3 Stage 1 — Initiation and preparation

Before the study is started its scope must be made clear to the analysts and to the sponsor. The responsibilities and tasks of the case organisation must be described in some detail. Also, the position of the organisation within the wider system of suppliers, customers and stakeholders must be laid out.

In stage 1 you will collect the information that you need to complete the other stages. The result is a report and agreement from the sponsor to proceed.

The Initiation and Preparation stage consists of the following steps:

1. Identify telecom services
2. Identify actors
3. Describe disaster scenarios
4. Create Stage 1 report
5. Obtain approval from sponsor

3.1 Identify telecom services

Create a list of all telecommunication services that are used by the case organisation. This list must be exhaustive. If a service is accidentally omitted, no risk assessment will be performed on it, and dependencies between the service and other services will not be discovered. As a result, decision makers may take unnecessary or ineffective countermeasures, or overlook necessary countermeasures.

To create the list of telecom services, the following information sources may be useful:

• The initiating problem statement, project initiation document, or request for proposals.
• Interviews with executives and operational staff from the case organisation.
• Observation of operational staff in exercises or real-life operations.
• Disaster preparedness plans.
• Reports or evaluations of past exercises.
• Internal formal procedures, operational guides, process manuals.
• Reference materials used during crisis response.

Briefly describe each telecom service. At this stage it is not yet necessary to describe the technical implementation, but if information is available on such items as handsets, terminals, or links, then this should be included in the descriptions.

If a telecom service acts as backup to some other telecom service, or when the service itself has fallback options, then these must be described as well.

The descriptions must also include the relevance of the telecom service to the operations of the organisation. That is, is the service essential, or merely a 'nice to have'?

It will also be useful at this stage to start a glossary of abbreviations and definitions of special terms that may not be clear to all analysts, or to the sponsor.

3.2 Identify actors and external stakeholders

List, for each telecom service, the actors who may make use of that service. Main actors are members of the case organisation. All other actors are secondary actors. Actors can be the initiating party of communication session (calling party) or the receiving party (called party), or both.

List all external stakeholders to the case organisation.

Actors and external stakeholders may be identified using the same information sources as listed above for telecom services.

3.3 Describe disaster scenarios

Before the analysis can start, it must be clear to which threats this organisation may be exposed. For example, the in-company fire service in charge of chemical plant safety will be confronted with different potential disasters than a crisis team controlling the spread of agricultural diseases. The latter is unlikely to be affected by violent destruction of hardware. Consequently, the threats to their telecom services will be very different in nature.

The threats to telecom services and their mechanisms must be described in as much detail as possible. Disaster scenarios describe the threats, their effects and mechanisms, their likelihood, and the required response from the case organisation.

For some studies intentional human-made events (crime, terrorism) are highly relevant. For other studies it may suffice to focus on accidental events only. The scope of the study need not be limited to technical aspects. When describing a disaster, the effects that it will have on telecom components is the most important part. To better understand the reactions of the general public it may be useful to also include some graphic descriptions of events that could be experienced by citizens, or that could be published in the media. This may facilitate the assessment of social risk factors in the Risk Evaluation stage.

It may be possible to reuse disaster scenarios from previous risk assessments, thus shortening the amount of work needed.

3.4 Create stage 1 report

The results from Stage 1 must be recorded because the analyst will need to refer to this information during subsequent stages.

The following is a common outline of the output document of the Initiation and Preparation stage. This report forms the introduction to the final report.

1. Executive summary to the Stage 1 report.
2. About the case organisation (internal scope):
   1. Position within wider system of stakeholders.
   2. Sponsor, decision makers, and analysts.
   3. Roles, tasks, and responsibilities of the case organisation.
   4. Telecom services used, with a description of the implementation, role and purpose, and fallback and backup options.
   5. Actors, including main actors, and their roles, tasks, and responsibilities.
3. About the environment of the case organisation (external scope):
   1. Disaster scenarios, with descriptions.
   2. External parties with whom the main actors may communicate, and other external stakeholders.
4. Glossary.

3.5 Obtain approval from sponsor

All analysts must participate in a review of the Stage 1 report. All analysts must agree on its contents by consensus.

The Stage 1 report must then be presented to and discussed with the sponsor. The list of telecom services may contain unexpected services. The unexpected appearance of a service is informative, since it indicates that the risk assessment and preparation of the case organisation are insufficient, and that disaster response plans are incomplete.

The results of the Initiation and Preparation stage determine to a large extent the course of the risk assessment in the later stages. It is therefore important that the sponsor also agrees to the outcome of this stage, and gives formal agreement to the resulting documentation. As a consequence, the documents must be understandable to non-experts. A glossary may be helpful to that effect. Also, an executive summary should be written.