How well is your organization prepared for serious incidents?
A short self-assessment for organizational leadership. It does not ask about individual measures, but about the four pillars that decide whether the system will actually function in a crisis — or only exists on paper.
The four pillars we ask about
Readiness profile of your organization
—
The shape of the profile
The radar chart shows how readiness is distributed across the four pillars. Security is only as strong as its weakest pillar — so it is worth paying attention to the side that collapses most deeply inward.
—
—
Breakdown by pillar
For each pillar you see the current state and a short comment on how I look at it when working together.
How I work with each pillar
If we were to work together, this is how I would approach each pillar. I deliberately write in concrete terms — so that you can see how I think about security in practice, not in abstractions.
I. Relevance — we deal with what actually threatens us
I usually begin a collaboration with the question „to whom is your organization a thorn in the side?“ — symbolically, locally, by sector, ideologically. From the answer grows a focused threat map, not a universal list of risks. Then I confront it with how modus operandi has evolved over the past two years and with incidents that have occurred in similar organizations. The result is a document that tells you where it makes sense to put energy — and where it no longer does.
- After a serious incident, is there an established ritual of learning — or do you go back to business as usual after a few days?
- Do you track how threats develop in similar organizations and in the locality where you operate?
II. Readiness — we know what to do and who does what
I build readiness on the principle that „paper alone is not enough“. Every procedure we create with the team goes through a drill — from evacuation and invacuation through lockdown to the work of the crisis staff. Only in an exercise does it become clear where the manual is silent, who is unsure of their role, who cannot operate the technology. We then adapt the procedures based on what surfaced. It is the only way to get them to the state in which they actually work in a real situation.
- Do you train scenario exercises at least once a year — to verify that the procedures hold up under pressure?
- Is it clear in your organization who has the authority to decide in a crisis, including outside working hours?
III. Early warning and communication during an incident
Here I combine the technical solution (warning channels, distribution lists, message templates) with training for those who operate them. Together we prepare a set of messages for typical scenarios — employees, clients, media, partners, families — and resolve the approval chain in advance, so that minutes are not lost in a crisis. We then test it as a tabletop: I set a scenario and we watch when and in what form the message would actually go out. This regularly reveals weaknesses that are not visible in calm times.
- Is it decided in advance who communicates externally — with the media, partners, families of those affected?
- Does the warning channel work at night and on weekends — is there someone who can actually send the message?
IV. Sense of safety and trust
A sense of safety cannot be „made“ in a single push — it is built patiently and can be broken quickly. I help organizations set a long-term culture: a visible and trustworthy contact point (ombudsperson, security manager, someone people can turn to without hesitation), regular leadership communication about security even in calm periods, integration of the topic into the onboarding of new people. And I measure it through anonymous pulse surveys, so we can see how trust evolves over time — not just once a year.
- Do your employees hear from leadership about security even in calm periods, or is it only talked about after an incident?
- When a new person joins, do they know in the first weeks who to call in an incident?
What to do next
Strengths are worth preserving — security is lost gradually, not in one leap. With the weaker pillars it makes sense to work systematically, not only in a rush after an incident.
Equally important as actual readiness is the sense of safety of those who are part of the organization or who come into it. And that does not rest on measures alone — it rests on how they are communicated, internally and externally. Without good communication, even quality solutions remain invisible.
If the four pillars made sense to you, you may also be interested in the specific themes I work through with clients during mentoring — nine areas in which the questions from these pillars usually come together into concrete work.
I will be glad for feedback on your assessment; you can write to me through the form.
This self-assessment serves as a prompt for reflection on the actual state of readiness, not as an audit. The evaluation is based on the answers you have just provided.