Resilience was on the agenda again in the October 2013 print issue of Professional Security. Here is what one head of security is doing about resilience.
Denis Murphy at Teesport describes security as one element of the wider resilience picture. He begins with the example of IT security. “You have to look not just at the physical security of the IT network, but that leads you on to business resilience and what is the business impact analysis of losing your gatehouse, or CCTV, or passes stop working.” Access is fundamental to a port, whether it’s bringing in or sending forth goods by road, railways, rivers or canals. It calls for resilience testing and risk assessment; the security manager, and business continuity or compliance manager supporting each other. Denis, a former military police man who became chief police officer at Teesport in Middlesbrough in 1999, has employed a business continuity manager, Bill Simpson, who has a background in incident management at operational, tactical and strategic levels. Denis recalls that the port had used Bill ‘almost on a consultancy basis when I was trying to get BS 25999 in place for the port’. Briefly, BS 25999 is the British Standard for business continuity management (BCM for short; and it might be worth pointing out the ‘management’ part because, as with the international standard ISO 27001 for information security management, the work is about managing a process; it’s not something you do until you can tick a box and file it in a desk draw, and blow the dust off it sometimes. But to return to Denis; he felt that to do BCM properly, ‘we needed somebody dedicated. It isn’t something you can just pay lip service to.’
Denis gave another example, of the firemen’s strike of late September. What’s the impact of it on Teesport, and other ports in the PD Ports group, such as Hull, Hartlepool, Felixstowe? As Denis put it: “We just have to make people aware that for four hours there isn’t fire cover; that doesn’t bring our business to a halt.’ BCM is about raising the question; what if there is an incident in that four-hour window. Under the Civil Contingencies Act 2005, Teesport is a level two responder; level one being the blue light services. That means if there is a ‘civil contingency’ – any emergency, man-made or act of God, a large chemical spill or explosion, flood or terrorism – Teesport may provide land, fuel, whatever the 999 services tackling the fire or fumes require. As for any fire strike; as Teesport has foam for fire-fighting, might it aid neighbours, to make all more resilient, more prepared?
Why go for the British Standard, besides doing things to be a more resilient business? “Partly to make sure we were doing it right,” Denis says, but interestingly also for business reasons; the BS 25999 was something that could attract customers. A port customer, whether a wholesaler bringing in retail products, or factories seeking imported raw materials or to export finished goods, wants deliveries on time; day or night. Yet the very smoothness of a supply chain might bring risks. Likewise, take social media. Teesport’s social media risk is not people looking online at work, Denis suggested; rather, it’s people using social media at home, talking about company business, precisely because it’s so easy to do so online. But the risk is – as in any workplace – workers giving away sensitive company details. But how to police social media – at all, let alone legally?! That said, at a port as elsewhere, Security, as a 24-hour operation, is the place other departments will ring, over a BCM rather than a strictly security matter. If there’s a traffic jam holding up lorries on an A road miles away; or bad weather is forecast; what are Security doing about it?! Denis’ point; resilience is not only about security or BCM, but all departments planning for situations. Because if the Arndale bomb in Manchester, or 9-11 taught anything, it was the need for a resilience plan.
About Denis Murphy: Appointed Chief Police Officer of the Teesport Harbour Police in December 1999, after a long career in the Royal Military Police, he holds a MSc in Security and Risk Management from the University of Leicester and is a Chartered Security Professional. Visit http://www.pdports.co.uk/en/marine-operations/harbour-police/harbour-police-management-team/
