12 minute read
Developing a Culture of Resilience
Developing a Culture of Resilience to Successfully Manage the Next Crisis
by Jeff Treffinger, Senior Vice President of Environmental, Health and Safety (EHS), Amentum
As we progress through various stages of reopening, more people are returning to the workplace. There has been much discussion both within government and within the government contracting community about when and how to reopen offices, and how to best protect workers as they return.
Some workers, particularly those supporting critical missions in government and in the private sector, continued to work safely throughout the early months of the COVID-19 pandemic. What enabled these organizations to continue the mission without seeing outbreaks among their workers? What lessons can we take away from this experience as we prepare for the next crisis? To answer these questions, we must first define what success looks like.
What defines success?
Successful continuity of operations during a pandemic must include several key elements. First, essential operations such as those supported by the Defense Industrial Base must be able to continue as needed. Some of these might include operations and maintenance or security functions. For highhazard work that is suspended, it must be able to successfully restart without incidents.
Second, the organization must stay true to its values and priorities and maintain focus on the overall business strategy or mission initiatives. Highly successful organizations will use the crisis as a catalyst to innovate and optimize traditional standard business practices. In all cases, the health of workers must be protected, so the infection rate must be kept low.
The key ingredients
Prior to the emergence of COVID-19, successful organizations had protocols already in place. For those that had a standard pandemic response plan, it took less time to create a tailored COVID-19 response. A strong culture of safety and occupational and public health expertise enabled swift implementation of calculated safety protocols at these companies.
Organizations that could quickly pivot had the ability to make necessary changes and had an immediate advantage. Early and consistent communication between leaders anticipated these needs, such as increasing VPN bandwidth, to enable the shift to telework. By allowing work to continue, organizations were able to lessen the impact to their bottom line.
Practice how you fight
Our military partners know the value of exercising their people and processes; it is no less important for those of us who partner with the government to do the same. Exercise can address all types of crises, ranging from a security breach to a hazardous material incident to a global pandemic.
Although it’s impossible to practice every scenario in the field, companies should set aside time to convene key decision makers to work through crisis scenarios that could occur within normal operations. In addition to identifying what to do, these types of activities better position the organization to respond to any emergency, even those that could not be predicted, ultimately establishing a culture of resilience.
The X factor: Leadership
Resilient leaders facilitate decentralized decision making, resulting in speed and agility within the ranks. Agile organizations will also be more adept at quickly integrating company, customer and facility requirements, furthering their ability to operate throughout the crisis.
For weeks, COVID-19 was the topic of almost every news story. Our people were continually bombarded with messages about the pandemic, and the result for many was fear. In this environment, direct communication from leaders to employees was more important than ever; frequent messages from company leaders set successful organizations apart in this crisis situation – even when we didn’t have all the answers.
A culture of safety
Amentum had a strong focus on safety well before the emergence of the coronavirus, largely due to the nature of our work. We support high-hazard, high-consequence, operations.
From this vantage point, we see the factors that separate organizations that successfully continued operations during COVID from those that were more heavily impacted. By having crisis protocols in place, by practicing scenarios, and by engaging in frequent leader communications with employees, Amentum has built up resilience within our organizations over time. As we return to facilities and settle in to the new “normal,” companies should refocus efforts on those activities that will improve their odds for success when the next crisis emerges. 3
by Shawn James, President, Transformation Systems, Inc.
The COVID-19 pandemic and recent social unrest have fundamentally changed the way the professional services industry and our government clients operate. While leaders try to anticipate the post-pandemic business drivers, the future remains unclear amid concerns of economic uncertainty, a potential second wave of the virus, and untold social parity measures. What is clear is that we cannot simply revert to the old normal; instead we must reinvent our businesses for the next normal. When we face extraordinary circumstances, it is always transformative. Whether we intend to transform or not, it happens naturally to everyone in every facet of an organization.
This transformation is an opportunity that can be channeled to make us better leaders, be more mission-oriented employees, and become superhero-like as the best, strongest version of ourselves. Individual behaviors and organizational mindsets can help each of us summon our superpowers and reinvent our futures to achieve success.
Our team at TSI has found that people who succeed in uncertain times and bring about remarkable results in their business endeavors and in their personal lives attain mastery in four specific areas. We’ve rolled these concepts out across the Navy’s acquisition workforce of ~65,000 public servants as part of our LEAP (Leadership Effectiveness and Potential) Program and observed similar positive trends that result in higher employee morale, more engagement and higher productivity. These are quantifiable results that can be measured by either the Federal Employee Viewpoint Survey for government employees or by your organization’s climate assessment.
These four masteries are more important now than ever. You, too, can tap into your “superpowers” and motivate those around you with the following masteries: 1. Personal Mastery: cultivating commitment, curiosity, and courage. Commitment to your goals. Curiosity that stretches your imagination, introduces you to new ideas, and helps you find new solutions to problems. Courage to eschew the status quo, take risks, and be willing to learn from failure. Individuals at all levels are being asked to step out of their comfort zones to confront challenges, help a colleague, and do more. 2. Interpersonal Mastery: focuses on being able to connect, communicate, and collaborate. Connect,
understand, and empathize with people across diverse backgrounds. Communicate new ideas and approaches to a solve old problems and unheard-of challenges.
Collaborate using technologies that stretch knowledge and skills. We’ll be positioned for success as we accelerate best practices around these elements. 3. Organizational Mastery: a critical tool amid a crisis and post-crisis. All employees must have a deeper understanding of their coworkers and the processes and products they provide. We must see how it all fits together in the big picture. This allows us to make smart, futureoriented decisions for the outcomes we desire. 4. Motivational Mastery: engaging, elevating, and energizing those around you whether you are formally a supervisor or not. Today’s “Essential Employee” is different than we envisioned them to be last year. Your team and colleagues are looking to you for cues, and now is the time to create an environment that fosters inclusivity and development to create sustainable achievement in your organization.
We can all summon our strengths for the post-pandemic future and beyond, to achieve remarkable results for our customers, our organizations, and ourselves. 3
Sharing Secure Communication When SCIF/SAPF Hits the Fan
by Mitch Lawrence, CEO, Lawrence Solutions LLC
Crises tend to expose things that we all have known about but have put off addressing. We learned during the last few months that those cleared to use secure communications at their work sites are not eligible at other sites due to “need-toknow” and/or administrative policies not necessarily related to physical security. This seeming paradox requires change, with the goal of ensuring that appropriately cleared workers can gain access to and use corresponding secure communications wherever that may be possible.
When many US Government highly secure facilities— Sensitive Compartmented Information Facilities (SCIFs) and Special Access Program Facilities (SAPFs)—across the nation were closed due to the COVID-19 pandemic, contractors working in those facilities no longer had access to do the classified work required to perform their companies’ contracts.
Naturally, workarounds would be explored and achieved. But unlike past local crises like Hurricane Katrina, 9/11, etc., this crisis went beyond regional and nation-wide limits to impact the entire world. This meant workarounds have been difficult but, maybe also fortuitously, revealed a shortcoming in access to secure communications.
Several people raising this issue about problematic SCIF/ SAPF access during the ongoing crisis have complained of a failure of facility reciprocity. This is not true in general, so what does the SCIF/SAPF policy say?
Director of National Intelligence (DNI) Intelligence Community Directive 705 (ICD 705) and associated policies governing SCIFs/SAPS establish cleared facility “reciprocity” for the federal government and its contractors. But this reciprocity has to do with construction requirements, not reciprocity of personnel access, or as germane to this issue, sharing of secure communications. Just the same, ICD 705 policies allow for the temporary storage of classified material not normally associated or approved for a SCIF or SAPF. It also permits the creation of Temporary SCIFs (TSCIFs) when following the approval guidance in the policy. And it
establishes an entire process, including a form documenting consent by the agreeing agencies, for co-using and joint-using facilities and classified information systems, respectively.
Why, then, have these available paths for access to SCIFs and SAPFs been problematic in the present time of great need? In a brief survey conducted with a dozen companies’ ICD 705 physical security professionals who collectively oversee many SCIFs and SAPFs, none suggested great difficulty in accommodating ICD 705 requirements for access to their cleared facilities. They said Temporary storage, TSCIFs and co-use/joint-use approvals have been forthcoming, understandably with some timeliness challenges. So, what is the real issue then?
During the same survey, it became clear that the problem was inability to share secure communications housed within a
SCIF or SAPF. This has nothing directly to do with ICD 705 reciprocity; it has everything to do with the facility’s policy and procedures reflecting its sponsoring agency’s authorities. In other words, the barrier to sharing secure communications is manifested in “need-to-know” and “data ownership” conditions, not SCIF or SAPF access or construction reciprocity.
An example goes like this: Customer A’s SCI-briefed person, who is no longer able to access their normal government SCIF due to the on-going crisis, requires communicating securely on an important, timely issue. The person requested the use of secure comms at Customer B’s SCIF but was told that, since they were not SCI-briefed on that contract with that agency, they can allow SCIF access under ICD 705 SCIF reciprocity, but not to use the secure comms within that SCIF. An extension of that scenario included the SCI-cleared team having to tell the SAP team they couldn’t attend a secure conference call to have their questions answered, despite the SCI team being able to be present during the call. In both cases the rationale for withholding access to secure communications were procedures governed by need-to-know and agency ownership of the secure phone/conference equipment.
Most who have spent time in the cleared world would find this aggravating but, unfortunately, not unsurprising—hence putting off a known problem only for it to be intensified during a crisis. If someone is cleared and briefed—and if warranted, escorted—why would they be disallowed temporary use of secure comms, especially during a crisis? Those who have been around recall that the STU and STE secure phone instruments Policy Spotlight, from page 14 the CMMC maturity level standards have been in effect since early this year, without the implementing regulations, neither the DoD buying agencies nor federal contractors can make essential and market-affecting decisions. PSC has a long history of working with DoD and our member companies on all facets of the CMMC program and our work continues, even as we await publication of the proposed rule and an opportunity to comment.
Finally, but certainly not least, we are waiting for DoD (and possibly other agencies) to provide additional guidance on the implementation of Section 3610 of the CARES Act – the provision that provides for the reimbursement of contractors who had employees denied access to government facilities and yet unable to telework because of the COVID-19 pandemic, but who were on paid leave to remain in a “ready state” so as to be available immediately to return to work. Here, again, PSC has been a leader in our advocacy for the would inform each caller of the level of classification allowed by the distant end caller. How different would it be for the host of a call to identify themselves as known to the distant end and then inform that some listeners are not briefed to the same level?
As this is being written there is movement within the Pentagon to find a solution to enable both US Government and Industry cleared persons to be permitted to have SAP conversations inside DoD-approved SCIFs. Getting the Intelligence Community (IC) to allow SAP discussions in ICapproved SCIFs is complicated by the fact that each IC agency has its own policies for allowing other agencies’ classified use of its secure communications, notwithstanding that the facilities are certified to the same standard.
Although DoD’s efforts are laudable, it should become obvious that the DNI, as the federal government’s security executive agent, needs to intercede to truly remedy the ability for cleared personnel to access, when warranted, secure communications across the government. One recommendation is to have the DNI amend ICD 705 and/or other policies governing access to SCIFs and SAPFs to allow for appropriate, even if limited, use of secure communications by any cleared personnel. The goal would be to facilitate access to secure communication of national security information, not prevent or deny it.
We know there will be consequences if the government fails to provide a remedy to such secure communication access.
There must be a resolve to attain a better path forward. 3 timely, meaningful, and reasonable implementation of this statutory response to COVID-19.
While we appreciate the enormous work done to date by DoD and other Executive Branch agencies to implement the law, much work remains to be accomplished before most contractors will be eligible to receive any reimbursement. For example, on May 18, DoD published draft guidance on the requirements for reimbursement; PSC (and others) submitted extensive comments on May 22. DoD (maybe in conjunction with OMB and other agencies since it is a government-wide provision) have not released the final guidance by press time.
PSC is prepared to work on parallel advocacy tracks as legislation and regulations are advanced. Our member companies always provide valuable and real-time input and guidance when we highlight impending action. The balance of calendar year 2020 will provide numerous opportunities to excel. 3
