The past 6 weeks or so have been quite surreal for us, and I guess for you too. Yesterday we went shopping, leaving our property for the first time since our shopping expedition a week before NZ went into "level 4" lockdown. As of a couple of days ago, we're now at "level 3". Don't ask me what the differences are between the levels, nor what levels 2, 1 and 0 might look like. All I know is that it was a relief to see other people out and about, most of us making obvious efforts to keep our distance. The new normal isn't so bad as I imagined, certainly nothing like a zombie apocalypse or police state. Those 6 weeks blurred into one. At some point I stopped counting up and blogging about the passing days ... and eventually started counting down to the end of "level 4", or more importantly the impending exhaustion of some of our most essential supplies: coffee, wine and chocolate. Some valuable lessons there for when we replenish our "earthq...

There's a slew of social media posts promoting business continuity management, resilience, ISO 22301 and the like, right now, during COVID-19.  That's like promoting birth control to a family of twenty. It's 20-20 hindsight. Now is the time to promote the planning and preparations needed to cope with the aftermath of COVID-19, taking account of things such as: Lingering uncertainties/doubts about business, the economy, life, health, management and workforce capabilities/competence, supply chains ... whatever  Inertia - the additional effort needed to spin-up to normal speeds after the go-slow  Low morale resulting from isolation depression, sickness, stress, over-work  etc . Lack of motivation to 'get back into the swing of things' as if nothing happened Various adjustments to the new working, home and social life Coping with losses of all sorts (money, people, jobs, opportunities ...) Realisation (for some) that working from home beats working from work Familial, c...

These are the headline metrics noted by the NZ Ministry of Health : Confirmed and probable cases of COVID-19 The number of people who have recovered How many people are (and have been) in hospital Cases by District Health Board, and by age and gender. The metrics are updated daily and reported dutifully by the NZ news media, but what use are they, in fact? What information and knowledge can we glean from the data?  Here is the current summary (snapshot at 7am on April 2nd):  There are no detailed definitions of these data, and my beady eye spots little differences, for example whereas the headline says "how many people are (and have been) in hospital", the data actually provided are "Number of cases in hospital" showing the "Total to date" and "New in last 24 hours". If this is a cumulative total of the number of COVID-19 cases admitted to hospital each day, are they just the "confirmed" cases or does that include the "probables...

The NZ politicians and news media are updating us daily on selected COVID-19 statistics (metrics), particularly concerning NZ of course but also the global situation. Countries with the largest numbers (regardless of which metric) are naturally media-fodder. It's fair to ask, though, what all these numbers mean, why we should care about them, and why they  are being reported rather than others. As with information risk and security metrics, there are various audiences of the metrics with numerous concerns, objectives, purposes, uses for or interests in them e.g. : Those actually managing the national response, day-by-day, need to know how they are doing relative to their plans and intentions, and how they might improve Central and local government politicians giving oversight and direction to the response ... with a keen eye on their popular standing, given that an election is in the offing (unless deferred) ... plus administrators in the civil service The Treasury and Inland Reven...

Our "broadband" is gradually becoming narrower by the day as an increasing number of Kiwis on staycation are working from home, downloading/watching videos, playing online games or whatever. Normally I listen to online music stations while working and I still can: thanks to bufferuffering and the relatively little bandwidth required, streaming audio still works OK ... but instead I'm listening to my music CDs for a change, figuring there are those out there who need the Interweb bandwidth more than me. Besides which, I like my CDs and it's easy to skip the duff tracks. 

Yesterday I wrote about exploiting/making the most of opportunities that arise in a crisis. Here's an example - using COVID-19 as an analogy to help explain a concept. A question came up on the ISO27k Forum about how to handle 'primary and secondary assets' in the risk assessment processes described by ISO/IEC 27005. This is my response ... Primary assets (business processes and activities, information) … usually the core processes and information of the activity in the scope” [ ISO/IEC 27005:2018 section B.1.2] are the focal point: that’s what we need to protect. However, in order to do that, we also need to take care of other matters, including the supporting/enabling information systems, networks etc . Those have some  intrinsic value ( e.g . used but now redundant servers can be upgraded, redeployed, sold or scrapped) but their main value relates to their roles in relation to the primary assets. A topical analogy is “health” – an asset we all need to protect. For vi...

With a bit of lateral thinking, there are ways to hook-in to and even exploit the COVID-19 brouhaha. More time for reflection is one of the advantages of the lockdown, for some of us at least.  Many organizations, for instance, have sent out customer comms about what they are doing to maintain services during/despite the pandemic. Although most are matter-of-fact and boring (maybe not even branded), some are more creative and engaging, even acknowledging that COVID is not going to blow over in a couple of weeks. Most are generic, superficial and bland, often supplier-focused, whereas some are personalised, unique, detailed and customer-focused. Most appear to be one-off broadcasts, hurriedly cobbled together by teams immersed in the chaos and confusion, then slowly refined and authorized. Not many that I've seen so far even hint that there might be more to come. The odd tinge of humour is welcome.   Unlike the vast majority of incidents and crises, a global incident such ...