The New York City Office of Emergency Management lost its state-of-the-art emergency operations center (EOC) when World Trade Center 7, which was situated across the street from Tower 1, caught fire and collapsed on September 11. As a result, the EOC was unusable—just when it was needed most.
An EOC’s purpose is to coordinate incident information and resources for management. It is the heart of any major response operation and provides enhanced decision-making capabilities to the organization. But when earthquakes, fires, floods, tornados or other disasters destroy or make the building in which the EOC is located inaccessible, or key staff that are dispersed throughout the world are needed during an emergency response, alternate locations as well as alternative operational concepts are required.
As a result, many organizations are now employing virtual emergency operations center (VEOC) concepts as part of their emergency management program. Beyond the Internet and the telephone, new developments in telecommunications, such as wireless networks and handheld devices, have opened significant opportunities for overcoming inherent EOC participation problems.
The Many Forms of the VEOC
An EOC is “virtual” when participants can share information, make decisions and deploy resources without being physically present in the EOC. Typically using Web-enabled software, a VEOC allows participants to work from their normal workstation, from home or from the field. Emergency plans and reports are available from any location. In fact, all information can be maintained in a central database that is available to VEOC participants from anywhere in the world.
A VEOC permits effective direction and control of resources, automates processes and methodologies, assigns and tracks tasks, and efficiently communicates real-time information. In addition, if configured properly, a VEOC can protect communication and data with needed redundancy, security and flexibility.
The military embraced the VEOC concept early in its command and control efforts, and the private sector is beginning to follow suit. As a September 19, 2001 Gartner Research Note states, “Enterprises should consider establishing a ‘virtual’ command center to limit the vulnerability caused by all senior executives being in one location.”
Companies such as Cisco and AT&T use commercial, off-the-shelf VEOC software, while others, such as Fidelity Investments and Bank of America, utilize conference calls and online databases to coordinate emergency response for global operations. The U.S. Army uses VEOC software on wireless mobile networks that can be deployed quickly at any major event. Other organizations use VEOCs to manage less extreme situations such as meeting revenue goals or managing a reduction-in-force.
“The use of [Wells Fargo’s] VEOC is critical to the success of our communication strategies,” says Rex Eng-strand, VP and manager of Wells Fargo & Co. corporate business continuity. “It enables my staff as well as those who support the rest of the organization the ability to assemble and discuss any incident with ease. We—corporate BCP—are not reliant upon or limited to, a physical EOC location as our only means of assisting in an incident. Some of the tools we utilize are: LDRPS, secure conference calls, an intranet chat for support groups, blast faxing for the stores, an employee 800 number and a call-out system for immediate staff notifications and call set-ups.”
Bank of America developed a regional approach to emergencies when preparing for the year 2000. It established ten regional support teams focused on notifications, evacuations, activations and event management using a combination of conference calls and Web-enabled tools. Mike Cannon, senior vice president and national manager of business continuity management for Bank of America says that one of the reasons it migrated to the VEOC arrangement was the global nature of its operations. “We require instant communications with people not physically located in the disaster area,” he says. “We do this using several different key components in our VEOC toolkit including e-paging, e-mailing and blast faxing.”
Continuity team members at Bank of America are required to have a pager or they call a phone number from their notification list. Since it is important to keep numbers up to date, they use an intranet-based roster that includes all eleven teams and their various contact numbers. In addition, they use an event management database. This database has a real-time reporting mechanism that is used by management for status reports. There is also the “Ready Access” automatic conference line that provides a prearranged conference call number with ninety-six ports. Other virtual tools include the involvement of weather experts in the conference calls and an event intelligence Web site with links to external sites that offer up-to-date information and intelligence. ‚
Bank of America also uses virtual tools to keep employees informed. Management officials get status reports via voice mail, which is updated after each status meeting. A disaster employee assistance line number is given to all employees to call for instructions during a disaster. Cannon says that the bank is also “planning to develop a lessons-learned database from drills and events that all team members will be able to access.”
How a VEOC Functions
The VEOC is typically an adjunct to a physical EOC. EOC participants may be able to function in their assigned roles in both the physical and virtual sense. Although certain key players should be present in the EOC to carry out particular functions and have face-to-face contact with decision makers, especially for extended events, the majority of participants may participate virtually so that they can attend to their duties in other areas. Regardless of location, participants must access needed data, and have the ability to send messages, conduct conversations and update information.
The core functions of a VEOC should include:
• communication and intelligence—to effectively receive and transmit information
• command and control—to provide the functions necessary to put multiple response and recovery plans into action
• coordination and documentation—to organize all of the steps taken to respond to an event and create a record of those actions to protect employees, infrastructure and shareholder value
• automated checklists—to ensure that response and recovery is complete for major functions
• alert notifications—to sort and distribute messages so managers can track and log multiple and varied notifications
• media management—to inform the media about the progress the company is making toward normal operations
Virtual Benefits
Throughout the entire response operation, the VEOC will track all activities and resource utilization against the response and recovery plan. These tasks will be tracked from their initiation through their completion and the ultimate closure of the incident. The VEOC should include databases with live, up-to-date resource data and use a system that monitors available resources as they are assigned. The database should track all data relating to each deployment and restore resources once available.
The VEOC ultimately is a center for information management. Its primary purpose is to gather and process all of the information required to plan for and respond—quickly and effectively—to emergency incidents. A VEOC should use the Internet to link to emergency plans, policies and procedures, site maps, floor plans, resource lists, other Internet resources and other entities.
Within the VEOC, incoming messages must be gathered, categorized, processed and displayed in order to optimize decision making. As messages arrive, the information flows to analysts who make the initial assessment as to whether an emergency incident is present. If and when they determine that a disruption must be treated as an emergency incident, then the incident must be posted to an operations log.
The VEOC should help widely distributed managers triage problems and track the deployment of resources, response teams and other response capabilities according to plan, so as to resolve any incident. The system should be able to summarize this tracking information for real-time briefings to either executives or the press concerning the organization’s progress on response and recovery.
In addition to internal communication, many organizations have a need to communicate with other external organizations. Terrorism concerns prompted leaders of the nation’s largest corporations to design a unique communications network, called CEOLink, that would enable them to contact other corporations and governmental offices during an emergency. Systems like CEOLink will help private companies respond more quickly to emergencies and will improve their recovery outcomes.
VEOC Tools
There are a handful of vendors providing Internet-based EOC products and intranet tools for a VEOC. Options and features vary, as does the degree of sophistication. (A project funded by the National Institute of Justice was conducted in the spring of 2002 to evaluate eleven different EOC software products.) The best-of-breed software will be easy to learn and use, and will work right out of the box. These products will include most of the following features:
• incident tracking, logging and reporting
• automated SOP checklists and plans
• resource management (with full database functionality)
• central command and control
• messaging and communications function with tracking
• documentation of response actions
• contact lists
• Internet, intranet/VPN and wireless
• radio, cellular and satellite
• appropriate member participation
• automated journaling
• access to plans and data
• mapping
• role-based staff management
• linking capability to access Internet sources for weather and event intelligence
• hand-held compatibility
• fully configurable and scalable (can grow and change with you)
• compatible with existing infrastructure, databases, software and e-mail
• status boards
• executive briefings
It is also important to include redundant and contingent alternatives to VEOC systems so that communication and data manipulation can occur under almost any circumstance. To the degree that the Internet is used, there is an inherent redundancy in linkages, but it will require multiple servers and terminals to have a fully redundant system. Web-based applications can be hosted on multiple servers in diverse and hardened locations, providing maximum resilience to disasters. Automated databases should be backed up with contact information for staff as well as vendors and other business partners.
Telephone and conference calls can be used as an adjunct to Web-enabled software. There are many sophisticated applications for managing EOC communications through notification systems, blast paging, fax and e-mail systems as well as conference call services and bridges. Fidelity Investments, for example, uses conference calls to bring its team together during an event. Fidelity continuity managers schedule regular group update calls. If possible, they touch base with the problem owner prior to the call. Each call is facilitated and managed in a way that keeps it focused and brief. It begins with a short impact status report, then the problem owner provides a detailed update before other liaisons input their updates.
VEOC tools should help you effectively manage the vast amount of information that is generated during a crisis. A good information management system organizes all of your response and recovery data and should be designed to help you manage your resources more effectively. Software replaces the physical world of white boards, black boards, flipcharts and pads of paper with an electronic data management tool. The system should make it easy for individuals from every department to quickly and accurately report on their progress using automated checklists and other time-saving features such as automated reports for incident tracking. While contingency plans often end up in binders or files, a good information management system can make plans and supportive materials easily available to everyone.
Virtual Enhancement
Although the VEOC concept has developed a useful way to provide the needed flexibility and redundancy to support emergency operations, there are some drawbacks in virtual operations. It may be difficult to get everyone to the “virtual table” at the same time. In addition, face-to-face meetings are often far better for communication. If you use an application service provider (ASP) you may be improving or jeopardizing your VEOC’s security and stability depending on your internal capabilities. Using an ASP opens your organization to the risk of system failure if communications or servers go down or if the ASP data center is affected. Security may be a concern since your critical data is not on-site and is not directly under your control.
But overall, the advantages of a VEOC are many. First and foremost is the fact that anyone can participate from almost anywhere. Additionally, the flexibility and redundancy that the Internet offers is paramount. Most organizations will discover that a VEOC requires a lower investment in physical EOC sites. Most VEOC software products are designed to be easy to learn and use. Some use a role-based design that allows participants to focus on critical tasks, while minimizing screen clutter and interference. Web-hosted deployment means that little or no additional infrastructure or equipment is required as any PC with a browser can act as a VEOC workstation. This also makes a VEOC easy to set up and implement. Maintenance can be automated through vendor software updates, which permit continuous improvements and enhancements. And data can be hosted off-site using redundant servers in hardened sites, or the server may be maintained by an ASP at a secure, reliable data center.
Depending on the event, it may be extremely advantageous for team members to remain in their traditional roles while still participating in event management. Utilizing virtual functionality, the organization can save on the cost and time of travel and quickly assemble a team.
Operation Emergency Terminology
Emergency Operations Center (EOC)
An EOC is the physical location where an organization comes together during an emergency to coordinate response and recovery actions and resources. These centers may alternatively be called command centers, situation rooms, war rooms or crisis management centers. Regardless of the term, this is where the coordination of information and resources takes place. The EOC is not an incident command post; rather, it is the operations center where coordination and management decisions are facilitated. Virtual
Virtual refers to something that is created, simulated or carried on by means of a computer or computer network. This wired environment is normally referred to as cyberspace. When information is stored and manipulated in cyberspace it represents a virtual room, e.g., “virtual library” or “virtual chat room.” Virtual Emergency Operations Center (VEOC)
A VEOC is an EOC that exists solely or partially in cyberspace. A VEOC provides an electronic EOC via a computer network or the Internet. It can consist of one workstation or thousands of networked computers dispersed throughout the enterprise and around the globe. The first versions of VEOCs were simple information systems based on fixed and mobile wireless networks. Modern VEOCs utilize the latest Internet technology as well as virtual private networks and satellite communications. Comprehensive Emergency Management Program (CEMP)
A CEMP is an integrated approach to the management of emergencies in four emergency phases (mitigation, preparedness, response and recovery) for all hazards. CEMPs encompass a number of specific planning areas including hazard identification and mitigation, emergency response and recovery, and crisis management and business continuity planning. A CEMP provides a roll-up of these various components into one complete program. |
Who Needs To Be Involved?
Typically, representatives from the following areas are involved in the EOC’s information sharing: • senior management • risk management • continuity planners • security • emergency response teams • network operations • facilities • public relations • corporate communications (internal and external) • marketing • support staff • legal counsel • line-of-business • finance • insurance • procurement |
