Amazing Teams – Incident Management Team


Did you know? You can share this story using the social media icons on the left. Please include the hashtag #WeAreCisco. You can also rate and comment on the story below.

The Incident Management Team in San Jose bridged via TelePresence with RTP discussing the Mexico 7.1 earthquake.

These days it’s hard to keep up with the procession of crises, disasters, conflicts and smaller-scale incidents unfolding around the world. In recent weeks alone, there have been terrorist attacks in Europe, earthquakes in Mexico, and hurricanes, flooding and wildfires in the United States—let alone the geopolitical rumblings in the Middle East, Latin America and Asia.

Events like these can have a dramatic impact on Cisco—potentially disrupting operations, putting employees in harm’s way or otherwise hurting our interests. Cisco’s Incident Management Team (IMT) is ready to leap into action when such events call for it. The team has a far-reaching mandate: pull the right cross-functional leads together to ensure a coordinated and managed response to local, regional and global incidents where employees, the business enterprise or assets could be impacted.

“We’ve had quite a bit of experience,” says team leader Roger Biscay, SVP, Treasurer, Global Risk Management. “The worse the situation, the calmer and more methodical we seem to be—we rise to the occasion.”

The Incident Management team in Singapore preparing for a drill with regional executives in attendance.

The Incident Management team in Singapore preparing for a drill with regional executives in attendance.

“I truly believe our Global Incident Management program gives us a competitive edge in the market,” says next-in-command David Walters, senior director of Global Safety, Security and Business Resiliency (SSBR). “After an incident, we pull a team together to get up and running fast, ensure employee safety quickly, get our facilities and offices operational, and provide employee support when appropriate—it makes all the difference in the world, especially after a disaster or tragedy.”

Roger and David oversee a team of regional managers who are spread across the globe and serve as incident commanders for their region. They are Timothy Pattyson, senior incident manager of the Americas, based in North Carolina; Jared Govorko, manager of Global Incident Management and Investigations, based in San Jose; Martin Lerigo, director incident manager of APAC, based in Hong Kong; and Steve Casey, senior incident manager for EMEAR, based in the UK.

The team tracks a broad range of incidents happening around the world, mostly in four categories:

  • Natural occurrences — storms, wildfires, earthquakes, flooding, etc.
  • Social political — military action, political unrest, terrorism events, etc.
  • Infrastructure — street closures, building collapses, etc.
  • Health — air quality control, pandemics, etc.

A well-oiled machine

The team monitors about 100,000 events a year, and if incidents evolve or escalate in a way that could affect Cisco, managers issue a “Situation Watch” to key business partners. This provides context about an incident — such as how it could affect Cisco and how the team might mitigate the impact. It could also include activating an Incident Management Team to bring together experts to manage the incident.

The Incident Management Team in San Jose bridged via TelePresence with RTP discussing Hurricane Irma.

The Incident Management Team in San Jose bridged via TelePresence with RTP discussing Hurricane Irma.

“The experts make the decisions; we facilitate,” Martin says.

Over the past four years, the team has formally activated 61 incident management teams — the most recent being for Hurricanes Irma and Maria and the devastating 7.1 earthquake that struck Mexico City.

As a result of its extensive experience, the team has evolved into a smooth-functioning unit. There is strong support between levels, from local to regional and all the way up to the C-suite, if needed. And managers in each region can jump in to help or stand in for managers in other regions.

The Incident Management team in Bedfont Lakes in the UK working on the Westminster Bridge Incident

The Incident Management team in Bedfont Lakes in the UK working on the Westminster Bridge Incident

“The process is set in stone,” Martin says. “It works.”

Just as important is the trust and confidence that Cisco’s leadership has in what the team delivers to protect our employees and assets. A case in point was the deadly terrorist attack on Westminster Bridge in London in March. Even before the news media reported the attack, the team had reached out to local resources on the ground and published a situation report to the appropriate Cisco leaders and employees.

“That was an example of great process,” Martin says.

Catastrophe as catalyst

It was the September 11, 2001 terrorist attacks that galvanized the formation of the incident management team. Before that, Cisco had relied on, and excelled at, what David calls “the diving catch.” But 9/11 brought home the need for a more formalized, consolidated and scalable IM program.

“We were scrambling, identifying what exposure we had, if any, to bombs or to buildings in proximity,” Biscay says of the attacks. “Multiple parts of Cisco were dealing with multiple areas.”

The incident management program was further elevated by the Arab Spring of 2010, when events in Egypt, Libya and Tunisia had significant potential impact on Cisco.

But the team isn’t just reactive; it spends time preparing for scenarios that might come to pass, such as an escalation of the North Korean tensions.

“That way, when game day comes and we have to activate, everyone follows suit,” Jared says.

Round-the-clock responsibility

Incident management team members share a special chemistry and don’t keep a 9-to-5 work schedule. They’re on call 24×7 and need to be able to work in a dynamic, fast-paced environment. That’s a good fit for the regional managers, many of whom have backgrounds in the military, law enforcement and corporate security.

“We’re kind of adrenaline junkies,” Tim says.

“Professionalism and preparation are key to success,” Steve adds. “When we have a real event, there’s no argument about who turns up. The teams turn up and they’re prepared.”

The team stays in close communication, using technologies that support the flexibility their job calls for—including WebEx, Spark and IPICS. The job can be extremely stressful and can exact an emotional toll, especially when events involve loss of life, back-to-back crises, or both (such as the 2016 terrorist attack in Nice, France, which was followed immediately by the coup in Turkey). Team members are encouraged to take time off to decompress or to be with family. But the challenges are compensated for by the pluses of the job.

“There’s this quiet satisfaction that you’re doing meaningful work,” David says.

Jared agrees. “The ability to help people is very rewarding,” he says.

Another thing the team all agrees on is how compassionate Cisco is about the wellbeing of not only our employees, but our employees’ families and their communities too.

Related Links:

Connect everything. Innovate everywhere. Benefit everyone.