Leading Through Crises: Communication, Collaboration, Coordination

An organization's personnel can be the strongest or weakest element of any security strategy. In times of national crisis, such as the COVID-19 pandemic, tensions can run high, and conventionally manageable stresses can accumulate and degrade focus, performance, and mental bandwidth. At the 2020 ICIT Fall Briefing, Scott Breor, the Acting Deputy Assistant Director for Infrastructure Security at the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, proffered some strategies that he implemented in his personal life and in CISA to mitigate distracting stressors and help CISA's staff adapt to the evolving demands imposed by the pandemic. CISA is tasked with securing the nation's sixteen critical infrastructure sectors against emerging threats and coordinating with public and private sector partners to improve critical infrastructure security and resiliency. He joked that their unofficial motto is, "Defend Today, Secure Tomorrow." CISA provides technical assistance, security advisory, educational training and exercises, best practices, and mitigation strategies to critical infrastructure stakeholders. CISA also helps critical infrastructure organizations manage their risk, build security programs, and improve their resiliency.

When COVID-19 spread and developed into a nationwide crisis, CISA recognized that they would need to provide resources to help critical infrastructure stakeholders adapt to the pandemic. However, they also realized that to do so effectively, they would also have to evolve their workforce and adapt to the "new normal."

Prepare Where You Can
A certain amount of every successful response to a crisis is "luck" in the form of premeditation. With the shutdown mandate, D.C. and the CISA building were restricted to only essential personnel. The change in operating posture also presented a change in the operating environment that necessitated adaptation. "Luckily," CISA had already replaced static desktops with mobile laptops, and they had already migrated many applications to the cloud. Their impetus for transitioning their systems to be more flexible stemmed from their crisis plan concerning inclement weather or widespread disruption. Their scenario-driven planning had necessitated that operations would not cease if external conditions were imposed on the workforce.

Adapt Where You Can't
Mr. Breor explained that in early 2020, CISA made decisions to adjust their work environment and operating practices and programs to ensure that they could continue to deliver products, resources, and tools to stakeholders despite the ongoing crisis. Personnel was given leniency to complete their work under the changing conditions. While technical controls were being implemented to secure the networked infrastructure, cultural strategies were being implemented to preserve employee mental health and wellbeing, work-life balance, and stress. Staff was trusted to complete their work while remaining safe, caring for their families, and adapting to the pandemic's prevailing conditions. By not requiring adherence to a rigid "one-size-fits-all" model of the workday, CISA reduced stress on personnel and increased productivity – as staff would not be distracted during meetings or overly pressured to conform to a work-schedule that conflicted with the needs and safety of their family.

Communicate in All Directions
Mr. Breor emphasized that communication was pivotal to the successful migration and adaption of the workforce. Leadership needed to understand their staff's needs and develop and communicate meaningful strategies to accommodate or address those needs. He believes that effective communication is more than just meetings, presentations, and emails. It needs to be an active dialogue where participants feel comfortable conferring their ideas, sentiments, troubles, and any obstacles they might encounter. It needs to be proactive and constructive rather than automated and routine. In addition to strategically ensuring transparent dialogues, mechanisms were implemented to guarantee consistent communication. In effect, focusing on communication empowered CISA to operate with a unified mission and purpose throughout the organization.

Hold Each Other Accountable
As part of clear and open communication, leadership and subordinates need to be comfortable conveying expectations and holding each other accountable. To work towards a unified purpose, all participants must actively contribute to progress. In the words of Mr. Breor, "Employees can only be accountable for what's expected of them. And to hold remote workers accountable, managers must provide clear and collaborative expectations."

Individualize Expectations
Trying to develop a "one size fits all" paradigm for expectations sets up your organization for conflict and failure. Instead, Mr. Breor suggests managers understand the needs of their staff, set clear high-level expectations of a task or mission, and then be flexible to how the work is achieved and adaptable to the worker's needs. For example, with regards to the transition from a typical "9 to 5" workday to the remote environments, he remarks, "It's not expected that you're going to work eight straight hours. It's expected that you're going to work eight hours that day. So, if you need to take a break or do something to help with children at home, who are virtual learning and having issues, you can do that."

Responsibly Allocate Mental Bandwidth
Stress detracts from the attention centers of the brain and leads to a decrease in efficiency and stamina. Mr. Breor found that setting a "no meeting day" helped his staff decompress from the deluge of virtual calls, meetings, and webinars that many found disruptive to their workflow. He also recommends individual or group exercises whose sole purpose is to alleviate stress by shifting focus away from work.

Conclusion
CISA offered significant, meaningful guidance, such as the COVID-scam advisories and vaccine supply chain guidance, to the critical infrastructure communities by empowering their personnel to gradually adapt to the "new normal" at their own pace. By leading with empathy, Mr. Breor was able to institute a culture that leveraged existing capabilities, identified and adapted to emerging challenges, prioritized communication, effectuated accountability based on individualized expectations, and ensured his staff's mental health and wellbeing. Based on the demonstrative achievements of CISA in 2020, it is clear that his approach of "adapting the working environment to the needs of the people" instead of "evolving the people to the needs of the workplace" proved effective.