Our Business Continuity Planning Consultant recently brought our attention to the Cooper Colour Code, for companies to gauge their Risk Awareness levels when identifying and building their Business Continuity (BC) frameworks.
The Cooper Colour Code consists of 4 conditions; white, yellow, orange and red.
In condition white, you are relaxed and unaware of what is going on around you. In other words, you are completely unaware of events surrounding you and unaware of the possibility of an incident. A personal example would be walking around a high crime area (and not knowing that you are in one) wearing earplugs and gazing into a mobile device. From a corporate perspective, you may be ignorant (or in denial) of things like cyber-attacks or an increased threat of terrorist attack.
In condition yellow, you remain relaxed or, from a corporate perspective, it’s “business as usual”. However, you are maintaining awareness of your environment and who and what is around you. You are paying attention to the sights and sounds that surround you. On a personal level, this can be equated to loosely keeping track of anyone behind you and almost subliminally avoiding areas that could lead to danger. From a corporate perspective, you are maintaining what is called an “environmental scan” – in other words, you have the capability to operate an early warning system. You may be constantly scanning for operational anomalies (in terms of performance, transactions volumes or cyber security activity, for instance) keeping track of government terror alert status or monitoring reliable newsfeeds for advance warnings of civil disturbance (such as mass demonstrations). Condition yellow is not paranoia – it’s making sure you ready to respond at the earliest outset and have the capability to detect potential incidents before they actually manifest themselves.
In condition orange, you have identified something of interest that may or may not prove to be a threat. Until you determine the true nature of whatever has attracted your interest, your attention is narrowed to concentrate on the possible threat and will remain so focused until you are satisfied no threat exists or that threat will manifest itself imminently.
In condition orange, you should be expecting the attack and will be actively readying resources and strategies to deal with the threat. On a personal level this will be or any pre-visualized “what if” situations you’ve catalogued as possible solutions should an attack take place. On a corporate level you are on standby, mobilising resources according to the threat – you are poised and ready to respond
Condition Red is when you deploy, invoke and generally take action to counter the threat. On a personal level, it may be your fight or flight strategy – depending on how you have assessed the question. On a corporate level, it means you are declaring an incident invoking your incident management process in accordance with the nature and (currently known) impact.
We would add one additional section: “preparedness”. Coopers Colour Code is focused on situational awareness and no doubt anyone would disagree that this should be a major part of an organisations incident management framework. However preparedness ensures that our situational cognisance is supported and facilitated by an intrinsic capability to put response strategies into operation. In blunt terms it means that we are “tooled up”; that we have resources and technologies that will help to mobilise and respond and that responders are competent and proficient in the response and the use of tools that support response.
If you would like to discuss your BC preparedness please contact us and we can arrange an initial conversation with our BC Consultant.