Thought Leadership
Adaptability stands as the cornerstone of a company's success. This is the premise of the Gamechangers in Resilience interview series, our tribute to the leaders who build resilience into the fabric of their organizations, one decision at a time.
This edition brings together two people who came to resilience from different starting points and landed on many of the same conclusions: Cameron Sullivan, who has spent years building cohesion across a business resiliency team and its enterprise partners, and Nelson Sera, PenFed's inaugural Incident Manager.
Neither of them set out to work in resilience. Cameron found it through an internship with a professor who moonlighted as a business continuity consultant. Nelson found it because PenFed had a gap in its program and he raised his hand. Four months later, the interim job became the job. What they've each built since says a lot about the discipline's evolution.
Q: How did you get your start in resilience?
Cameron: During my undergraduate degree, I began an internship with a former professor who also happened to be a business continuity and leadership consultant.
Nelson: I had an unconventional start in resilience. While working at PenFed, a gap was identified in the company's program, and I stepped in as an interim incident manager to help fill that need. After about 4 months, I officially took on the full-time role for the position I hold today as PenFed's inaugural Incident Manager.
Q: What part of your program are you most proud of that people outside your team rarely see or understand?
Cameron: I am most proud of the cohesiveness and unity that we've not only built within the business resiliency team, but with our enterprise partners. In addition, taking a step back and enhancing the foundational approach to the program, through industry standards and regulation, policy, and practicality, has greatly contributed to the success of the program.
Nelson: It really comes down to the relationships we build with business units across the organization. It's something that can easily be overlooked, but it's critical to everything we do. Resilience touches everything, so to bring real value we must actively partner with stakeholders. Regardless of if it's during the BIA process or when we're managing through incidents, by closely collaborating with stakeholders, we're able to get the most accurate and meaningful information and action from them.
Q: Where have you intentionally prioritized usability over perfection, and how did it pay off in a real-world scenario?
Cameron: Transitioning the business impact analysis to an agile and automated system of record. When first developed there was plenty of room for improvement, but throughout the few years after, it has continually seen enhancements. Since then, it has been used for multiple incidents for easy dependency identification and serves as a basis for identifying key players during exercise development.
Nelson: In every incident we have to prioritize usability over perfection. It's important to always put our members first in what we do. Sometimes that means putting a temporary workaround in place, even if it's a bit more time-consuming or requires extra effort for our teammates. The goal is to ensure our members have access to the products and services as they expect. Meanwhile, we will be putting in the effort to restore everything to full capacity as quickly as possible.
A plan that's technically complete but too slow to use in the moment isn't actually finished.
Q: What's one element you've built that's now so embedded, people don't even realize it's part of a resilience strategy?
Cameron: Leadership support is integral to the success and progress of any business continuity program. Over time, we (the entire team) have moved beyond resilience as a compliance measure to a capabilities and preparedness measure. Through senior engagement and showcasing the value of the program, we have garnered strong support at all levels to achieve great success.
Nelson: I agree with Cameron, having leadership support and buy-in has been huge for our resiliency strategy. When leadership is on board, that is passed down through the whole organization, which helps us show the business units that what we're doing matters, and helps them maintain their operations when we face incidents.
Q: How have you adapted your continuity or incident plans to reflect how people behave under stress?
Cameron: Response plans are often overburdened by information that may only be a distraction during an incident. Streamlining and enhancing the plans with a focus on being useful but thorough reduces churn time during response, leading to more rapid response and recovery.
Nelson: Our team has put a lot of effort into making our plans truly useful by removing unnecessary details and focusing on what matters most. As people join or leave the organization and roles evolve, we've built in live links within our plans so that updates to key information automatically carry over. This ensures we have the most current information available so when an incident happens, it's one less item to think about and we can respond as fast as possible.
Q: What's a gap you discovered through exercises or real events that led to a major improvement in your approach?
Cameron: Recovery Time Objective and Recovery Time Capability as well as severity of response actions aren't always aligned across the organization, especially between business units and their technology counterparts. Through enhancing exercises and microsimulations with a focus on understanding needs across the organization, we've become more prepared and understanding of how different lines of business can seek to continue accomplishing each other's needs during an incident.
Nelson: One thing I've discovered is that while we often have workarounds or manual processes in place, they're not always documented. This can create challenges, for example when someone leaves, that knowledge leaves with them. We're now focused on documenting these manual processes across the organization so that all this information lives within our Business Continuity Plans.
Q: How have you made vendor continuity or third-party risk actionable?
Cameron: Zero in on what matters most, high risk and highly critical vendors and dependent business processes. Rather than inadvertently focusing on all things at once, our programs and exercises focus on processes with the highest tangible and intangible values, prioritizing their risk vectors and mitigating impacts.
Nelson: I live in the world of incidents, so when it comes to making vendor continuity actionable, I must capture the specifics of incidents so we can take the necessary steps. I raise any concerns to be addressed with the vendor relationship owner, Third-Party Risk Management team, and my team, Business Resiliency. From there, we can take the necessary action with the appropriate subject matter experts. This can be revisiting and renegotiating SLAs or raising awareness around vendors that pose a higher risk for evaluation.
Q: What's one process, playbook, or tool you built that teams now ask for?
Cameron: Iluminr's microsimulation capabilities have become a tool that is being requested by our business units, with examples being a simulation surrounding identity and access management all the way to another focused on specific individual's understanding of their roles and responsibilities, both normally and during an incident.
Nelson: Our playbooks are something teams consistently asking for. We're focused on streamlining our responses as much as possible, and the playbooks play a big part in that. Many teams have asked us to continue expanding this library, especially for incidents that tend to follow similar response efforts so we can respond faster and more efficient.
Q: What have you done to ensure your program grows with change?
Cameron: One major push that the program is working towards is furthering agility and automation of the program. By reducing the administrative burden that the program can have on both the business resilience team and our partners, we have more time to focus on what matters most - building actionable response procedures and highly capable partners.
Nelson: Overall, we've expanded our team to keep pace with the organizations growth. At the same time, we're always looking for ways to leverage emerging and evolving technologies so we can use modern tools to address modern challenges.
Q: How do you apply the lessons of resilience in your everyday life?
Cameron: That's a big question. Building your everyday life "resilient by design" is multifaceted. With every risk, I envision controls that should be implemented in response: building financial stability in case of unstable economic conditions, keeping a reliant vehicle, even carrying an umbrella in your car. These are all done with the focus on mitigating the impact, being prepared, and overall reducing life's uncertainties. Most people build resilience in their lives, but they don't think about it, its just human nature.
Nelson: I apply lessons of resilience in my everyday life by focusing on preparation and practice. This builds confidence to respond effectively when challenges come up.
As the late Kobe Bryant said, "Confidence come from preparation....I'm not asking myself to do something I haven't done thousands of times before."
While I may not face every scenario thousands of times, being prepared allows me to approach challenges with composure and confidence.
