Risk and mitigation

The loss of access to an office is a serious impact no matter the duration, but in most instances the reason is something like someone forgot the keys and had to go back and get them. So the duration might be in the order of one to four hours.

In the time that the office is unusable, you have obviously lost access to all the information, technology such as computers, fax, telephone and probably any incoming mail.

So weighting the severity of the impact we would probably assign a value if two or three, based on the short duration.

In looking at the likelihood of occurrence, you would look historically at the past occurrences – but this is likely to be a one or a two.

For detection, it would be a one – you will know that you cannot get access to the office.

In calculating the risk priority number we would arrive at a value between two and six, these are low numbers.

There are a number of ways of dealing with the risk, a key vault or a second key holder are probably adequate for this. So there is a cheap and easy solution to remove or mitigate the risk.

Losing access to the office for a protracted period of time can have a large impact, the cause is likely to be more significant than “someone forgot the keys”.

In this situation, it is important to have a carefully prepared plan. This is the business continuity plan. Even a relatively small business will require a plan, as they have to be able to communicate with customers and suppliers.

It is likely that any information on the systems and documentation in the office is no longer available, given the dependence on technology the lost information could include access to bank accounts and the ability to pay suppliers and staff.

The severity of this is high, probably between a seven and a ten depending on the cause.

The likelihood of occurrence is probably low, again probably a two or three.

And it is a pretty fair bet that you will know that you have lost access to the office so on the detection front a one.

Which gives a risk priority number of between ten and thirty.

In the modern world data and voice communications are essential, little can be done without them and yet we just accept that they will be there – well what happens when they are not there?

Clearly any loss of this technology is serious and is likely to be noticed quickly, but how do you quantify the risk attached to its loss. I have here two examples of problems, both experienced by myself as a user of the services.

The first was a total loss of data and voice, the building contained a computer suit and around 800 users – many of which operated in a call center environment.

The second was a loss of voice only, an organisation moving from one premises that they were planning to demolish to save costs.

In the first case new cables were being routed through an existing duct into the building, during the course of this work the existing fiber cables were severed. The ensuing bun fight between the company and the three vendors involved, required four full days to resolve the problem.

The estimated cost of the incident including staff costs was in the order of £550,000.

In the second, the supplier of the fiber services (which required a 65 day lead time) failed to schedule the relocation of voice services. This dragged on for almost 9 months and required that the building scheduled for demolition was maintained in a functional condition for all that time incurring significant costs.

The estimated cost of the incident was £300,000, relating to the costs of the old building.

The loss of data and voice communications has a significant impact, if there is a call center type environment involved then the impact is massive. There is effectively an immediate cessation of all activity, with no outgoing or incoming communication.

With this in mind, the severity would immediately be a ten due to the nature of the business.

The likelihood of occurrence is in the order of two or three, as the infrastructure can be expansive.

As for detection it is a one as it will be immediately noticed that nothing is working.

As you can see the risk priority number for this comes in between twenty and thirty, which is significant.

It is possible to minimise exposure to this risk by having multiple vendors for the service. Along with redundancy for cable routing and hardware, but this is a costly solution usually outwith the reach of smaller and medium companies.

When the data and voice communications are out for a protracted length of time, there are very serious consequences. In particular relating to staff costs and reputational damage, for example having to pay help desk staff that cannot be contacted by customers.

Data and Voice communications are a core function of any business now, from the Man and a Van who uses a mobile phone and cellular data for everything whilst on the move. All the way to the corporate head quarters of a multi national corporation, the loss of this function is catastrophic.

And yet when we assess this risk the answer is quite surprising;

The severity of the risk screams out a ten.

The likelihood of it occurring strangely is somewhere between two and three.

The detection of the problem is certain so rated at one.

Again we end up in the twenty to thirty range.

The risk is the same for the Man and a Van as it is for the multi national.

The mitigation strategy for the Man with a Van is simple enough and not very expensive, a spare mobile phone with synchronised contacts – with the alternate number communicated to the customers.

The multi national corporation may have to have a slightly different strategy, however it still revolves around infrastructure resilience and equipment redundancy.

To mitigate the above scenarios there are a number of options available, how to deal with the loss of an office – or even THE OFFICE!

If nothing else, the Covid-19 pandemic has meant that many businesses implemented remote working. This is fine if your core IT systems and applications are still available, here we are assuming possibly a Cloud based model. But what if the core infrastructure is in the office, or if a Hybrid Cloud is in operation.

Things to evaluate would be;

• What systems or applications would be lost.
• What information would be unavailable.
• Can the office staff work remotely.
• Is the WFH model suitable for my staff.
• What internal communications to use.
• What is the Customer/Supplier impact.
• Can we communicate with Customers and Suppliers.

I’m aware of one company that had to source, build, configure and ship 800 laptops at very short notice. They also had to configure Voice over IP for 800 people at short notice, this was a serious drain on available IT and Comms resource.

Prior to Covid-19 a SME could possibly have quickly relocated much of the administrative and back office function, using one of the specialist service suppliers like Regus.

As to the loss of data and voice communications, in general these services are robust – but not infallible. So you may want a premium support contract for this, but if someone cuts through a fiber cable there will still be a significant outage – possibly running to a number of days. How would you deal with the impacts, do you have alternate means of communications.

Given the nature of systems and applications, these may not be available from the office along with the data that is resident in the applications workloads.

So an alternate should be part of the mitigation strategy.