A few years ago, I was a speaker at a series of Windows IT Pro events about security. Mark Minasi was also a speaker and would claim that he knew the secret to being a security guru and was going to teach it to everyone in the audience. He would then ask the audience to stand up and repeat after him: "The … sky … is … falling." Funny. Of course, this joke does beg the question: What would you do as an IT manager if someone came to you—from your company's security team or elsewhere—and made this exclamation? In any crisis situation, perceived or real, the speed at which decisions are made and the pressure felt by the individuals making them can lead to mistakes. Here are three rules to follow when you're managing a crisis situation. With a little practice, you can make dealing with emergencies as routine as a trip to the grocery store.

Rule 1: Stay Calm


Stay calm, both inwardly and outwardly. Becoming agitated will negatively affect your decision making and could spread panic. The people around you will likely become excited, emotional, and fearful—particularly if they feel they might be at fault. Be sure to smile, thank people for their help, and keep a positive yet realistic attitude. Your staff will be looking to you to be a leader and need to believe that the crisis will be averted or resolved, so it's your job to remain in control.

Rule 2: Drive for Certainty


Part of what drives panic in a crisis is the unknown. To remove this pressure, drive for certainty from the outset. As people bring you information, calmly ask where it came from, how it can be verified, and who is responsible for reporting any change in the information to you. Doing so will help you separate facts from fancy. If the alleged disaster really is a disaster, you need to be able to make decisions based on verifiable facts as often as possible, or else risk spending time on the wrong problems or even amplifying panic. Initially, you'll want to establish the following:

  • What is at risk?—How effectively you respond to the situation will largely be determined by what's at risk. Consider the following scenarios: Customers can't use their line of business (LOB) software; a tornado is approaching the building; a VP can't log on to his or her computer. Each of these situations might constitute an emergency that you have to deal with, but each is unique because of what's at risk—the business continuity of a division, human safety, or the business continuity of a user (albeit an influential one).
  • Who was the first observer?—Determining who the first person was to observe the situation helps you establish a timeline in which to place other observations, and also provides an excellent place to start investigating the facts.
  • What is the scope of the symptoms?—Determine exactly what's affected and when it was affected. Plot the logical and physical locations on a diagram and log the time on the master timeline. Plotting these things will help you look for the cause of the problem and for what might be affected next.
  • What would a successful outcome entail?—Determine early on the successful resolution to the crisis so that you can focus your efforts on success rather than on chasing dead-end leads or getting lost in details. For example, if an LOB application isn't available to a call center, the immediate goal is to restore the service, whether you find the source of the problem or not. You might solve the problem by initiating a business-continuity plan to move users to a different LOB server or by switching to a manual backup process.
  • Who else needs to be involved?—From the previously mentioned items, determine who you need to work with to successfully reach the goal that you've identified and what information and assistance you'll need and when you'll need it.

Rule 3: Communicate Clearly and Consistently


Few things amplify a crisis like confusion. On a whiteboard or wall, use Post-it Notes to create four columns, each with a heading describing the trust level of its information: Verified fact, Believed to be true, Rumor, Untrue. Place each piece of information that's reported to you into the appropriate column. Regularly report the overall status of the situation, the information gathered according to rule 2, and any other relevant information (along with the corresponding trust level), to the appropriate stakeholders. Over time, try to move all the information that's reported to you into either the Verified fact Untruecolumn.

Controlling Crisis Situations


Following these three fundamental rules will make responding to any incident less taxing for you and everyone around you. These rules will help you control the emotions, uncertainty, and confusion that are all endemic to a crisis situation. In reality, situations in which the sky is falling occur rarely, but practicing this column's advice—even in the course of routine operations—will prepare you for the worst.