Business Continuity Management in PSAPs
- October 22, 2024
- Categories: Emergency call centre operations
Business Continuity Management (BCM) is a systematic approach to identifying potential threats to an organisation and developing strategies to maintain business operations in the event of disruption. The goal is to strengthen the organisation’s resilience, ensure that important processes can continue even in crisis situations, and limit damage. Continuous operational readiness is critical, especially in PSAPs, so the elements of BCM can be easily transferred to PSAPs. The types of events that require BCM are not limited to IT disruptions. The loss of personnel or damage to buildings also requires action.
Advantages of a BCM
The advantage of a functioning BCM is a minimisation of downtime: well-prepared emergency plans can shorten the time PSAPs are interrupted in their operations. This also ensures that trust in public services is maintained: PSAPs that can deal with crises quickly and efficiently gain citizens’ trust.
The following describes the procedure for a BCM and presents examples of solutions for PSAPs. Of course, the solutions here can only ever be mentioned in general terms. Ultimately, each PSAP must find the best individual procedure for itself.
BCM, in a nutshell
The most essential elements of BCM are risk analysis, business impact analysis, recovery strategies and plans, crisis management, exercises, and continuous improvement. First, the components are briefly explained. The individual elements are then discussed in detail below.
Risk analysis: First, potential threats that could threaten the PSAP are identified. These can include natural disasters, cyber-attacks, pandemics, or technical disruptions. All these risks must be assessed regarding their likelihood of occurrence and possible impact on the individual PSAP.
Business Impact Analysis (BIA): This determines which processes are particularly important for the operational readiness of the PSAP. The aim is to identify the critical processes and set priorities for their recovery.
Recovery strategies and plans: Based on the risk analysis and the BIA, strategies are developed to maintain the operation of the PSAP or to restore it quickly in the event of a disruption. These include emergency plans, alternative working methods, backup systems, and agreements with external service providers.
Crisis management: A central component of BCM is functioning crisis management. This includes clear communication channels and defined responsibilities in order to be able to react quickly and efficiently in emergency situations.
Training and exercises: In order for the emergency plans created to work in an emergency, they must be regularly tested and simulated. Regular staff training ensures that employees are prepared in an emergency, failures are detected in good time, and the operational readiness of the PSAP is maintained.
Continuous improvement: BCM is not a static process. It requires regular reviews and adjustments to changing conditions, new threat scenarios or technological developments.
Risk analysis
A PSAP is exposed to various risks. The likelihood of a hazard occurring must be assessed individually for each PSAP. For example, for a PSAP built in a building next to a body of water, the risk of flooding must be higher than if the building is on a mountain. The following hazards should be given special consideration, although this list is not exhaustive:
| Hazard | Description |
| Cyberattack | For example, through unauthorised intrusion into the PSAP systems or through DoS attacks. |
| Fire | There is a fire in the PSAP or in part of the PSAP. |
| Natural disasters | Natural disasters can directly affect the operation of the PSAP. But they can also lead to a failure of the PSAP by destroying general infrastructure. |
| Disruption of communication networks | This also includes the communication networks of the general infrastructure. |
| Power outage | Power outages can also affect the general infrastructure on which the PSAP depends. |
| Software vulnerabilities | Errors in the software can lead to immediate failures in the PSAP or enable unauthorized persons to penetrate the PSAP’s IT systems. |
| Staff shortages | The PSAP staff can be unavailable unexpectedly, for example due to illness, accident or death. |
| Terrorist attack | An attack can lead to the entire PSAP no longer existing. |
Business Impact Analysis
Receiving emergency calls and alerting emergency services is one of the critical processes in every PSAP. The functioning of these elementary processes has the highest priority in every PSAP. However, several other processes significantly influence a PSAP’s operational readiness and must not be neglected during a recovery.
For recovery, it is essential to prioritise these processes accordingly. Processes are often carried out in several ways. For example, in many countries, an emergency report can be received by phone, SMS, or via an app. Due to the frequency of use by citizens, it can make sense to prioritise emergency calls by phone over SMS or the app.
Strategies and plans for recovery
After the possible hazards and critical processes of the PSAP have been assessed, the results must be used to develop a strategy for reacting to a crisis.
If the CAD or communication technology in the PSAP can no longer be used, alternative working methods must be used. The focus must be clearly on the essential processes in the PSAP. At the top of the list is, of course, receiving emergency calls via the emergency number 112 and alerting emergency services. For emergency calls, it may be necessary to have a telephone system that is physically separate from the existing PSAP systems. Applications designed explicitly for failure can also be suitable for processing emergency reports. In the simplest case, it should be ensured that there is sufficient paper and pens available at every workstation in the PSAP. Alerting emergency services also requires an alternative method if the usual systems fail. If emergency systems cannot be used, at least current telephone numbers for the rescue organisations should be available in the PSAPs. It must also be clarified which telephones can still be used to call the emergency services if the primary systems fail.
A strategy must be developed for restoring the PSAP systems from the backups. All systems directly related to processing emergency calls and alerting emergency services should again be given a very high priority. On the other hand, systems that provide statistical data can be given a lower priority during restoration.
Support from external service providers may be required for restoration. Once the disruption has occurred, there is usually no time for extensive research into which service provider could help in the specific case. This research should be carried out calmly while the systems are still running. Also, specific contact persons or contact addresses should always be available for the service providers. In addition to the manufacturers of communications technology and CAD, PSAPs are usually also the telecommunications providers that provide emergency call connections. However, help from special IT security service providers should also be considered if this expertise is unavailable in the PSAP. If the service providers in the PSAP network are already familiar with the system due to previous contact, it will be easier for them to find their way around more quickly in the event of a crisis.
All these plans must always be readily available in the PSAP. It is important that access to the emergency plans themselves is not impaired due to a possible failure.
Crisis management
Clear communication channels: Internal and external communication are important in BCM. External communication must prevent speculation, which can lead to uncertainty among the population. It must be defined who will inform the public if the PSAP fails. But informing your own staff must not be neglected either.
Define responsibilities: If it is clear in advance who has which responsibilities, the PSAP will save itself a lot of stress in a crisis.
Training and exercises
First, it must be ensured that employees are trained to recognise a fault in good time. Only then can you activate the other measures to maintain the operation of the PSAP. The measures must also be trained. The measures should be practised regularly to ensure that everything works as smoothly as possible in the event of a crisis. Only if employees are familiar with the operation of the emergency systems can the operation of the PSAP be guaranteed, even under the stress of a fault.
After the exercises, processes that did not work well may need to be revised and trained again.
Continuous Improvement
The entire BCM must be reviewed regularly. Improvements can be made based on findings that have emerged during exercises. Adjustments can also be necessary due to changed conditions. These can be new threat scenarios or technological developments. For example, in the future, if the CAD fails, the PSAP will also have to develop alternative methods for processing emergency messages that are received in the PSAP via real-time text.
Lessons learned
Business continuity management is an essential part of any PSAP. It helps build the resilience of the PSAP by preparing for potential crisis situations and developing quick, effective countermeasures. PSAPs that successfully implement BCM are better able to recover from disruptions and remain operational in the long term.
Henning Schmidtpott
Share this blog post on: