The value of preparation for post-incident organisational recovery is only visible on the day it is needed. Guard force performance on this part of corporate security practice reflects supervision, not instruction. Participants gain a clear basis for measuring what the wider corporate security practice agenda has actually achieved. It is written for people who have to make post-incident organisational recovery work with the resources they already have. Discussion is anchored to worked examples of the corporate security practice discipline rather than to abstract argument. The course gives participants a defensible structure for this aspect of corporate security practice and the judgement to adapt it. Practitioner evidence points the same way: post-incident organisational recovery improves fastest where responsibility for it is named and owned. Improvement in this part of corporate security practice stalls when it depends on one capable individual rather than a defined method. The final module sets out how progress on this aspect of corporate security practice will be evidenced six months later.
Expected Learning Outcomes
✓
Design business continuity arrangements covering post-incident organisational recovery.
✓
Establish escalation routes for post-incident organisational recovery that work outside normal hours.
✓
Identify vulnerabilities in post-incident organisational recovery and rank them by consequence.
✓
Balance security requirements in post-incident organisational recovery against operational practicality.
✓
Set the minimum documentation for post-incident organisational recovery that is genuinely necessary, and stop there.
✓
Review post-incident organisational recovery after each incident, exercise and change of threat.
✓
Select indicators that show whether post-incident organisational recovery is improving, and reject those that only look useful.
Who Should Attend
✓
Staff seconded into improvement work on post-incident organisational recovery.
✓
Business continuity and crisis managers covering post-incident organisational recovery.
✓
Analysts producing the data on which decisions about post-incident organisational recovery rest.
✓
Investigation and loss prevention specialists working on post-incident organisational recovery.
✓
Information security staff whose remit overlaps post-incident organisational recovery.
✓
Human resources staff handling vetting and insider risk in post-incident organisational recovery.
Course Modules
Open any module to see its sessions and topics.
01
Post-incident organisational recovery: procedures, access control and identity
2 sessions · 8 points
Session 1Handling evidence from post-incident organisational recovery so it survives scrutiny
Identify the data already collected that bears on post-incident organisational recovery.
Confirm vetting standards applied to staff and contractors in post-incident organisational recovery.
Define the first response actions for an incident involving post-incident organisational recovery.
Coordinate arrangements for post-incident organisational recovery with civil defence and police in advance.
Session 2Getting other functions to support post-incident organisational recovery
Exercise the plan for post-incident organisational recovery under realistic conditions and record failures.
Establish the boundary of post-incident organisational recovery and record what sits outside it.
Establish who is informed, consulted and accountable in post-incident organisational recovery.
Assess insider risk in roles with privileged access to post-incident organisational recovery.
02
Post-incident organisational recovery: insider risk, vetting and personnel security
2 sessions · 8 points
Session 1Supervising the guard force on post-incident organisational recovery
Prepare the summary of post-incident organisational recovery that senior management will read.
Set escalation criteria and out-of-hours contacts for post-incident organisational recovery.
Define acceptance criteria for post-incident organisational recovery in advance.
Map the handovers in post-incident organisational recovery between functions and secure them.
Session 2Moving post-incident organisational recovery from approval to execution
Report on post-incident organisational recovery in terms that support an investment decision.
Identify vulnerabilities in post-incident organisational recovery and rank them by consequence, not ease of fix.
Record the rationale for each significant choice made about post-incident organisational recovery.
Assign responsibility for keeping documentation of post-incident organisational recovery current.
