to acquire secrets,” he said, with the idea that “if you limit how many people see it, it will be more secure, and you will be able to get more of it. But that’s now appropriate for a small and shrinking percentage of information.” The time is past for analysts to act like “monastic scholars in a cave someplace,” he added, laboring for weeks or months in isolation to produce a report.

Fingar says that more value can be generated by analysts sharing bits of “open source” information — the nonclassified material in the broad world, like foreign newspapers, newsletters and blogs. It used to be that on-the-ground spies were the only ones who knew what was going on in a foreign country. But now the average citizen sitting in her living room can peer into the debates, news and lives of people in Iran. “If you want to know what the terrorists’ long-term plans are, the best thing is to read their propaganda — the stuff out there on the Internet,” the W.M.D. analyst told me. “I mean, it’s not secret. They’re telling us.”

The amount of self-publishing on "Blogs" and "Wiki" applications is here to stay and now it is just a matter of having the right analysts using the correct tools. The point is that new search technologies and all of the "bots" and "crawlers" can try and keep up with the new content, but it is not likely. Intelligence analysis will continue to take far more grey matter than we have people trained and able to do so. This fact alone, should bring us back to square one. There is no such possibility as 100% security. Prevention and Preemption are both elusive goals and will be our "Holy Grail" for some time to come.

Today’s spies exist in an age of constant information exchange, in which everyday citizens swap news, dial up satellite pictures of their houses and collaborate on distant Web sites with strangers. As John Arquilla tells Clive Thompson a contributing writer to the New York Times, if the spies do not join the rest of the world, they risk growing to resemble the rigid, unchanging bureaucracy that they once confronted during the cold war. “Fifteen years ago we were fighting the Soviet Union,” he said. “Who knew it would be replicated today in the intelligence community?”

Business Risk: Grow or Die...

In a previous issue of Corporate Board Member magazine in a PwC survey, the question is asked:

Has your board discussed what to do if the company is hit by a major Crisis?

• No - 51%
• Yes - 41%
• Not Sure - 8%

What is the definition of "Crisis" in the minds eye of the Board of Directors today?

n. pl. cri·ses (-sz)

1. A crucial or decisive point or situation; a turning point.

2. An unstable condition, as in political, social, or economic affairs, involving an impending abrupt or decisive change.

3. A sudden change in the course of a disease or fever, toward either improvement or deterioration.

4. An emotionally stressful event or traumatic change in a person's life.

5. A point in a story or drama when a conflict reaches its highest tension and must be resolved.

How can these numbers be correct? Why don't these results make sense?

It does seem almost impossible that just over half of those surveyed said, that they have not discussed what their company would do in the event of a crisis.

In light of the latest corporate governance and catastrophic events any board member who would answer no, is either not attending the meetings or is so new to the board, that they haven't been part of the conversations yet.

The Pwc survey of 1,103 directors who responded have illustrated many of the risk management issues that are taking up much of the shareholders time.

They also indicate where they wish they were spending more time, as 59% hoped they could be doing more "Strategic Planning."

Is there a correlation between those who have not been part of discussions of crisis management and the wish to focus more on strategy?  We hope there is.

Our experience is that corporate management and the board need a 3rd party facilitating the mechanisms for change and towards the "Big Picture" of the future.

If management sees the board as an overzealous parent and not working on behalf of the shareholders the tension increases.

Once the board and corporate management have found a "strategic facilitator" to guide them towards a model of "Enterprise Architecture" everything becomes crystal clear.

The factions now see the blueprint for change and the path to implement the strategy and the tactics to achieve it.

The Importance Of Leadership In Uncertain Times

In an age of global unrest, strength and courage at the helm are more important than ever. As a director, it's your job to ensure your CEO has what it takes.

At the end of the day, the deliverable is to continually grow and whenever that significant crisis or "Breakpoint" occurs, the engineered resilience of the business enables its survival and the next phase of growth to begin...

Travel Risk: Adaptive Survival Instruction...

Travel risk to corporate executives is on the rise. Even if you are not an executive who can afford the services of personal body guards and armored cars, there are some prudent ways to mitigate the risk of traveling to the global hot spots.

The Mission

Travel safety is becoming more of a main stream issue with savvy Operational Risk Managment (ORM) leaders. The fact is, most of these so called travel safety courses are being taught from only one side of the equation.

"In a world of global commerce, CSOs are often tasked with building their company's corporate travel safety programs. The job calls for a proactive approach to educate employees about precautions they can take to stay safe, whether they're the CEOs of multibillion-dollar conglomerates who fly on company jets that land on secured tarmacs or rank-and-file staff riding in commercial airline coach."

The Take-Away

Business has to be done in some of the most dangerous places on the planet, even when it comes to being exposed to kidnapping, terrorism and corrupt governments. Our advice is to make sure your instructor transfers skills to people on "how" to detect, deter and defend against the attackers. Not just the "What to do".

The how is not easy to teach unless you have been there and experienced it. One of the reasons why most CEO's are "Age Experienced" is that it takes time to acquire enough valid leadership lessons.

It does not happen in a week or a month or even a few years. Learning the skills to survive in strange cities, cultures and countries requires instruction by age experienced and "Quiet Professionals". Much of this instruction is about training people to be "Adaptive."

Personnel threat management is a prudent risk mitigation solution. This combination is one key strategy to reduce the operational risks associated with key personnel in your organization.

Individuals whose occupations place them at risk may include people with access to valuable proprietary information or holders of high level security clearances, the wealthy and those responsible for their safety.

Comprehensive "Adaptive Survival Instruction" for international business executives, is a primary mission for OPS Risk leadership, because it saves lives.

Old to New: Accelerating the Velocity of Decision Advantage...

Trust Decisions in the innovation environment requires entrepreneurs, who are willing to risk their reputation and to build new cognitive bridges.

The vulnerability of solving new found problem-sets outside of your organizational safe zone, with a new set of people, is just the beginning.

As your new TEAM works side-by-side, through hours, weeks and months of tame dialogue, heated arguments and little sleep, the level of cultural trust quickly rises.

It does not matter if this occurs in a new business unit within the private sector, or out on the frontier in an austere world at the Forward Operating Base (FOB).

This place on the edge was created to be a strategic unit with tactical objectives.  Call it a "Skunkworks", an "Outpost" or some other clever xxWERX name.  It really does not matter.  Yet everyone knows that the core mission is still relatively unknown.

The reward becomes, that someone of significant rank, or a vital customer, who recognizes that the new idea, new prototype or new invention is truely a game changer.  An outlier.  A true "Decision Advantage".

Walking across that virtual bridge from the "Old" to the "New," from the normal to the abnormal or from the design of a market copy cat to a disruption market leader, is what this initiative is really all about.

So how do you do it?  In order to set the stage, you might start here:

Col. John Cogbill, chief of staff of the Joint Special Operations Command, discusses how to leverage Silicon Valley's "secret sauce" to encourage the MacGyvers in your ranks.

The methods and the process are constantly evolving.  Yet the core thinking and the integration of the various cultures that synchronize together, in a proven innovation journey is the real mission.

A few months before Col. Cogbill's podcast, the Council on Foreign Relations (CFR) published the 120+ page Independent Task Force Report #77, "Innovation and National Security - Keeping Our Edge.

What happens when you put a Task Force together with a combination of Special Operations Commanders, Venture Capitalists, Private Sector Leaders and Management Consultants?

"A new U.S. innovation strategy should be based on four pillars: funding, talent, technology adoption, and technology alliances and ecosystems. Action is required over the next five years." (TFR Innovation Strategy P. 17).

You will have to read the report in it's entirety to form your own thoughts and conclusions on what needs to happen in your own local ecosystem of innovation.

Yet, suffice it to say, the people on the "Task Force" understand the real challenges.  They know first hand the National Security threats.  They realize we all have to accelerate and simultaneously collaborate.

So how might you build some bridges this month from the "Old" to the "New"?

Why will your mission create a foundation to increase the velocity of your TrustDecisions to gain Decision Advantage...

Corporate Social Responsibility: An Era for New Leadership...

Here are a few of this mornings top news stories. It seems that Operational Risks have us surrounded and yet many organizations are still in denial that anything will impact them directly:

Libyan Oil Exports Blocked Ahead of Berlin Peace Conference
By Salma El Wardany
January 18, 2020, 4:46 AM PST Updated on January 18, 2020, 7:16 AM PST

World News
China reports new virus cases, raising concern globally before key holiday
Published Sat, Jan 18 20206:34 AM EST

Why Iran plane disaster protests mark most serious test yet
By Amir Azimi BBC Persian service 18 January 2020

U.S. Government Confirms Critical Browser Zero-Day Security Warning For Windows Users
Davey Winder Senior Contributor Cybersecurity

How long will this naivete go on in your company, city, state or country?  Maybe it's time for more Corporate Social Responsibility and a renewed focus on training new leaders.

As the finger pointing continues and the documents of the day are debated, there is one strategy that has been with us for many years, and many have forgotten.  It is called Corporate Social Responsibility (CSR). CSR is gaining new emphasis around the globe:

Mary Parker Follett's (1869-1933) thoughts on democracy, society and management have inspired business leaders in fits and starts during the 20th century and they deserve to be revisited as we move forward in this century.

What is the important role that businesses play in society?  She gave serious attention to what we now call corporate social responsibility, a topic of great interest in today's boardrooms and business schools.

One thing is certain. All of the employees and citizens on the planet want leadership and courage from the ordinary person next door.

The citizen soldier who is willing and capable of leading the people around them in the face of a sudden catastrophic crisis.

In the midst of an important ethical decision. In the moment of the day, are "Leaders Born, Not Made"?  What would Mary Parker Follet and Laura Tyson have to say:

"Leaders can be taught, and should be keen on sharpening their skills as rigorously as a surgeon. In 1933, she put it plainly: managers must realise that they, as professional[s], are assuming grave responsibilities, that they are taking part in one of the large functions of society, a part which, I believe, only trained and disciplined [business people] can hope to take with success."

As the Operational Risks continue to surround our corporate enterprises, it's imperative we look at where we are spending our money and deploying our resources.

What would happen to our preparedness, readiness and recovery capabilities if we just reallocated 5% of the corporate marketing budget to the Risk Management budget?

If we did, then we might find ourselves with fewer calls to the Court house, State house and the White House.

Davos 2020: Culture in a Complex, Interdependent World...

"No institution or individual alone can address the economic, environmental, social and technological challenges of a complex, interdependent world"...

In 9 days, leaders on the planet Earth will be converging on Davos, Switzerland for the World Economic Forum Annual Meeting. What will this years pressing themes tell us, about what is on the minds of Presidents, CEOs, Managing Directors, Chief Information Security Officers, Chief Risk Officers, Generals, Secretarys and Activists?

Davos 2020 will be focused on the following four themes:

__1. How to address the urgent climate and environmental challenges that are harming our ecology and economy.

__2. How to transform industries to achieve more sustainable and inclusive business models as new political, economic and societal priorities change trade and consumption patterns.

__3. How to govern the technologies driving the Fourth Industrial Revolution so they benefit business and society while minimizing their risks to them.

__4. How to adapt to the demographic, social and technological trends reshaping education, employment and entrepreneurship.

If you only could pick one of these four very important issues facing our global societies, which would you feel you have the most ability to impact, with your own organization?

Got it?  Now, think about how your organization will change, in order to make a greater difference in that particular theme you have selected.

The culture in your organization is going to be the difference between your ability to succeed, or to be soon facing failure.  As a leader, how will you continuously adapt to your human culture, just as Davos is addressing our interdependent world?

How might you change the way you are "Visible" to your stakeholders?  Why are you the one they "Trust", to achieve organizational objectives?

You see, you are not as visible as you think you are.  You are not as trusted as you think you are.

Your organization needs you, to step out and really show them who you really are.  They need to see, hear and read about the collective mission.  Their respective purpose, for being present today.

Culture.  As a leader, it is all on you...

ORM: Pervasive Risk Across Disciplines...

What is the origin of the "Operational Risk Management" (ORM) discipline? Was it derived from the work within the financial services industry from the Basel II initiatives?

The definitions and the actual work towards creating standards of conduct and rule-based design has been evolving for the past few decades.

Operational Risk and the approach to risk that is not otherwise considered to be market or credit risk, is one mind set. The other mind set considers the hazards associated with the threat to our valuable assets.

Either point of view depends on the environment that you operate in and the risks associated with that environment.

To give a quick example, here are a few views into Operational Risk in the United States:

"It didn’t take long—the first attack on a U.S. government website hit on Saturday, a day after the killing of Qassem Suleimani in Baghdad. The fact there was an attack is not a surprise—speculation has been rife. And the style of the attack is consistent with the nature of the primary cyber threat we now face. Hackers claiming to be linked to Iran targeted a low-level domain—the website of the Federal Depository Library Program—defacing its home page, echoing Teheran’s threats of vengeance alongside imagery of President Trump, Ayatollah Khamenei and the Iranian flag" Forbes

"Boeing will still burn more than $1 billion a month even after halting 737 Max production, according to J.P. Morgan.  Boeing’s decision to stop suspend production of the troubled aircraft was made in light of months of cash-draining groundings worldwide, but the company’s internal overhead and labor expenses will remain and will increase cash burn, analyst Seth Seifman wrote to clients."  CNBC

These examples encompass a U.S. government agency and a private sector U.S.-based global aerospace company.  Both are operational risk scenarios that could contribute to losses that will also impact the reputation of the entity involved.

That aspect alone, could be the major factor in why Operational Risk Management is such a growing discipline in our 2020 global landscape.

Some of the earliest origins of the Operational Risk concerns come from the military. The U.S. Navy is one of the branches who has embraced it fully:

• Purpose. To establish policy, guidelines, procedures, and responsibilities per reference (a), standardize the operational risk management (ORM) process across the Navy, and establish the ORM training continuum.
• Scope. This instruction applies to all Navy activities, commands, personnel, and contractors under the direct supervision of government personnel.
• Discussion. Risk is inherent in all tasks, training, missions, operations, and in personal activities no matter how routine. The most common cause of task degradation or mission failure is human error, specifically the inability to consistently manage risk. ORM reduces or offsets risks by systematically identifying hazards and assessing and controlling the associated risks allowing decisions to be made that weigh risks against mission or task benefits. As professionals, Navy personnel are responsible for managing risk in all tasks while leaders at all levels are responsible for ensuring proper procedures are in place and that appropriate resources are available for their personnel to perform assigned tasks. The Navy vision is to develop an environment in which every officer, enlisted, or civilian person is trained and motivated to personally manage risk in everything they do.

If only our major business entities would would fully encompass the following steps with all employees and processes then more lives would be saved, corporate assets would be protected and the enterprise would be ever more resilient:

(1) Identify the hazards;

(2) Assess the hazards;

(3) Make risk decisions;

(4) Implement controls; and

(5) Supervise.

Yet the losses and the potential for loss continues across the organizations who are well equipped to make Operational Risk Management a part of every person and operating divisions daily mind set:

The places change, the numbers change, but the choice of weapon remains the same. In the United States, people who want to kill a lot of other people most often do it with guns.

The number of U.S. mass shootings depends on how you count

Public mass shootings account for a tiny fraction of the country’s gun deaths, but they are uniquely terrifying because they occur without warning in the most mundane places. Most of the victims are chosen not for what they have done but simply for where they happen to be.

There is no universally accepted definition of a public mass shooting, and this piece defines it narrowly. It looks at the 172 shootings in which four or more people were killed by a lone shooter (two shooters in a few cases). It does not include shootings tied to robberies that went awry, and it does not include domestic shootings that took place exclusively in private homes. A broader definition would yield much higher numbers.

Whether it is on the deck of an aircraft carrier or within any organizations business facility, operational risk is pervasive. It is up to you and your organization to begin to make a difference...

Year 2020: Navigating to your "Why"...

The Year 2020 is upon us and a new decade is at our doorstep.  Are you looking at how much you have accomplished this past year or reflecting on all the goals you were unable to achieve?

What is your "Why"?

The world around us is rapidly changing and we must recognize when we are deveating from our intended course.  All of us have our daily risk challenges with work, friends, spouses and kids or family, yet how effective are you at consistently navigating back on your true heading?

This will make all the difference in your life.

The difference between achieving your dreams and finding yourself in a different or unintended place, without vital key resources.

Where are you on your life map, at the end of this year and this decade?

How many books or articles of research have you read and studied this year that provides you even more insight, into your particular mission, craft, or trade or skill-set?

Guess what?  You are not as smart as you think you are.  You might not have as much context and experience as your parent, your teacher, your coach, your co-worker, or your partner.

On the dawn of a new decade known as 2020, maybe it is time for you to truly dedicate yourself to the science of your mission.  Your particular "Why."

Only then, will you begin to achieve the discipline you require each day, to navigate your true course.

Your life...wishing you a wonderful "New Decade"!

Christmas 2019: Look Around and Look Up...

"Let the true light of Christmas shine bright through you. You have received the greatest gift of all."

As your unique holiday season surrounds you this week, what will you be saying to yourself?  Why are you so joyful?  Who will you be celebrating with, as we sing together?

This time, of each year, we have the opportunity to reflect.  To Remember.  To Give.  To Pray.

As you look around the room at some gathering point, focus on why we all traveled to come together.  Are you a Mother or Father, a Son or Daughter, Brother or Sister, an Aunt or Uncle, a Grandfather or Grandmother?  Or just a Friend.

Think about where your life has taken you so far.  Yet wonder, about the future and what is next for you.

"Who among mortal men are you, good friend? Since never before have I seen you in the fighting where men win glory, yet now you have come striding far out in front of all others in your great heart..." --Homer, The Iliad

As you transcend through the thoughts and emotions of your journey so far, "Look Up"...

Godspeed!

The Risk of A Blueprint For Action: Heroes Yet Undiscovered...

Thomas P.M. Barnett's book was sitting there on the bookcase shelf last night gathering dust from 2006 and this is the next step in the "The Pentagon's New Map."

What an inspiring exercise in "Strategic Foresight" and a journey it was, well over a decade ago.  And yet now the journey begins again, to find our "heroes yet undiscovered".

What the author means is this.  Along the path through an uncertain and new worldview, we are going to encounter people who are hero's in the implementation of the bold concepts described in this insightful book.

Mr. Barnett gives us a few descriptions of who to look out for back then, and evermore so today:

• The four-star military police general:
• Japan's first combat casualty since World war II:
• The "Martin Luther King" of Islamic Europe:
• The "Serpico" who blows the lid off human rights abuses in the global war on terrorism:
• China's "JFK"
• India's "Bill Gates":
• The first female leader of an Arab state:

His unreasonable ideas that sound at first to be far fetched are by design, to make us think deeper about the impact of globalization and the future.  In fact, they are upon us today.

"All things being equal, no one chooses the informal economy over the formal economy. Because the efficiency and security of the latter are undeniably a better deal." Page 262

"In the end, the Gap (non-core countries outside the G-20) is plagued not so much by bad governments as by simply the lack of good ones. Our goal in shrinking the Gap must entail, therefore, increasing the number of good governments there, governments that extend the rule of law, develop the human capital of all citizens (and especially that of young females), and ---most specifically---foster entrepreneurial opportunities by recognizing property rights and expanding contract case law." Page 262

The real risk of "A Blueprint For Action" is that our world leaders in 2020 still have not converged on this remarkable book and discussed it over their next dinner together.

If they do, then we will be on our way to a trusted future worth creating...

Operational Continuity: Top Ten...

As your Board of Directors Meeting agenda is prepared for your next conference call, Operational Continuity should be near the top of the list of priorities.

"Californian utility giant Pacific Gas and Electric (PG&E) has agreed a $13.5bn (£10.2bn) settlement with victims of wildfires in the state.  The company's equipment has been linked to several blazes including the deadliest and most destructive wildfire in state history, 2018's Camp Fire."

The risk of a significant business disruption is increasing and shareholders are increasingly asking for additional oversight by boards, to make sure that executive management is on top of Operational Risk Management (ORM) issues.

Catastrophic losses may be caused by natural disasters such as hurricanes, earthquakes, flooding, drought, tornados, fires and winter storms or man-made events.

Workplace Violence and/or Terrorist acts are tragic and complicated, taking an awful toll in human lives and resulting in insurance claims that run into the millions or billions of dollars and, often, litigation.

Here is a top ten list for your board to consider. If you can answer "Yes" to these items then you are well on your way to a high level of "Operational Continuity" in your organization:

__1. The Board of Directors reviews and approves company-wide contingency plans annually.

__2. Formal documented guidelines, policies, and procedures exist for the development and maintenance of business Continuity/Disaster Recovery, Emergency Response (evacuation and life safety) and Crisis Management plans (public relations and communications).

__3. An Operational Risk Assessment that categorizes potential threats (internal and external) has been performed on all corporate facilities for both information technology and work areas.

__4. There is a current (updated annually) Business Impact Analysis that determines recovery time objectives (the maximum tolerable time to recover critical business functions) and existing resources supporting each function.

__5. Recovery strategies exist for the resumption of critical business processes and support services.

__6. The Operational Continuity Plan and the recovery efforts are driven by the business requirements of the Business Impact Analysis.

__7. A Gap Analysis has been performed to identify the differences between Business Impact Analysis (business requirements) and the current environment.

__8. Business recovery strategies have been developed for all essential business functions.

__9. Manual workarounds exists for processes that could be completed in the absence of automated systems.

__10. Business Continuity and Disaster Recovery plans are exercised and tested bi-annually.

If you answered "No" or "Don't Know" to any of these ten, then your organization is at risk to a myriad of threats including shareholder legal actions...

Enterprise Resilience: Compete or Die...

Enterprise Resilience is the road to competitiveness. It is the global answer to many of the Chief Security Officers (CSO) who have faced the troublesome battle of selling more "Fear and Doubt" to the CEO and Board of Directors.

The 34th Overseas Security Advisory Council event was held the week before Thanksgiving as usual.  Yet flashback to when Deborah Wince-Smith stood up on the stage at the 21st Annual Security Briefing at OSAC on November 16th, 2006, when her words were music to our ears:

"It is undeniable that the world has gotten more risky. Businesses now function in a global economy characterized by increasing uncertainty, complexity, connectivity and speed. Managing this rapidly changing risk landscape is an emerging competitiveness challenge—a challenge that demands resilience: the capability to survive, adapt, evolve and grow in the face of change. The Council on Competitiveness is proud to offer this report, which promotes a strategy of resilience for both the public and private sectors a strategy with clear benefits for our companies’ competitiveness and our nation’s homeland security."

On the doorstep of 2020, globalization, technological complexity, interdependence, and speed of digital information are fundamentally changing the kind of risks and competitive challenges that companies— and countries—face.

Failure, whether by attack or accident, can spread quickly and cascade across networks, borders and societies.

Increasingly, disruptions can come from unforeseen directions with unanticipated effects. Global information and transportation networks create interdependencies that magnify the impact of individual incidents. These new types of risk, demand new methods of Risk Management.

Was this a way for the Chief Security Officers of the Fortune 500 to finally shift their thinking from protection to something less macho? How could "Resilience" become a platform for a mind set shift to justify new funding?

After all, now we aren't trying to scare people into the "Low Probability - High Impact" incidents anymore and focusing in on the high probability incidents, that may have enough impact to cause a significant business disruption.

What are the incidents and areas of risk that insurance won't touch these days? If the insurance companies can write the policy to give you peace of mind, then is this necessarily an area that you can ignore, because you have transfered the risk to someone else?  Maybe not.

Being agile, ready and capable of a quick recovery is what competitiveness is all about, on the field, on stage or around the table in the Board Room. Working towards control and protection while fear builds in the back of your mind makes you stiff, depletes your energy and creates doubt.

And when you are operating a business or standing on the tee of your first sudden death hole on any PGA weekend, you better have resilience.

The business equivalent to Homeland Security and Critical Infrastructure Protection is Operational Risk Management (ORM)—a domain that many executives see as the most important emerging area of risk for their firms. Increasingly, failure to plan for operational resilience can have “bet the firm” results.

Back in 2000, the Meta Group (now owned by Gartner) did a study on the cost of "An hour of computer downtime by industry group". These numbers are now 19 years old:

INDUSTRY SECTOR (Millions)

• Energy - $2.8
• Telecommunications - $2.0
• Manufacturing - $1.6
• Financial Institutions - $1.4
• Information Technology - $1.3
• Insurance - $1.2
• Retail - $1.1
• Pharmaceuticals - $1.0
• Banking - $0.996

We all know that it costs lot of money to have any systems downtime, that's why so many dollars have been invested in Disaster Recovery (DRP) and other Business Continuity Planning (BCP).

Yet is this the kind of resilience that is going to make you more competitive, to seize more opportunities? The economics of resilience are more than investing for the likely or unlikely information systems incident (ransomware) that will attack your organization tomorrow.

The threat of Tort Liability and the loss of reputation is top of mind these days with every major global company executive. The threat is real and increasing at a faster rate than many other real operational risks to the enterprise. Litigation from regulators, class actions and competitors has given the term "Legal Risk" new emphasis and meaning.

Once corporate management understands the need for a "Resilience" mentality in place of a "Protection" mental state, a new perspective is found. Investing in the vitality, agility and competitive capabilities of the organization sounds and is more positive.

It alleviates the fear of doom and gloom and inspires new found innovation. The future of your organizations longevity and in its adaptability, can be achieved with a new perspective.

Compete or die.

"Enabling Global Enterprise Business Resilience" is just the beginning...

Trust Decisions: Future Outcomes in an Unpredictable World...

What new information have you processed or new insight have you gained today, that will be necessary for your next Trust Decision?

The little screens and nano-processors in the palm of our hand, have taken over our abilities to think clearly.  To ask the right questions.  To process information, using our own biological and cognitive capabilities.

The ability to make your next decision to act, will depend on your level of trust in the information you are now processing.  How are your recieving this new information and what is the source?  Is it trusted?

The speed and quality of "Trust Decisions" in your life will make all the difference in your ability to prosper or not.  How much do you trust the sources of your daily information?  How much does it distract you, from your primary mission?

Are you starting a new education or training class?  Are you starting a new job?  Are others following you?  Are you going on a first date?  Are you planning a wedding?  Are you moving to a new city?  Are you going to be a Mother or Father in the next nine months?  It is an unpredictable world.

What happens to your behavior, when you receive this trustworthy information?  You act on that information, whether it is positive in your plans or creates a new and challenging problem-set to be solved.

"The Internet, the embrace of cyberspace, and the ubiquitous presence of digital information in human society are making immense, positive contributions. In the simplest actions of our daily lives and in the most important decisions we make in business, in government, in education, and in choosing between war and peace, we have become reliant upon the availability and presence of digital information. As our reliance speeds into dependency and, in turn, addiction, there are two profound shifts occurring that are shaping the direction of this war on trust." --Jeffrey Ritter-Achieving Digital Trust

The little screen in the palm of your hand, does not make information more trustworthy.  It makes information more readily accessible and in greater volumes.  It assumes you are pressed for time and therefore, you do not have the patience or the ability to ask timely questions about it's origin, or authenticity to make your next "Trust Decision".

As you sit there and read this, look around you.  What do you see?  How do you feel?  These are the outcomes of your own history of "Trust Decisions".

Why did you decide to get on that plane with this particular airline today?  Why did you decide to make the appointment to travel to your destination, to meet with the person(s) you are traveling to visit?  Why are you going to spend your valuable time, listening to what they have to say, what they will show you and tell you?

Your future continuously depends on your next "Trust Decisions."  What is the information you are receiving and from where?  Will you trust this information?  You see, your next behaviors and actions will take place as a result of how your brain and your trust calculations have processed this information.

So what?

• Every transaction creating wealth first requires an affirmative decision to trust.
• Building trust creates new wealth. Sustaining trust creates recurring wealth.
• Achieving trust superior to your competition achieves market dominance.
• Leadership rises (or falls) based on trust (or the absence of trust).  --Jeffrey Ritter-Achieving Digital Trust

Your decisions to trust some thing or some one, is far more a science and a calculation than you may have ever known before.

It is time to begin thinking differently about the science of "Trust" itself.

The time has come for you to spend more time with the leaders and the sources of trustworthy information and behavior.

It is time for you to evaluate your wealth in this world.  Whether that wealth is tangible or intangible.  Whether it is measured in love, knowledge, experiences or in currency.

The calculus of your own "TrustDecisions" will continue to be the difference...