CXO Insight Survey: Are you using the best practices for remote working resilience?

Our Challenge

In a crisis, organisations are faced with incredibly tough decisions to keep the lights on, and the mission focused on essential needs of customers, employees and in some cases the regulators they have to answer to. When disruption strikes, it does often by surprise, and we have to adjust plans to the situation as it unfolds. Being resilient is about flexibility and adaptability to continue your organisation’s most essential functions in a secure and trusted way. These best practices outlined below are intended to inform your planning and execution in advance of, or during a crisis. While there is an endless list of actions you must consider, we suggest focusing first on laying the groundwork to rapidly re-constitute core services remotely when the situation demands so.

Question Title

1. What is your role in the organisation

CIO

CISO

CSO

CRO

Other C-Suite Member Not Listed

Other Management Level Position Not Listed

Question Title

2. My organisation is involved in critical infrastructure support either as the designated owner, operator or providing services to one or more critical Infrastructures. These are the ones and this is our responsibility to that critical infrastructure:

	Designated Owner/Operator	Provides Services to
Power (Oil / Gas / Petro / Electricity/Renewable energy or similar)	Power (Oil / Gas / Petro / Electricity/Renewable energy or similar) Designated Owner/Operator	Power (Oil / Gas / Petro / Electricity/Renewable energy or similar) Provides Services to
Healthcare (Hospital, Pharmaceutical, Ambulance, Paramedics or similar)	Healthcare (Hospital, Pharmaceutical, Ambulance, Paramedics or similar) Designated Owner/Operator	Healthcare (Hospital, Pharmaceutical, Ambulance, Paramedics or similar) Provides Services to
Telecommunications (Data Centre, ISP, Phone Company or similar)	Telecommunications (Data Centre, ISP, Phone Company or similar) Designated Owner/Operator	Telecommunications (Data Centre, ISP, Phone Company or similar) Provides Services to
Banking and Finance (Banks, Finance Companies, Insurance, Stock Exchanges, or similar)	Banking and Finance (Banks, Finance Companies, Insurance, Stock Exchanges, or similar) Designated Owner/Operator	Banking and Finance (Banks, Finance Companies, Insurance, Stock Exchanges, or similar) Provides Services to
Government (Government Departments- Federal, State and Local, Civilian Agencies, Judicial, Non-Military)	Government (Government Departments- Federal, State and Local, Civilian Agencies, Judicial, Non-Military) Designated Owner/Operator	Government (Government Departments- Federal, State and Local, Civilian Agencies, Judicial, Non-Military) Provides Services to
Security & Emergency Services (Fire, Police, Military, Para-military or similar)	Security & Emergency Services (Fire, Police, Military, Para-military or similar) Designated Owner/Operator	Security & Emergency Services (Fire, Police, Military, Para-military or similar) Provides Services to
Transportation (Land, Maritime, Aviation)	Transportation (Land, Maritime, Aviation) Designated Owner/Operator	Transportation (Land, Maritime, Aviation) Provides Services to
Supply Chain (Food, medical supplies, building supplies, or similar)	Supply Chain (Food, medical supplies, building supplies, or similar) Designated Owner/Operator	Supply Chain (Food, medical supplies, building supplies, or similar) Provides Services to
Media (Television, Printed News, Social media platform)	Media (Television, Printed News, Social media platform) Designated Owner/Operator	Media (Television, Printed News, Social media platform) Provides Services to
Physical Infrastructure (Roads, Bridges, Major Facilities like Ports, Economic Free zones and similar)	Physical Infrastructure (Roads, Bridges, Major Facilities like Ports, Economic Free zones and similar) Designated Owner/Operator	Physical Infrastructure (Roads, Bridges, Major Facilities like Ports, Economic Free zones and similar) Provides Services to
None	None Designated Owner/Operator	None Provides Services to

Question Title

3. Does your organisation have a published Business Continuity Plan (BCP)

Yes

Question Title

4. How is your Business Continuity Plan (BCP) validated? (check all that apply)

We periodically send out the policy for management review and feedback

We have never validated our BCP Plan

We test our BCP plan with table top exercises at least once a year

Annual Full Cyber Exercise or Full Cyber-Drill, (not table top)

Question Title

5. The last time that you exercised the Business Continuity Plan either as a test or in a real situation, what was the outcome? Please select what applies.

It was executed well, everyone performed their roles as assigned, the lessons learned were fed back into the BCP plan within 3 months.

There were some important failure points, which were reviewed and corrected, the plan was updated within 3 months.

The plan was inadequate to the situation, and there were major failure points that seriously damaged the brand of the organisation as well as the financial position. The plan needed to be rethought from the beginning.

There was no plan, people ‘made it up’ as they went along. This caused huge losses.

We executed the plan in a real situation

We executed the plan in a testing scenario

None of the above – please explain

Other (please specify)

Question Title

6. How robust is your critical asset list (choose the best one)

We do not have a critical asset list but plan to build one

Kept in an excel spreadsheet or other static document

We have implemented an asset management system that is not linked to our business continuity planning

We have implemented an asset management system that is linked to our business continuity planning

We have a fully ITIL compliant IMDB that is continually refreshed and updated

Question Title

7. I would assess the maturity of our organisations business continuity plan as;

Level 1 – Non-Existent

Level 2 – Just getting started

Level 3 – We have a plan in place but it’s a copy of a template from downloaded ISO Certification Checklist

Level 4 – We have customized a template, and tested it

Level 5 – We have a solid plan, and it is regularly tested, and proven

Question Title

8. In the past 12 months Business Continuity Planning has been conducted with the C-Suite and the Business Unit Leaders

Never

Once

At least once a quarter

Monthly

Question Title

9. Who ‘owns’ the overall Business Continuity Responsibility as one of their key performance indicators?

CEO

CIO

Head of Risk

Business Unit Leader – Please supply title and to whom do they report for this function ion the 'Other' section

Other. Please supply title and to whom do they report for this function

Question Title

10. Where do you think your biggest risk is in navigating through the next major incident? You can indicate more than one risk.

The BCP plan itself may not be fit for purpose

The staff may not be trained well enough to deliver on the plan during the incident

The BCP has not been tested or tested well enough

The physical infrastructure may well not withstand a natural disaster

The technical infrastructure may not withstand a natural disaster or a cyber attack of any magnitude

Senior management have not been engaged in a leadership role

Our staff is spread so thin now, that it is likely they will not be able to navigate a major incident and keep the organisation functioning

We don’t have a PR plan to reach out to customers and the markets

We have not defined well enough our dependence on supply chain, customers, finance and other areas and planned to reduce those risks

Other (please specify)