Airline information security failures

In my work I get to travel a fair amount, Across Africa and the Middle East mostly. On my travels I'm always thinking to myself, "why don't you guys implement ISO 27001 and make the world a better place?" Here's an example of one of those times.

Recently I was traveling home from Riyadh, Saudi Arabia, on one of the region's low-cost carriers, +flydubai. I arrived in plenty of time at the airport, checked in (no online checkin unfortunately), made my way through the immigration and security queues, and headed for the gate noted on my ticket. When I got there, there was no airline representative and no information on the screen. No Fly Dubai plane parked outside either. On the airport information screens it was mentioned, "Fly Dubai - Gate 17 - Counter closed" so I took this to mean that I was too early. 

It'd been a long week so as usual, I wander off to the business lounge to eat, drink, and relax while I wait for the "Gate Open" or "Boarding" announcement on the screens.

After some time, the announcement is updated to "Delayed". Trying to get some more information, I go back to the gate. Still no rep' from the airline, and no plane outside the gate. I'm starting to feel frustrated at this point. The airline staff on the next gate inform me that the plane didn't even leave from its origin yet, and based on that I estimate I have at least another two hours before there is any chance of departing. Annoyed with the lack of information, I return to the lounge figuring I'll just monitor the screens for an update.

An hour and a half passes. Still nothing.. until suddenly my flight vanishes from the screen! Aggravated and slightly concerned, I go back down to the gate. Nobody is there. Confused, I ask the neighboring counter staff, who inform me that the flight already departed - I am one angry customer!

Fortunately there is another flight leaving an hour later. I assume, given the circumstances, that there would be some concession. No such luck. I am charged full price for a new ticket, and worse, it is a business class ticket since there is no space on the flight in economy. Its no longer low-cost, as the price I'm charged is as expensive as the regular carriers. 

The manager refuses to come out from his office and sends his subordinates (those with no authority to make decisions) and despite a last plee for a reduced price on the ticket, I am refused, left with a choice to either reside forever-more in a Saudi airport, or pay through the nose for a second ticket home. 

Those of you reading with a more stuborn view of business and the concept of customer satisfaction are probably thinking that I should have waited aimlessly all day next to the gate so that I wouldn't have missed the flight. Others, maybe those who travel more regularly, probably understand why I didn't.

Regardless, the point is, why doesn't Fly Dubai have an ISO 27001 management system and make the world a better place? With information availability and integrity at its heart, an information security management system could make Fly Dubai, and others like them, more competitive, improve their reputation, and essentially, make them more profitable. I for one will not be using them again (at least not willingly) and certainly can't recommend them to collegues or friends. 

Incidentally, I was subsequently informed by the airline staff -- whilst they were busy blaming me for my error -- that the "Counter Closed" message displayed on the information screen in the lounge was actually a reference to the checkin counter being closed, not the boarding gate counter being closed as I'd wrongly assumed. Why passengers who are already checked in and waiting to board a flight need to be informed about the checkin counter's closure I have no idea. 

Information security failures such as this one can have subtle but cascading effects in the long term. I'm just one voice. But repeated failures will eventually impact their reputation and perhaps change opinions about the benefits of a low-cost carrier. It would have cost them virtually nothing to stick me in one of the empty seats on that next flight. Or at least to acknowledge some degree of responsibilty.. Or even just to give me the benefit of the doubt and offer me a discounted ticket - I am (used to be) a paying customer after all. 

Good practice is good practice for a reason. Wake up airline people and start adopting these standards!

Ok. Time to head to my gate as I post this whilst sitting patiently in an airport lounge and hoping that the information provided is accurate. 

Did anyone else experience the same or similar problems? Does it bug you also, or is it just me? Feel free to post your comments, thoughts, and own experiences.  

Improvement planning and objective evidence

In a recent audit of a client’s business continuity program, an auditee in the company’s communications department who was responsible for the internal communications protocol, offered up – when asked – an improvement opportunity that he had identified a month earlier regarding the early warning process that they were currently following.

At the time I was auditing, the authorized procedure for providing notification to staff of an impending disruptive incident (an approaching sand storm for example)  involved sending out a red colored alert message by email and SMS to all staff, at all levels, and to all locations and offices across the entire country in which they operated to warn staff of the coming event. In this case, the communications specialist had identified that by sending messages indiscriminately to everyone, staff whom would be unaffected by a localized event may become complacent of the little red notice’s importance and hence impacting the effectiveness of the procedure. The proposed solution was to review this procedure and to see if it could be improved upon by having the capability to target the messages to specific audiences.

In any management system audit, such an initiative is a very positive finding since it is evidence that continual improvement is in fact occurring, as indeed it should be if we are properly aligned with the subtleties of the process approach, PDCA model, and continual improvement mandated by all ISO management system specifications. In ISO 22301, this requirement basically falls under clause 9.1 Monitoring, measurement, analysis and evaluation for identifying the improvement and clause 10.2 Continual Improvement for taking action. However, it is the next step wherein many organizations often fall short, especially within those who have only recently established their shiny new management system and haven’t thoroughly come to grips with the complexities of the process approach. The next step is obviously to plan the improvement action; and the next audit question then, is likely going to be something along the lines of, “Please show me the plan!”

Unfortunately, organizations with a less mature understanding of the requirements of management systems and more importantly this PDCA culture think that by just fulfilling the minimum stated requirements of the standard that they are fully meeting their obligations and have a conforming management system. But this is not necessarily so, as auditors are not there to simply tick boxes, but rather, to audit the intention, implementation, and effectiveness of the management system – they’re auditing the process itself and there must be sufficient objective audit evidence made available to the auditor so that a determination can be made as to the extent of conformity to established requirements.

In the case of my auditee, the communications manager, he was unable to provide evidence, other than a few inspiring words and a couple of emails that had been largely ignored by the recipients, of any real commitment or support to actually implement the improvement that he had identified.

PDCA (Plan – Do – Check – Act)

The processes approach means that once the process weakness or improvement opportunity is identified (at the C – CHECK stage) then it should be evaluated, and if appropriate, acted upon (A – ACT). A decision to take action leads us back to the beginning of the cycle.. P – PLAN, and therefore, there should be audit evidence available in one way or another for the decision having been taken (who decided? Who authorized the action?), and planning of the improvement itself.

Not to get in to a discussion about documentation requirements, and it is true that a plan may not (or is not required to) necessarily be documented, records are still typically required to be maintained as evidence. The point is that there must still be objective evidencethat the organization is in-fact planning and that it is in control of its own processes, has management support, and that the necessary resources are committed for the process to achieve its objectives. A member of staff making the claim that he is planning to do something without then supporting that claim with something a little more tangible is likely to fall short in an audit and certainly doesn’t give an auditor any confidence. In terms of planning, there should at least be some clarity on the basics, which would include accountabilities and responsibilities, planned actions, a clear time-frame, and not forgetting.. an objective! (You are taking action to actually achieve something, right?)

In most other management systems there is still the age-old requirement for “Preventative Action” which does mandate clearly this need to record evidence of improvement planning; however, the days of a preventative action procedure are limited and as is the case in ISO 22301:2012, we now look to clause 6.1 “Actions to address risks and opportunities” for this requirement to “plan actions to address .. opportunities” and to “integrate and implement [these] actions.”

Conclusion

To ensure that you are getting the most out of your ISO 22301 internal and external audits, ensure that your management processes identify and include requirements for maintaining evidence of the management system’s effective implementation. It is generally a good idea to document any improvement plans and activities.

For implementers, it is wise to ensure that not only is the necessary documentation produced during the implementation stages of a certification project, but that management culture is also developed inline the process approach to management.

I hope this article has been helpful. Feel free to post questions or comments, or to share your own experiences or views on the topic.

Writing the scope statement for an ISO 27001 ISMS

One of the first steps in the implementation of an ISO 27001 information security management system (ISMS) is to identify and define the scope of the system. Equally, for those tasked with assessing or auditing an ISMS, reviewing the scope will be, or should be, a first step.

In this post I’ll be discussing the importance of properly scoping your ISMS and will try to identify some key points to consider when documenting the “scope statement” – the statement which will appear on your ISO/IEC 27001 registration certificate and is typically a short, one paragraph or less, summary statement.

[Note: This post refers to the now obsolete 2005 version of the standard.]

Requirement

Let’s start with the requirement, ISO/IEC 27001:2005 clause 4.2.1 a) which falls under the PLAN component of the standard, or “Establish the ISMS.”

What’s expected is a clear, concise, unambiguous and documented (4.3) description of what’s ‘in’ and what’s ‘out’ of your ISMS umbrella.

Let’s put it another way. If its in scope, it will be audited; if its out of scope, it will not. If its in scope, it is subject to ISMS Policies; if itsout of scope, its not. If they’re in scope, they will attend the Awareness Training; if they’re out of scope, they will not. Etc. You get the idea.

How we describe this will depend on what we have, but generally speaking we’re talking about: assets, processes, people, technology, and locations.

In determining and documenting the scope of your ISMS, the standard requires that you define it in terms of:

1. The characteristics of the business
2. The organization
3. Assets
4. Technology
5. Locations

Characteristics of the Business

What does this mean? Well, just that you should be describing what your business is all about and generally, how it works. What do you do – sell products? Provide a service? I think about this as being the elevator pitch given by the company’s best sales guy when you meet him for the first time. Or how the CEO would describe her organization.

If you’re a bank, you’ll be telling me all about current and savings accounts, credit cards, loans, and mortgages. If your a telecoms company, you’ll tell me all about your mobile services, roaming services, data and internet services. If you’re an airline, you sell tickets and fly people about. And so forth.

The Organization

How is it structured? What does it do? You might consider a description of your products and services, departments and their activities, as well as the org. chart under this heading.

Assets

Probably the next most important point in defining the scope is to have some clarification on what assets are covered by the ISMS. The definition of the term “asset,” according to ISO 27001, is: “Anything that has value to the organization.”

So under this topic, we probably want to identify major organizational assets such as: information, process, people, reputation, equipment, facilities.. to name a few. And if the main purpose of your ISMS is to protect a specific asset or asset group, it will be the place to emphasize those assets. So for example you might identify your scope as covering “all customer information.”

Technology

What type of technologies do you depend on and use to operate your business. Are you high-tech, or low-tech? Technology, of course, is not just a reference to computers and servers.

It is also common to include network diagrams to help to show the boundaries and logical interfaces under this topic.

Locations

Make reference to all of the business locations, for example, offices, workshops, branches, warehouses, and any other place of business. Are you situated in one location, or multiple locations? Local, regional, or international? You’ll want to identify and make reference to them all if your ISMS policies will be implemented at those locations.

Note that if you are planning to exclude any location from your scope, under most circumstances your head office will always have to be included.

You do not necessarily have to separate the information under each of these headings but the scope documentation that you produce should collectively reflect all of these points.

Scope Exclusions

The elements mentioned above are all a necessary part of your scope description and will tell us what is in scope. You may also choose to exclude parts of your business so long as this does not contradict your ISMS policy or hinder the ability of the ISMS to achievement your stated security objectives.

In short, if something doesn't need to be included as a part of your ISMS, then it can be excluded from the scope.

It is a common practice to exclude parts of the business from the ISMS scope (for certification purposes at least) as a larger scope equates to a lot more $$$ and effort and will also lead to bigger auditor bills. However, it is also a common practice to exclude parts of the business that should necessarily be included. This is often done either due to a lack of knowledge, or just a lack of management commitment for the implementation. Either way, its bad.

The argument goes like this: “its our ISMS and its our top management’s right to say what’s covered. Its not for the auditors to tell us what the scope should be.”

This is a fair enough argument, and perfectly correct. However, the point is that auditors are not telling anybody what the scope should be, they are reviewing the ISMS for conformity against requirements and judging its ability to achieve its intended purpose (the purpose is defined by top management of course). In this case, clause 4.2.1 a) is very clear about the scope being relevant and appropriate for the organization – “characteristics of the business” as described earlier. Therefore, any organization having a scope definition that does not in some way reflect core business is probably going to fall short in meeting this requirement and the good auditor will rightly challenge it.

Another common argument goes like this, ”Our data center is our most important asset with regard to information security because that’s where all our customer information is processed and stored.”

Again, probably true enough, but once more, your “data center” is probably not (for most companies) the topic of conversation for your sales people or your CEO – on its own, its not “characteristic” of your business – its simply a support service in most organizations no matter how big or important you think it is.

The standard is clear on this concept of being business-driven for a good reason, let’s see an example:- A training company wants to become certified to ISO/IEC 27001:2005, and their scope statement reads: “ISMS covering the information in the data center.” – Correct me if I am wrong, but I don’t see the sales guy or CEO of a training company explaining to customers the ins and outs of their data center. What the training company are doing in this example, is including the data center in the scope (because they believe its critical for information security), and excluding all of their training activities – it should be the other way around!

OK, so this is one view on how the standard requires the ISMS to be aligned with organizational goals and objectives. Let’s dig deeper and try to understand why this is so important.

Consider the security objectives and policy of this training company, it probably reads something along the lines of: “It is the intention of management to ensure the confidentiality, integrity, and availability of all information in relation to our training courses and examinations, and the personal information of our students.”

Now consider that in order to be effective and to achieve this goal you’re going to have to identify and manage risks at all points wherein that information is created, communicated, shared, used, stored, destroyed, etc.. within the business and across its boundaries. Most likely, you’ll find that numerous departments and functions within the training company are in some way involved in this process as well as external 3rd parties too.

Consider how and when the “personal information of .. students” comes to be in the hands of the training organization; probably, students are asked to fill up a form and send it in to the sales department. The sales department share this with finance so that the credit card can be charged or the customer invoiced, and then the data is entered into a database and the information is stored. Then the course instructor will be provided the necessary information in order that [s]he can conduct the course.. Clearly, in order to achieve the objective of “protecting information” the scope of the ISMS must include all of these process activities, people, technologies, locations and so forth for security to be effective. If anything in this process is exclude then you are not in a position to claim that you are in control. Out of scope equates to the fact that you did not do a risk assessment, did not train your people, and do not audit, to name a few.

Be careful about your exclusions as you also have to be able to provide a sensible business justification. Can you imagine when the auditor asks the CEO of our training company, “Dear CEO, you've told me that you are committed to ensuring the security of your students information, including their personal information and exam results – can you please explain to me why you have excluded your training department, personnel (who mark the exams and post the scores) and your instructors from the scope of your ISMS??”

Ok, a big mention there on exclusions, but vitally important!

Boundaries

In identifying the scope, we are also identifying the boundaries of the ISMS. A boundary is the demarcation point between the in-scope and out-of-scope processes of our ISMS. You may have functions, people, assets, departments that are a part of your organization but are out of scope of your ISMS as described previously under “exclusions.” Where there is an exchange of information between in-scope and out-of-scope elements, this is a boundary.

You also have relationships, partnerships, vendors, suppliers, and customers that are not a part of your scope (you can’t control them.. directly), but they must be identified. For example, where your network cabling terminates and connects to the external network owned by your telecoms provider, this represents a boundary. Or where your customers cross from the public walkway in to your shop, this is a physical boundary.

Identifying boundaries is important because you need to recognize that just because you can’t control what’s on the other side, doesn't mean you don’t have a responsibility for protecting your assets when they cross the line. Meaning, you should be conducting a risk assessment to identify the threats that those 3rd parties present to you – including any internal boundaries.

Once the relationships and risks are understood, you will need to implement some level of control to manage those risks. This is often achieved with some form of contractual agreement where you will stipulate your requirements for security and the protection of your assets while in the hands of the third party.

For example, if you use a 3rd party courier service to deliver your product to your customer. The courier service is an intermediate entity between you and your client and you’ll want to ensure the security aspects of the courier service when entrusting them with your company assets.

You may, for example, stipulate in the contract your right to audit the 3rd party to ensure that they are confirming to their contractual obligations.

Writing the scope statement

Now that we have some idea about what is involved in defining and documenting scope related information, let’s take a brief look at how we can approach writing a smart little certification scope statement, the one that will go on the registration certificate issued by your certification body. The following are just suggestions and tips on how to approach the task and what you might include.

1. Focus on high level processes, activities, services, and/or your major assets, rather than departments.

For example, saying that the ISMS covers “customer information” infers that any part of your business that touches or handles customer information is now within scope. There is no need to say instead, the ISMS covers “The sales department, the finance department, the customer services department…” due to the fact that  if any of those departments are a part of the process then they will be included.

Another example would be, “The ISMS at our bank covering loans, mortgage and accounts management.” – indicating all assets and resources relating to these banking products/services are within the scope of the ISMS.

2. Tack on some location information.

Adding to the activities or coverage of specific assets described above, it is a good idea to now state the locations that are covered. For example, “at our head office in ..” or if you have multiple locations, “at our London head office and all branch offices within the United Kingdom.”

3.  Consider your audience

Although this is not a policy statement or a news paper advertisement, it is still worth considering that your customer or client may see your scope statement – its going to be on your certificate. Most companies are in-fact looking to achieve certification for this exact reason, as a marketing or competitive edge, used to promote the worth of the company to clients.

This is another reason why it could be more useful to describe your scope in terms of coverage by product or service rather than departments and internal functions. A customer is more likely to read, understand, and appreciate a scope statement that says, “..covering customer information” or “.. covering our flight booking service..” than a statement that lists out your internal departments, like, “.. covers in the IT, HR, Finance, Sales departments and call center.”

4. Keep it clear, unambiguous, and accurate

The certification scope statement should be a simple statement that indicates what is covered, and in case of exclusion, what is not covered, and should not be misleading.

5. Statement of Applicability

Certification bodies may want you to include reference to the statement of applicability (SoA) too. This normally goes something like, “.. in accordance with the statement of applicability version 1.2 dated 25/12/2012.”

Examples

Now that we have some idea about writing the scope statement, let’s take a look at some real life examples. The following are randomly select from an online database [link removed as the website has unfortunately vanished] and are consistent with most of the suggestions in this post. Have a look and see what you think.

Axalto Canada

“The information security management system that covers the card service bureau activities including the customer data reception, the data processing, the smart cards and PIN mailers personalization, the packaging and shipment of personalized products and the key management of the Burlington Plant of Axalto Canada, Ltd. This is in accordance with the statement of applicability version B5.”

B6 Integrated Entertainment

“Provision of consulting activities through the innovation of special formats in media and contents as added value for the advertising investment management, including the handling of competing clients information”

Camelot Group Plc

“The management of information security in the operation of the National Lottery. This is in accordance with version 1.1 of the Statement of Applicability.”

Centrum Medyczne LIM Sp. z o.o.

“Provision of medical services (including medical data protection) by CM LIM Sp. z o.o. as well as by associated support processes carried out by CM LIM Invest Sp. z .o.o. and ACCMED Sp. z o.o. in accordance with the Statement of Applicability issue 3 dated 27.03.2007.”

Chiyoda Almana Engineering L.L.C.

“ISMS is applicable to the provisioning of Engineering, Procurement and Construction of Brown Field and Green Field Projects for clients from Oil & Gas, and Petrochemical Industries, in the State of Qatar as per the Statement of Applicability Version # 1, dated: 02 Nov-2011.”

Finally

Remember, ISO/IEC 27001 is a process-based standard, and as we've seen in some of the examples, to effectively protect our assets we need to consider the threats and vulnerabilities throughout the entire process in order to have confidence that our ISMS can and will be effective. So – think about what you’re actually trying to achieve in having an ISMS and make sure that your scope allows you to achieve it.

A note on the IT driven scopes. If you feel that IT really is the scope of your ISMS then my suggestion is to check out ISO/IEC 20000-1 for IT Service Management instead. This standard is specifically written for this purpose and will be far more useful than ISO/IEC 27001 as a management framework. The standard provides a suitable framework to manage all aspects of IT service which includes the information security commitment to users and the greater organization within the IT context.

Note that this post is based on ISO/IEC 27001 2005 requirements. I'll be updating with regard to the new 2013 version soon.

Earthquake! How effective was your company’s response?

On April 16th, an earthquake measuring 7.8 hit Iran and its effect was felt across the region. In this post I want to consider this real world example and delve deeper in to the topic of management system “effectiveness”.

I’ll try to explain what is meant, and what is to be expected of an effective risk-based management framework such as an ISO 22301 (BCMS) or ISO/IEC 27001 (ISMS) management system, and I’ll apply the concepts to two case studies to better illustrate these points.

The Response

At the time the earthquake hit, I was working from my home office just off of the Dubai coastline. I felt the floor rumble and move under my feet, but it was only for a  brief couple of seconds. At first I was confused, then the idea that it could be an earthquake hit me.. fear struck me, briefly – I’m more than 25 floors up!

A deep breath in and my brain reactivated, I figured that perhaps it was just the construction going on outside.. Maybe I imagined the movement of the floor? I looked around and saw that the light on the ceiling was swinging around; it was real alright.

I dashed to quickly grab my passport, phone and wallet, I should evacuate… shouldn't I? But what do I do – take the stairs? That’ll take me about 10 minutes or more to get down to the bottom, if things are going to go, then that’s too long. Do I risk the elevator? We’re not supposed to use the elevator in a fire.. but this isn't a fire so maybe I can I use it now to get out quickly? It might be worth the risk.

There was no alarm or evacuation alert in my building, so I gathered my thoughts and again wondered if it was indeed an earthquake – I've never experienced an earthquake before. As I started thinking more about what I should do next I also started to second-guess my first instinct to evacuate. Maybe its safer to stay here? Besides, aren't these buildings designed to withstand such events? Surely they are?

10 minutes on and I still hadn't left the building. Now my nerves had reordered themselves and I have talked myself down from my confused and fearful state of mind. I’ve felt nothing else since the first rumble so now I’m going to wait and see what happens next. Its probably all over, nothing more than a little tremor, so I sit back down and Google “earthquake Dubai”!

Elsewhere in the UAE, one Dubai school has completely evacuated and sent all its students and staff home. The school closes its doors for the next day too, whilst an expert checks the structural integrity of the building to give the all-clear. Other schools remain open and continue to operated as usual, apparently unconcerned, whilst the roof of a shop in Ras Al Khaimah collapses and reminds us that the potential for a loss of life is not altogether unrealistic.

Employees of some companies evacuate and spend an hour or so on the streets. Others remain inside, hidden under tables; and yet others appear completely oblivious to the event and continue to work, its business as usual.

These are just some of the responses I've learned about over the last couple of days from personal experience, news reports, friends, and colleagues and its interesting because here in the UAE earthquakes are a pretty rare event. Given these examples, what I want to consider next is how companies with formal management systems in place should be behaving after such an event and to consider what an effective management system actually looks like.

The Management System

First off, where and how does this all fit into our BCMS, ISMS, OHSAS etc picture? Well in the grand scheme of things this is all about “checking”. It’s too late to be “planning” our response (creating the earthquake evacuation plan), since it already happened, and what should have happened during the earthquake event was the “doing” or “implementation” part (staff evacuating according to the plan). Now we are going to look back after the event occurred, i.e. post-event, and we’re very keen to know if the the plan was effective – i.e. did everything go according to plan and did the plan work as expected.

For a quick self-evaluation, ask yourself the following question. If your answers are similar to mine, whether yes or no, your management system is probably working, at least to some degree, as it should be.

The question is: Did you consider “earthquake” in your risk assessment?

If no:

- Have you since reviewed your risk assessment and updated it?

- Did you ask yourself why it wasn't included?

- Are there other risks that you may also have overlooked? Are you resolving this?

- Are those doing the risk assessments competent to do so? Why did they miss this?

If yes:

- Did you have a plan in place to respond to this type of event?

- Did everyone follow the plan knowingly and correctly?

- Did the plan work as expected? Can anything be improved?

- Did you review your risk assessment assumptions (e.g. likelihood and impact)? Do they need tweaking?

- If you identified the risk but management decided that there was no need to implement a plan, do they still feel the same way?

All management systems tell you to PLAN –> DO –> CHECK –> ACT (PDCA), so embedding this process-approach in to everything that you do is fundamental to having an effective management system. The above question, leading to answers of either yes or no, and on to further questions that lead you to identify improvement opportunities, demonstrate effectiveness. You are required to check to identify your weaknesses and/or failures and act on them to improve. Doing so means “conformity” to a standard’s requirements. Doing nothing means “nonconformity” to a standard’s requirements.

Not every company would have considered earthquake as a risk in Dubai, it happens rarely, but it does happen and therefore should likely have been identified. However, if now the risk assessment has been reviewed and updated, and a response plan is being developed, then the outcome is improvement and is evidence of a management system that works.

Those who think they comply just because they have a plan, and the plan was followed, but didn't conduct a post-incident review, will likely fall in to the non-conforming group.

So the bottom line is that: an effective management system is one where management continue to identify improvement opportunities and act on them. A ‘real’ event, like an earthquake, is invaluable in this improvement process.

Case Studies

Let’s take a step back and speculate on the management systems (whether formal or informal) of our schools from earlier.

Case 1

First up, the school which closed its doors and did a thorough check of the integrity of the building, Repton Dubai in this case. This is an expensive school to attend and its policies and reaction to the earthquake demonstrates to me a very risk-averse, safety conscious management team. Given that the school did not even feel the tremors  it  may be considered by some that the response was excessive and costly. Clearly, by sending children home early from school and keeping them home the next day without prior notice, there will be a significant impact on many parents. But then, what would have been the impact if they had not responded in such a way and the roof were to collapse? All questions I would assume/hope were asked and answered by the school, prior to the event (?!).

Regardless, here is the result of their response plan, criticisms from parents who were not happy about the way in which the school responded (as reported in a 7 Days newspaper article):

“I’m amazed,” said one. “The building’s only four or five years old and three stories high.”

“Is the building structure really that poor they think it’s going to fall down?”

“It’d be nice to get a refund for the day, thank you very much.”

What those parents might have otherwise had to say if instead the school roof had collapsed on to their children is something I hope we never have to read, but anyway, I get their point.

So what do we have? Here is a school that reacted quickly to a potentially disastrous scenario but came under fire from “interested parties”, in this case, the parents. Clearly there is room for improvement here. It might be that the school did not communicate effectively when establishing the response plan. Consultation, transparency, communication, awareness, are all words that spring to mind. It seems that there is no requirement from the Dubai government to respond to an earthquake in this way since others schools remained open so this is a choice that the school has made for themselves. So let’s ask a question:

Was this reaction planned, or was it a knee jerk reaction?

It’s very possible that there was no risk assessment and no formal planning and this response was managed on the fly. If this is the case, the next thing to do would certainly be to recognize that the failure here was in not identifying the risk and subsequently preparing an appropriate response plan.

Parents played a key role in this response (they had to be at home or to make alternative arrangements with no notice and no support from the school) and where completely unaware of how the school would respond prior to the incident. A recipe for parental lash-back. In fact, on the day of the earthquake, children were sent home early, and notification of this was sent to parents by email only so depended heavily on parents checking emails and making the appropriate arrangements at the last minute. Thanks to inadequate communications planning and awareness as a part of the response plan, the school has taken a hit on its reputation.

If the response was formerly planned as a part of a business continuity management system, then the issue is similar, with the need for consultation, awareness, and communications looking to be a key candidate for improvement.

Case 2

Let’s look at two schools which responded in a different way, Gems Education and Taaleem, who both did nothing.

It turns out, it seems, that this was a good decision. The school didn’t collapse, and there are no parents asking for their money back. In fact, “doing nothing” is a valid and common business continuity strategy. However, the question here is:

Was the decision taken by an informed  management team based on proper planning and preparation or was it simply afright response similar to my own reaction in my apartment tower?

Let’s hope it was an informed and educated management decision as we don’t have to look too far back too see why these processes, as described in ISO 22301 and other standards, are so important! The Qatar Villagio nursery fire incident of 2012  is a shocking example of management failure at multiple levels and a prime example of why having an effective management system, and not just ticking boxes for compliance purpose, can be so important.

Conclusion

To summarize what I am highlighting here, management system effectiveness is an implied expectation of all management system standards.

Just doing something for the sake of doing something will lead to nonconformance because you are required by these standards to systematically: plan and set objectives that define what you are trying to achieve; then implement the system to achieve those objectives; and finally, you must monitor and review your achievements and act on your findings to make improvements.

If you didn’t achieve your objective, what will you change? If you did achieve your objective, how can you improve? This is the essence of “continual improvement” and therefore, an effective management system.

---

Advice on earthquake response

I've included some references here for earthquake response planning and the following is an excerpt from the US government site www.ready.gov suggesting what to do during an earthquake. Both ready.gov and the main FEMA website are great sources for emergency planning.

Different countries may provide different guidance however, so always check with your own local authority for appropriate recommendations.

During an Earthquake

Drop, cover and Hold On. Minimize your movements to a few steps to a nearby safe place and if you are indoors, stay there until the shaking has stopped and you are sure exiting is safe.

If Indoors

• DROP to the ground; take COVER by getting under a sturdy table or other piece of furniture; and HOLD ON until the shaking stops. If there isn’t a table or desk near you, cover your face and head with your arms and crouch in an inside corner of the building.
• Stay away from glass, windows, outside doors and walls, and anything that could fall, such as lighting fixtures or furniture.
• Stay in bed if you are there when the earthquake strikes. Hold on and protect your head with a pillow, unless you are under a heavy light fixture that could fall. In that case, move to the nearest safe place.
• Do not use a doorway except if you know it is a strongly supported, load-bearing doorway and it is close to you. Many inside doorways are lightly constructed and do not offer protection.
• Stay inside until the shaking stops and it is safe to go outside. Do not exit a building during the shaking. Research has shown that most injuries occur when people inside buildings attempt to move to a different location inside the building or try to leave.
• DO NOT use the elevators.
• Be aware that the electricity may go out or the sprinkler systems or fire alarms may turn on.

If Outdoors

• Stay there.
• Move away from buildings, streetlights, and utility wires.
• Once in the open, stay there until the shaking stops. The greatest danger exists directly outside buildings, at exits and alongside exterior walls. Many of the 120 fatalities from the 1933 Long Beach earthquake occurred when people ran outside of buildings only to be killed by falling debris from collapsing walls. Ground movement during an earthquake is seldom the direct cause of death or injury. Most earthquake-related casualties result from collapsing walls, flying glass, and falling objects.

If in a Moving Vehicle

• Stop as quickly as safety permits and stay in the vehicle. Avoid stopping near or under buildings, trees, overpasses, and utility wires.
• Proceed cautiously once the earthquake has stopped. Avoid roads, bridges, or ramps that might have been damaged by the earthquake.

Source: http://www.ready.gov/earthquakes

---

Did you experience the earthquake? How well prepared do you feel you or your company was? Feel free to share your own experiences.

Note also that the schools and any references to other businesses mentioned in this article are for illustrative purposes only and not based on first-hand factual information. Maybe they really do have good business continuity management systems?!