WISE 2023: Delivering one of the largest exercises of its kind
At 13:30 local time on 16th November 2023, the Hong Kong financial services sector did battle with a cyber-attack launched by the Shadow Collective, an eco-hacktivist group whose raison d’etre was to sow chaos amongst the financial firms as penance for their continued support of the fossil fuels industry. To save your frantic googling of this event in disbelief that it passed you by, this was the scene presented in crisis management team meetings across the city as the firms of Hong Kong took part in WISE 2023.
Exercising an entire industry
The whole industry simulation exercise (WISE) is an opportunity for business continuity management practitioners and crisis management teams within these organizations to pitch themselves against a severe but plausible scenario as a sector and share in the collective experience of managing the complexities brought about by an industry-wide crisis.
Under the guidance of the Hong Kong Financial Services Business Continuity Management board – snappily abbreviated to HKFSBCM – these exercises provide fertile ground to gain a stronger understanding of emerging threat trends, risks to the sector, and to build out their response procedures. After a pandemic-induced period of rest, 2023 saw the return of WISE to bring together crisis management teams to test their plans and procedures against this year’s theme of an industry-wide cyber event.
Planning and preparation
With 43 participant organizations, each with their own plans, procedures, and regulatory deliverables, the scale of the planning and execution was significant.
First of all, there can be no escaping the complexity of such an undertaking. The 4C team began by working alongside HKFSBCM to understand the exercise requirements and create the objectives and scenario. To ensure that enough contact time was given to those organizations involved in the exercise, the project was broken down into three in-person delivery sprint weeks in Hong Kong, divided equally across the planning period up until the final week in mid-November, when the exercise took place.
These weeks were conducted through a series of workshops and briefings which allowed the team to introduce the 4C way of running an exercise. The component pillars of our methodology are to:
- Design;
- Develop;
- Deliver;
- and Evaluate
These concepts were perhaps unfamiliar to many in the audience but were well received and embraced by participants as a whole as the project progressed.
The complexities of scale
As with all exercises of this scale, buy-in across the board is an absolute necessity. In the case of WISE, it is the sheer scale of the undertaking that allows this mass attendance to even be possible.
Each participant organization paid a fee that contributed to the overall cost of running the exercise. When considering budgets in often-stretched departments, this entry cost is far outweighed by the enormous benefits of exercising on this scale. Furthermore, the WISE 2023 exercise saw the three industry regulators play for the first time ever, providing a degree of authenticity to the exercise, as well as providing regulatory guidance.
Truthfully, if the low cost and high returns were the carrot, regulatory engagement is most certainly a stick. Take up for the exercise was high amongst the members of the HKFSBCM community, and no doubt helped by the fact that this was the first such opportunity to exercise on such a scale this decade, coupled with increased regulatory scrutiny.
Sprint weeks prove invaluable
The sprint weeks, weeks where 4C provided in-person workshops and training to organization representatives in Hong Kong, were the foundation upon which this exercise was built. They helped us connect with the top experts in business continuity management and operational resilience in the Hong Kong sector. The insights gathered during these weeks, along with feedback from the firms' business continuity management leads, contributed to a crucial project deliverable: a sector-wide Crisis Management Capability Maturity Model (CMCMM). This model outlines the best practices for the Hong Kong financial sector when dealing with a crisis.
Utilising 4C’s 10 Functions of Crisis Management, coupled with the data on ‘what good looks like’ provided by the business continuity leads, the CMCMM gives organizations a tool by which to measure the maturity of their capability against the sector as whole. This is something that has not been attempted before and will provide a legacy for participant organizations to take forward as they build out their capabilities in the future.
The sprint weeks were also an opportunity for 4C to help the firms prepare for the exercise. Be it through evaluation techniques training or with C-suite level crisis management training workshops, they provided an effective way to engage with a usually time-constrained audience. This allowed representatives from participating firms to concentrate on skills often overlooked in the constant rush of day-to-day business.
Exercising operational resilience capability at scale
WISE 2023 marked the first instance of incorporating operational resilience into an exercise of this magnitude. To cater to firms eager to test their operational resilience as part of the exercise, 4C provided an operational resilience aide-memoire in advance of the exercise play. This included a severe but plausible scenario for firms to grasp and validate their assumptions about their recovery time objectives (RTOs) and tolerances before the exercise day.
To conduct scenario testing before engaging a crisis management team is essential for identifying and addressing gaps in their preparedness. It ensures that the team is familiar with realistic crisis situations, improving their ability to respond effectively when dealing with a crisis and responding to regulators. Furthermore, the process helps confirm regulatory compliance, enhances team coordination and communication, and fosters a proactive approach to continuous improvement. Successful scenario testing builds confidence within the team, ensuring they are well-prepared and capable when facing a regulator in a real crisis. Notably, it was key for the participating firms to ensure they were able to answer any queries when asked by the regulator, for which the prior scenario testing enabled a more validated response.
Squeezing this operational resilience requirement into a three-hour window seemed almost impossible, but two factors made it achievable.
- The first factor is prior preparation, by organizations with the capacity to do so (i.e organizations were able to carry out elements of the exercise prior to the exercise day). This enables firms to incorporate operational resilience elements into their injects.
- The second factor is having a system to develop and deliver the exercise in, including capture all injects, observations, and media to make the exercise come to life as well as ensure consistency throughout the playing firms.
Regarding the second factor, the 4C training and exercise management portal used for WISE served as a hub for players, evaluators, and scenario leads to manage all exercise content. It allowed staff to preview scenario injects on a timeline view before they were sent by the scenario leads. The portal worked hand in hand with three crucial roles played by participating organizations:
- Scenario leads, responsible for developing and executing scenario injects.
- Evaluation leads, a key role capturing observations against exercise objectives.
- Facilitators, ensuring the exercise's success within exercising firms and serving as the single point of contact for all communications.
Achieving an immersive experience for thousands of players
Firms wishing to exercise their crisis communications team were given an opportunity to do so, since we integrated a social media simulator for the duration of the exercise, providing an immersive platform that simulated the cacophony of chaos that social media brings to a crisis. Situated on the player portal, this provided an additional element of synthetic reality to enhance the experience. Indeed, it was heartening to see the crisis communications teams spar with a wide array of enraged simulated personas as the exercise progressed.
In summary
It is hard to do justice to the amount of work required on all sides in preparation for the exercise in one article. Taking into account the 43 participant organizations, three contact points for each firm, multiple briefings, communiques, and sector-wide emails, the inbox alone for this kind of undertaking is intimidating. All of this preparation — the hours stood talking to rooms of SMEs about a new methodology to consider for crisis management, the achingly early meetings to keep to APAC hours — it all boiled down to three crucial hours of exercise play. It is only once the exercise director starts the exercise and the firms let rip their scenario injects that you truly understand the scale of what has been achieved.
Three hours of play, simulating two days of all-consuming crisis, with scenario injects fed to hungry CMTs in quick succession, each one driving the scenario forward. Then, before you know it, it’s over. Where once there stood a bustling exercise control centre, nestled in the heart of the financial district of Hong Kong, there now stands an empty room save for a few promotional pens and the 4C branded liquorice sweets that are seemingly not a ‘crisis sweet’.
The dust is now settling on WISE 2023 and we are back in the UK, deep in the post-exercise lessons and reports. It is too premature to include these lessons in this piece, indeed, to do so before the sector receives their feedback would be remiss. The main outcome and the true value of WISE remains the continued promotion and embedding of business continuity management across the wider financial services sector in Hong Kong, and in this respect it has triumphed.
In an effort to capitalise on this, we have documented the process from start to finish on film, with a view to sharing this with the participants to ensure that the effort and rigour involved in WISE and that the importance of business continuity management is understood organizationally from the top down. Keep an eye out for further details on this. As the post-exercise process reveals the true treasure of undertakings such as WISE, we shall be able to reveal further insights into exercising on this scale and the complexities this brings to further enhance the capability of Hong Kong finance sector.
More on
About the author
-
Mathilda Jansson
Senior Consultant
-
Chris Jee
Senior Consultant, 4C Europe Uk Ltd / 4C Strategies
