June 2010
| 
|
Need Your Own Copy of The Risk Communicator?
|
|
Write for Us
|
| Have you seen a story you would
like to see included in The Risk Communicator? Do you have a research project you want to share with your colleagues? If so, please contact
the newsletter staff at newsletter@sarma.org. |
Legal Matters
|
Copyright 2010 SARMA All Rights Reserved
Privacy Policy
The views expressed in The Risk Communicator reflect the views of their authors, and do not neccesarily reflect the views of SARMA, the US Government or the employers or clients of the contributors.
|
|
|
President's Corner
|
| Dear Fellow SARMA Members,
Welcome to the June issue of The Risk Communicator! At least for me, it's hard to believe we are halfway through 2010 -- but while it has been a busy year already for SARMA, there is still much more to come.
For those of you who were able to join us at George Mason University (GMU) on June 17, you were witness to an enlightening discussion among public and private sector leaders on the subject of resilience and how it is understood and practiced within these communities. However, the differing viewpoints that emerged also underscored the need for further dialogue aimed at identifying how public and private sector interests can be collectively served through the identification of common ground.
The timing of this discussion could not be better. As many of you are aware, the Department of Homeland Security recently began a holistic effort to revisit how it looks at and applies risk as a decision-support tool across the homeland security enterprise. This initiative began with a policy memorandum from Secretary Janet Napolitano, released in late May, establishing the department's policy for integrated risk management. Key to this new approach is the view that risk can be best managed by a collective approach that unifies efforts among all homeland security partners. This policy memorandum is soon to be followed by a DHS directive defining how the new policy will be implemented within the Department. Likewise, DHS also recently announced the adoption of final standards for the voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep). PS-Prep was implemented to address a key recommendation of the 9/11 Commission that called for the creation of a program to improve private sector disaster preparedness. Adoption of three standards, developed respectively by ASIS International, the British Standards Institution and the National Fire Protection Association, follows a lengthy public comment period and paves the way for DHS to implement a voluntary private sector certification program founded on recognized best practices.
In SARMA's view, the convergence of security risk management interests is an essential means of achieving a higher level of national resilience. Thus, with the climate seemingly right for a concerted effort to further align public and private sector investments in resilience, I am pleased to announce that SARMA intends to place this issue at the forefront of its efforts for the remainder of the year. This focused initiative will include a dedicated track at the Fourth Annual Conference on Security Analysis and Risk Management, now scheduled to be held October 5-7 on the Arlington Campus of GMU, and the development of a policy paper detailing the Association's thoughts on how this convergence may be best achieved.
If these efforts sound important and interesting to you, then I encourage you to become involved. Whether it's providing critical financial support to enable SARMA's efforts to facilitate this discussion, serving on our Conference Committee and working to make the annual conference a success, or engaging with the Policy Committee to help in drafting SARMA's recommendations for achieving a heightened state of national resiliency, there are many ways to contribute. Please consider how you could become a part of this exciting and timely discussion. For more information, please contact us at info@sarma.org.
My best, Kerry
Kerry L. Thomas President
Security Analysis and Risk Management Association
|
News
| | DHS Announces PS-Prep Standards
Department of Homeland Security Secretary Janet Napolitano this month announced the adoption of final standards for the voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep) -- a major milestone in DHS' implementation of a program recommended by the 9/11 Commission to improve private sector preparedness for disasters and emergencies.
"Private organizations across the country -- from businesses to universities to non-profit organizations -- have a vital role to play in bolstering our disaster preparedness and response capabilities," said Secretary Napolitano. "These new standards will provide our private sector partners with the tools they need to enhance the readiness and resiliency of our nation."
PS-Prep is a partnership between DHS and the private sector that enables private entities to receive emergency preparedness certification from a DHS accreditation system created in coordination with the private sector.
The standards -- developed by the National Fire Protection Association, the British Standards Institution and ASIS International -- were first published for public comment in the Federal Register in October 2009. The final standards were adopted following a series of regional public meetings and the incorporation of public comments.
|
Announcement
| | Call for Speakers: 4th Annual SARMA Conference
SARMA is seeking proposals from individuals or groups who wish to share their insights with the profession at our 4th Annual Conference on Security Analysis and Risk Management.
The conference will be held in partnership with the George Mason University School of Law's Center for Infrastructure Protection and Homeland Security (CIP/HS) in Arlington VA, starting on Tuesday, October 5, 2010 at 8:30 am and running through Thursday, October 7, 2010 at 12:00 pm.
Our major focus this year will be on the convergence of the resilience and risk management disciplines. During the two-and-a-half-day conference, over 50 presenters and panelists will provide fresh perspectives on current policy trends and initiatives, advances in risk assessment and management techniques and best practices, and efforts to advance the professional discipline of security analysis and risk management.
Special consideration will be given to proposals that examine one or more of the following areas:
- Organizational/Enterprise Resilience and Resilience Standards
- Government Risk Management Planning and Policy: National, State and Local Issues
- Threat Assessment and Multi-Hazard Risk: Knowing Your Adversary
- Security Risk Assessment and Management Methodologies
- Public Health and Mass Casualty Care
- Transnational Terrorism
- Cyber Security
What is the deadline for abstracts/papers? July 15 for abstracts; August 15 for full papers or slide presentations. What is the length limit for the abstracts?Minimum 250 words; maximum 500 words. Where should the application be submitted?Email to conference@sarma.org. What is the desired format for the application?
Word document (or use the form provided). No more than two pages total, to contain name, presentation title, presentation abstract, an explanation of how conference attendees will benefit from the presentation, plus a biography and contact details. What are your presentation and panel discussion durations this year?We will have shorter presentations than last year: 45 minutes each rather than one hour. Panel duration will be one hour and 15 minutes (1.5 hrs maximum) with a moderator and three to four panelists on each panel, including time for a question-and-answer period. ---------------------------------------------------- Don't miss your opportunity to present at this exceptional forum for collaboration, information-sharing and networking, and to meet and interact with a wide array of practitioners from federal, state and local governments, private industry and academia. Please remember to submit your application to conference@sarma.org no later than July 15th.
|
Events
| | Resilience and Risk Management Conference
On June 17, SARMA and the George Mason University Center for Infrastructure Protection and Homeland Security co-hosted a conference on Achieving Enterprise Resilience. What follows is a summary of the keynote addresses and panel discussions.
Morning Keynote: The View From DHS Todd M. Keil, Assistant Secretary for Infrastructure Protection at DHS, was the day's first keynote speaker. After emphasizing that, by and large, the nation's private and public institutions understand the importance of resilience, he called for a new national effort that "pays special attention to where our critical infrastructure is -- regional and local communities."
Turning to the question of what the risk management community can do to help achieve this goal, Mr. Keil stressed the importance of developing "better decision support tools" that create "defensible analysis" for decision makers at all levels. He noted a number of important new efforts to push support out to state and local partners, including a new Regional Resiliency Assessment Program to engage and inform regional partners about the interdependencies of critical infrastructure; applied research in modeling, simulation, and analysis; and an "Infrastructure Protection in a Box" program for fusion centers to support local homeland security efforts.
To succeed, these programs need support from the risk management and analysis community, Mr. Keil explained. Resource constraints at the state and local level make it all the more important that they have the tools they need to invest wisely. "These partners need tools that facilitate the decision-making process without mandating unrealistic or expensive information requirements," he said. Mr. Keil called attendees to action by linking their expertise to dealing with the challenges that the Nation faces. "We need to commit to talking about, analyzing, and preparing for the risks that have the power to incapacitate the nation: a cyber 9/11, an earthquake along the New Madrid Seismic Zone, serious supply chain disruptions, and the list goes on. You play an essential role in this new goal, because risk analysis must be at the foundation of our decision making," he concluded.
Panel 1: Government Perspectives Moderator: John Paczkowski, Vice President for Emergency Management, ICF International Panelists: Robert Kolasky, Assistant Director, Risk Governance and Support Division, Office of Risk Management and Analysis, National Protection & Programs Directorate, DHS; Thomas DiNanno, President, Republic Consulting Group
Mr. Kolasky opened the discussion by emphasizing that DHS understands that "homeland security is risk management," noting that Secretary Napolitano recently signed a policy statement for Integrated Risk Management (IRM). The policy statement establishes IRM as a fundamental concept that will guide the department's risk management efforts across the homeland security enterprise. This policy, according to Kolasky, squarely embeds risk management into the overall workings of the department and sets the executive mandate to build a program to improve the enterprise-wide approach. He noted that the Office of Risk Management and Analysis (RMA) at DHS has responsibility to administer and promote the implementation of the Secretary's policy by working with the department's Risk Steering Committee, which is made up of all the major components of DHS. As such, RMA has begun a benchmarking study of how enterprise risk management is applied at large organizations in both the public and private sectors. This study has led to a number of observations, including: that executive-level support for risk management policies is essential; that there needs to remain significant flexibility and variations in risk management standards; and that risk management must always be tied to strategic planning. Mr. Kolasky offered four areas of needed improvement from the risk management community. First, he stressed the importance of "bridging the gap" between analysts and decision-makers, such that the producers of risk information can share it effectively with the consumers of the information. Second, Mr. Kolasky noted that risk analysts must develop an appreciation of simple analysis for complicated problems. The simpler the answer, the more likely it is to be transparent and defensible, and thus the easier it will be for the decision-maker to adopt. Third, risk analysts must better appreciate how their efforts impact the bottom line, because decision-makers tend to be most responsive to arguments that demonstrate achievable results. Finally, Mr. Kolasky called for the development of incentives and standards of excellence to build the human capital needed to support integrated risk management for homeland security. Mr. DiNanno, continuing on the theme of needed improvements in the risk management community, said he had noticed a disconnect between those responsible for large regional infrastructure and those in Washington responsible for overseeing risk management programs. Having left the government for the private sector, Mr. DiNanno said he was sometimes stunned to hear security managers at the local or corporate level say they had never heard the names of certain critical federal risk management officers.
Mr. DiNanno also pointed to the convergence of multiple regulatory schemes as an area of ongoing confusion and misunderstanding at the state and local level. Fixing the problem will not be easy because it requires multiple willing partners, he said, but not doing so undermines DHS's credibility as a single agency. Mr. DiNanno also suggested the creation of a trade association for the critical infrastructure protection community to help resolve these issues and advance the community's interests.
Mr. Paczkowski began his remarks by noting that since September 11, the homeland security community has been steadily "climbing the maturity curve" on the application of risk management concepts. While risk management principles were initially absent from security planning, he said, they are gradually becoming essential elements of more structured and deliberate planning for homeland security and preparedness. He said that state emergency management directors and homeland security advisors are increasingly grappling with how best to assess and manage risk as they work through their own planning processes, the identification of needed capabilities, and the allocation of limited state and local funding and federal grant assistance. "They are looking for assistance with strategic level risk assessment."
Mr. Paczkowski believes that the regional catastrophic planning efforts now under way by FEMA's Response and Recovery Directorate hold considerable promise for focusing on the "vital few" infrastructures and community systems that require concentrated risk mitigation and resilience campaigns by government and the private sector. He said that a better business case can be made for risk-based investment when more specific consequences and cascading interdependencies can be identified through the deliberate planning process. He suggested that FEMA and the DHS Office of Infrastructure Protection collaborate on how best to leverage the regional catastrophic planning program to advance national resilience aims.
Mid-morning Keynote: The View From FEMA Corey Gruber, Assistant Deputy Administrator for FEMA's National Preparedness Directorate, gave the mid-morning keynote address. He focused his talk on ways that risk management analysts can improve communication with decision-makers who must make choices within a constrained political environment. Policy suggestions must be "understandable and communicable," he said, and they must be tailored to helping the decision-maker achieve his own goals. Because political appointees often stay in their offices for only a few years, detailing short-term achievable benchmarks can make a critical difference, Mr. Gruber said.
Panel II: Private-Sector Perspectives, Standards Development & Case Studies Moderator: Marc H. Siegel, Commissioner, Global Standards Initiative, ASIS International Panelists: Peter Gallant, Chief, Corporate Security, World Bank Group; Alex McLellan, Principal Analyst, Homeland Security Studies and Analysis Institute
Dr. Siegel began his remarks by noting that the emergence of resilience as a key concept is being driven by a growing recognition that dividing up homeland security issues into different silos of security management, crisis management, continuity management and recovery management doesn't work and is unnecessarily expensive.
The development and growth of international standards is a major part of this effort, said Dr. Siegel, and he warned conference participants that they have to be engaged in the discussion or risk not being heard at all. Time after time, he said, Americans fail to show up and participate in international discussions about risk management and business continuity standards. Standards change with time, he said, and it's important that Americans be at the table to share their perspectives on effectiveness and utility.
Mr. Gallant opened his discussion by talking about how the World Bank is unique in that it doesn't have to abide by any national or state-level standards. Nevertheless, the World Bank answers to an international board of directors and, like other major organizations, requires a risk management strategy. Although the World Bank had previously had a small risk management program, after September 11 it expanded dramatically, Mr. Gallant said.
In 2001, the World Bank began an analytical process to start identifying risks and potential methods of mitigation. But implementing the program was difficult because of a concern that the organization would simply react to international events and fail to focus in on its own unique requirements. Instead, the World Bank took a "slow paced approach to building a resilient program based on the criticality of the business needs of the Bank," Mr. Gallant said.
Key to the World Bank's initiative was to first distinguish between critical and non-critical business functions. For instance, the Bank operates major international bond trading and portfolio management programs, many of which implicate international political risk challenges in addition to concerns about physical or cyber destruction or disruption. "We looked at our program from a holistic approach and triaged it down to two business lines that we're looking to support," Mr. Gallant said. The World Bank also decided to de-emphasize physical protection of its facilities in lieu of developing redundancy programs to continue operations in a crisis.
Mr. McLellan began his talk by noting that while there are multiple definitions of resilience that have not yet been resolved, the concept has been around for a long time as "a holistic approach to the management of disruptive events."
Looking at communities in coastal Louisiana, Mr. McLellan noted that while in some parishes no oil from the Deepwater Horizon had reached the shores, the local economy was already reeling because the oil and fishing economies have come to a standstill. Yet these areas typically demonstrate "inherent resilience" in that they are challenged every year by meaningful weather events. Whether they will now demonstrate "adaptive resilience" in the face of this new challenge presents an important topic for further research, Mr. McLellan said.
|
| Analysis | | Resilience and Public-Private Partnership in the Gulf
by Philip J. Palin The ongoing rush of oil into the Gulf of Mexico has created drama befitting our greatest authors and playwrights: the Gulf's people and ecology will struggle to re-establish themselves; BP might disappear as a corporate entity; President Obama is struggling to demonstrate his authority; and the can-do confidence of American culture is under significant strain. In mid-June the oil spill reached the climax of its first act. We are not sure how more this play will feature, but it promises considerable length. As the crisis approaches its second month there are three dramatic scenes worth remembering. Scene 1: On June 16, BP leadership came to the White House for a four-hour meeting. Afterwards, a $20-billion independent claims facility was announced, including $100 million for compensating indirect costs related to the spill. The president affirmed BP as "a strong and viable company and it is in all our interests that it remains so." BP's chairman claimed that the company and the government were "fully aligned in our interests in closing this well, cleaning the beaches, and caring for those affected." It was clearly a difficult, but productive deliberation. Scene 2: On June 17, BP CEO Tony Hayward came to Capitol Hill, where Energy and Commerce Committee chairman Henry Waxman accused him of "stonewalling" the committee. For seven hours Mr. Hayward participated in an increasingly common ritual of public shaming. Scene 3: On June 18, Admiral Thad Allen, the national incident commander, gave another of his regular updates. "We're also working very closely with British Petroleum," he said. "We have given them direction to increase their redundancy and capacity of their containment operations... BP laid out and we've approved where they are headed right now to bring in needed capacity... So we continue to make progress there." Elinor Ostrom, the 2009 Nobel Laureate in Economics, and others have found that participation, collaboration and deliberation are fundamental to resilience. Hayward's performance before the House Energy and Commerce Committee demonstrates the limitations of mere participation. The progress reported by Admiral Allen suggests the practical benefits of collaboration. Without several weeks of often troubled collaboration, it is entirely possible the White House deliberations would not have produced anything close to the same result. Participation by itself is never enough. BP and the US government each "participated" in developing inadequate oil spill recovery plans. Once the crisis compelled the parties to actually collaborate, weeks passed before some rough semblance of an effective and shared operational approach emerged. Both the collaborative relationship and deliberative process remain fragile in face of the lack of prior investment in collaboration and deliberation. No wonder there has been so little resiliency evident in our response to the Gulf disaster. We were not investing in it. Fortunately, resiliency is now enshrined in the recently-published National Security Strategy: "When incidents occur, we must show resilience by maintaining critical operations and functions, returning to our normal life, and learning from disasters so that their lessons can be translated into pragmatic changes when necessary. The private sector, which owns and operates most of the nation's critical infrastructure, plays a vital role in preparing for and recovering from disasters. We must, therefore, strengthen public-private partnerships..." Articulating the goal is helpful, but true resilience relies on action and authentic relationships. Meeting, greeting, exchanging PowerPoints and other documents are a start, but unless participation leads to collaboration, we are not cultivating resilience. Unless our assessments, plans, tactics and strategies are tried and tested in action -- by working together -- the meetings, regulations, filings and testimony are mostly meaningless. Looking forward from the Deepwater Horizon disaster, three specific steps should be taken to enhance resilience in the Gulf and other regions with similar challenges: 1. Oil spill response plans, required of all those awarded drilling rights by the federal government, should include a catastrophic incident annex (note: this is different from the plan's current attention to worst-case scenarios). The catastrophic incident annex should require detailed preparation for an event with a scale similar to Ixtoc I or the still emerging benchmark of Deepwater Horizon. 2. State and local stakeholders should be included in reviewing and commenting on oil spill response plans. Both public and private sector stakeholders should participate in this review and comment process. The work of the Prince William Sound Citizens' Advisory Council demonstrates the benefit and long-term effectiveness of local oversight of the most sophisticated and complex of systems. Ostrom and others have reconfirmed this time and again. 3. Federal, state, local, and private sector partners should conduct annual exercises to test and further develop oil spill response plans. Training and tabletop exercises can be part of the effort too, but annual full-scale operational exercises designed to stress -- not confirm -- the plans are the way to foster meaningful collaboration in advance of an emergency. This will also facilitate the shared deliberation that can reduce the likelihood and mitigate the consequences of an emergency. While these three specifics focus on enhancing the resilience of our drilling operations, they are context-specific examples of the broader principles of participation, collaboration and deliberation: actively involve a broad cross-section of those who are mostly likely to be most affected by any systems failure; create opportunities for a diverse set of public and private players to work together; and work together to ensure that lessons learned are identified and put into action.
Shared and authentic deliberation in advance of crisis is what generates the resilience to bounce back when the unpredictable happens. Philip J. Palin is a research fellow in the Pace University graduate program in Management for Public Safety and Homeland Security Professionals. Mr. Palin's publications include Resilience: The Grand Strategy; Threat, Vulnerability, Consequence, Risk ; and Catastrophe Preparation and Prevention . He is also a regular contributor to the Homeland Security Watch blog. |
Key Reports
|
| GAO: Aviation Security: Efforts to Validate TSA's Passenger Screening Behavior Detection Program
In a new report about TSA's Screening of Passengers by Observation Techniques (SPOT) program, the GSA notes that while the agency deployed the program "on the basis of some risk-related factors, such as threat information and airport passenger volume, it did not use a comprehensive risk assessment to guide its strategy of selectively deploying SPOT to 161 of the nation's 457 TSA-regulated airports."
View the report
CHDS: Twitter, Facebook, and Ten Red Balloons: Social Network Problem Solving and Homeland Security
Maj. Christopher Ford, a Judge Advocate with the U.S. Army, won the Naval Postgraduate School Center for Homeland Defense and Security 2010 essay contest with an extended look at using social networking to "make homeland security a more layered, networked, and resilient endeavor."
View the report
DOJ: Review of the Department's Preparation to Respond to a WMD Incident
The DOJ's inspector general reports that the agency "as a whole and components within the Department have not implemented adequate WMD response plans ... Moreover, no components other than the FBI have specific WMD operational response plans or provide training on responding to a WMD incident."
View the report
|
Jobs
|
| NMR Consulting: Senior Risk Officer
NMR Consulting is seeking candidates for a position responsible for developing and managing a risk management program in support of a large government contract involving infrastructure upgrades and enhancements at Ft. Meade, Maryland.
View the notice
NMR Consulting: Senior Risk Officer
NMR Consulting is seeking candidates for a position responsible for moving a project from Northern Virginia to the Ft. Meade, Maryland area. The successful applicant may also support efforts on other contracts.
View the notice
SRA: Security Risk Analyst Position
SRA International Inc. is seeking candidates for a security risk analyst position. The successful candidate will use their experience to plan, organize and carry out analytical studies of complex security risk management problems, as well as plan and implement potential technical or programmatic solutions to those problems.
View the notice
Analyst Position with the Federal Emergency Management Agency (FEMA)
ABS Consulting is seeking a talented professional to provide technical and management consulting services to the federal government, specifically in the area of homeland security risk analysis for grant allocation at FEMA. Education and experience with economics or a related field is a key requirement. An active security clearance is preferred.
View the notice
Corporate Security Analyst Position in Switzerland
SMR Group, an international executive search firm whose global practice is focused exclusively on professional- and executive-level corporate security positions, is seeking candidates for the position of Corporate Security Analyst, located in Switzerland. The Corporate Security Analyst will be responsible for protecting business operations and associates throughout the organization from external threats by the collection, analysis and dissemination of strategic and tactical threat assessments, and production of both analytical and intelligence products designed to support investigations and protective security operations.
View the notice
Risk Analyst Position With Centra Technology
Arlington, VA-based CENTRA Technology, Inc. is seeking talented professionals to provide technical and national security analysis for the U.S. Government, especially in the area of homeland security risk analysis. Successful candidates will perform security risk analysis; threat, vulnerability, and consequence analysis supporting risk analysis; and security risk management. They also will develop, assess, document, institutionalize, and apply risk management processes and methodologies to inform policy and programmatic decisions.
View the notice
|
|
|
|
|