Turning ready on paper into ready in practice
Stress testing crisis policies to give Definition confidence in its response before ever it’s tested for real.
Governance & Compliance: Regulatory readiness | Policies & controls design
Security & Resilience: Information security | Incident management | Business
Operating Model & Adoption: Operating principles | Process design
Delivery
SECURE & RESILIENT Blueprint
Background
Having grown rapidly through acquisition, Definition is a brand, marketing and communications specialist with c.100 people and 300+ clients worldwide.
A DATA Health assessment confirmed its technology was well managed, but focused attention on incident management, business continuity and disaster recovery and what would happen in practice:
Who would take control?
What would happen to the operation?
Who was responsible for what, and when?
Did they understand the role they would play?
Approach
AIK Advisory worked with Definition to turn its crisis policies into practical processes people could follow under pressure.
Protect: building crisis policies that work
AIK Advisory developed Definition’s incident management, business continuity and disaster recovery approach to ensure:
each plan addressed its distinct purpose
all three would work together as part of a coordinated response.
Navigate: challenging assumptions before they’re tested
Reworking the policies surfaced some potential gaps between what Definition might need in a crisis and what was available, and whether the gaps were material. AIK Advisory helped clarify:
what it could expect from suppliers
where responsibility sat
whether anything needed to change.
Embed: making people part of the plan
Existing roles, escalation routes and oversight were interrogated and redefined to establish:
who needs to be involved and what is expected of them
clear division of labour – decision-making, communications, execution
deputies and ‘command chains’.
The plans were signed off by the Board, with responsibilities communicated and acknowledged across the business.
Outcome
Enable: operational and commercial confidence
Definition now has a clear response it can follow, should the worst happen:
people and suppliers know their roles
they can focus on managing the situation rather than reformulating policy under pressure
robust plans help demonstrate to major and highly regulated clients and prospects that Definition is a well-run, resilient business.
Alan brought exactly the kind of constructive challenge we needed – questioning our assumptions, drawing on his experience and helping us to think through what would happen in practice. He helped us commit robust, easy-to-follow plans to paper, and ensure everyone understands them and their role in them.”
Adam Sumnall, CFO, Definition
Build resilience into your business
Let's talk about how to strengthen your disaster recover, incident response and business continuity planning, so that you’re ready to respond effectively when things don’t go to plan.
Related insights
Policies being ignored? Why it happens, why it matters.
Policies. Widely unpopular, critical to governance, often ignored. So how do you design, refine and embed policies that the business actually follows?
Related resources
What to do if you’ve had a cyber near miss: 9 practical steps
A cyber near miss could be a warning of something more serious. Discover nine practical steps to contain the threat, understand the risks and prevent further harm.