BLUF – Challenges found in traversing thresholds into new spaces are exponentially amplified when thresholds are crossed urgently in an emergency. Fortunately, we plan for emergencies. Unfortunately, nothing goes according to plan. This post considers what we look for and find when crossing under duress.

Background – The previous post regarding liminal spaces discussed challenges found when traveling between places – physical/ emotional/ mental/ spiritual – where a threshold is crossed. Once crossed the first time (and to a lesser, pearl step extent, when you pass through the same threshold multiple times) we realise we missed or misinterpreted what we anticipated seeing – the interior of the room is different from what we thought was there when approaching the doorway.

This resonates in peace. Moreso when approached with urgency, in the case of emergencies.

For known emergencies we spend time pre-emptively cultivating the environment. Preparations are vital, reducing risks with what we include or avoid. These are implemented legally, contractually, physically, and mentally. We create policy and procedure, we test, we train and give awareness. We have fire extinguishers, lanes, doors and drills. We have conducted exercises and independent assessments, adopting all the best practices.

Then disaster hits. We cross the threshold.

When in the crisis, we have a live test of all our preparations.

Some of the response actions go according to plan.

Some critical pieces are found missing.

Some aspects fail under pressure.

Answers are demanded.

Decisions are made.

Chaos crystallises.

Dust settles.

And we emerge. Changed.

We can’t plan for every contingency, so we ideally embed flexible recovery – not just in our plans, but in our culture. We capture the processes, making certain to leave space in the checklists to adapt to unforeseen requirements (preferably without derailing known plans, communications, and cadence). Having a portion of the team operate in a reserve capacity or as a separate component to fill gaps we stumbled into may make all the difference.

In the incident and capturing the after actions, here are a few areas for future plans and procedures:

• Finding the thresholds articulating when a phase of operations is complete, another starting. Similar to cooking a meal, knowing the timing for various components is crucial. In many cases, you can’t move on until a set of core operations are complete. Here we sort what is required to advance to next phase whilst prioritising efforts, ensuring requirements are individually and collectively met.
• Concurrent efforts and non-essential players so we know who will be bearing the brunt of various operations during an incident – often they are equipped with near-linear, decision-tree type checklists. Other teams with minor responsibilities are referenced, though their duties – whilst important – aren’t part of the decision-tree and don’t fit squarely into the timeline. Support teams often are assumed to have necessary procedures established. Making things even more complex is multiple activities operating concurrently – different teams, initiated and potentially completed independent of one another (though with potential impacts to other groups if timed inappropriately). Support teams and concurrent efforts require a notion of which incident threshold must be reached before their roles are called upon and this is necessary to be articulated clearly when possible.
  • For example: public relations and internal communications may not aid in direct operational response efforts but are responsible for communicating messaging regarding the incident to external and internal audiences, respectively. Since it is likely they will have legal’s blessing for wording a message early into the incident, wouldn’t it be troublesome were either of them to get ahead of other messaging efforts which were intended to go forward first? Imagine senior leadership/ board/ insurers finding out about an incident from Reuters.
• Enquiries and bypasses Interpretation of liminal spaces for messaging offers challenges beyond the example, as you not only send messages out, but take incoming enquiries of varying degrees of import. Provisioning crucial buffers to incoming enquiries is often overlooked. Two forms of enquiries challenge responders – official and critical. Neither should be answered by those who are conducting response/ recovery efforts. Delegates, who understand the responder communications, can relay pertinent information to the requestor, and can either safely divert or keep completely out of the fray are ideal. This can also be the incident secretary, who would be responsible for tracking the times when action items are completed and creating the official incident dossier for future use if necessary. After all everything is messaging. And narrative voids can create other challenges.
  • Official enquiries often come in the form of organisations such as CISA who are looking for further information to pass on to safeguard other organisations, or the FBI who are looking for evidence in their case against the culprits. In both cases, answers are not immediately critical – although the enquirer’s tone might suggest otherwise. Answer at a convenient pause when there is sufficient data to make the call worth the time.
  • Critical enquiries are often from C-suite senior management/ board chairs/ relationship managers for high-value clients who are asking because they are protecting the business and relationships – from operational impact/ regulatory response/ reputational damage perspectives. Here, valuable communications prepare other areas in potentially bracing for impact and good care should be taken in what is relayed. Often not enough is known for concrete answers, however giving them the best understanding of where the team is and where challenges are present/ known and where likely impacts will be found is crucial to their crafting the best responses possible. Even though they are major players, in this they are stressed people responsible for the results of an incident beyond both their understanding and control.

For another post, perhaps… As you consider all the emergency liminal spaces you may encounter and traverse, just understand others may seek to exploit your circumstances or force perception of entering a false emergency.

In cyber – social engineering is founded on creating a sense of initial panic to trigger poor decisions. Just as any other threshold you approach – regardless the speed/ physical/ virtual natures – do so with caution.

Whilst patience isn’t always a virtue in incident decision making, a little understanding should precede blind rushes through liminal spaces .

-scl