4 minutes
As events last year in Paris, San Bernardino, and elsewhere have shown us, we can no longer bind ourselves to the idea, “It can’t happen here.” Nothing in our nature as not-for-profit financial cooperatives makes us immune to acts of terrorism or active shooter incidents. We must examine the risks, create response plans, and ensure staff members are trained and prepared to carry out these plans.
This article is intended to provide suggestions and note resources your credit union can use in developing your response plans. It is divided into four sections: offsite (non-branch) considerations, onsite considerations, scenario planning, and finally a list of additional resources.
Offsite
There are many situations in which a group of credit union employees or employees and members may be gathered away from a credit union office/branch:
- credit union annual meeting,
- employee training or recognition events,
- participation in a local parade or other event (e.g., cancer walk) or
- a “booth” set up at a community event.
For credit union-sponsored events, a security checklist should be used to note and confirm security- or emergency-related items for the location. For example, include the location of and the paths to all exits, the location of sprinklers and/or fire extinguishers, the locations of fire alarms and testing verification records, the location and probable response times of first responders—and which, if any, first responders and employees with medical training will be attending. This information can then be used to develop and work through various, “What if…” scenarios (discussed below).
For non-credit union sponsored events, the credit union should review what security or emergency planning and precautions the sponsors have made. As with credit union-sponsored events, attending employees should be made aware of this information and prepared for various incidents. Credit union employees attending offsite functions, such as conferences, should be taught to note the locations of exits, evacuation routes, fire alarms, and aid/security stations.
Onsite
In many cases, credit unions have plans for “traditional” incidents (robbery, fire, bad weather) and have made response training for these occurrences standard. It’s a good idea to add active shooter and terrorism scenarios to such training.
Scenario Planning and Development
A key aspect of developing and examining scenarios for terrorism and active shooter incidents is examining and integrating credit union plans with those of the first responders (police, fire, EMT) who will be called to the scene. This can prevent a bad situation from getting worse. Consider these possible contradictions:
- The credit union’s response plan calls for an evacuation of the premises; the first responder’s plan calls for “stay in place” or lock-down.
- The credit union’s plan relies on immediate or quick EMT/paramedic access to the facility; the first responder’s plan calls for a delay in EMT/paramedic access until an “all clear” has been sounded.
Coordinating credit union and first responder plans can be accomplished by meeting and working with local police, fire, and EMT representatives. Creating and maintaining lines of communication can also bolster confidence (on both sides) that these situations, response plans, and training are taken seriously.
Another aspect of this coordination can be found in understanding, planning, and training staff on the FBI-recommended actions for active shooter incidents: 1.) run, 2.) hide and 3.) fight.
Here are examples to consider in your scenario planning:
- You are hosting your annual meeting in the banquet room of a large hotel when you hear a number of loud “bangs” coming from outside. You believe the sounds could be gunfire.
- You are staffing a booth at a local fair and you feel an explosive bang and see smoke rising 200-300 yards from your booth.
- …and you hear gunfire…
- Members of senior management are attending a convention. Gunmen burst into the facility and open fire.
- You are one of the attendees…
- You are the management team back at the CU…
- Employees arriving at your office one morning find a backpack leaning against the front doors.
- In the middle of your busy period on Friday there is a large explosion in your parking lot close to the facility.
- You have a branch in a shopping mall or mall store. There are a number of explosions outside and the sound of multiple guns firing, suggesting the possibility of multiple attackers.
Additional Resources
Your credit union can find additional information on planning for terrorist and active-shooter incidents via these websites:
- Federal Bureau of Investigation on active shooter incidents
- Department of Homeland Security on active shooter preparedness, preparing a business for emergency and first responder guidance.
Terrorist or active situations are very frightening because they are beyond our control. However, it is within our control to acknowledge these situations can occur at our credit unions and to our employees; determine how we will respond to these situations; and ensure employees are trained to respond in a calm, self-assured, and controlled manner, limiting the damage these situations can cause.
Jim Benlein, CISA, CISM, CRISC, owns KGS Consulting, LLC, Silverdale, Washington, and offers insights to CUs on information technology governance, information security, and technology risk management.
