Critical incident management and the security plan

1The security plan

The security plan turns the risk analysis into concrete rules: description of the context, main threats, standard operating procedures (movements, communications, base, cash), security levels (for example from 1 to 5, with the measures for each level), hibernation, relocation and evacuation plans, emergency contacts.

Everyone knows it, it is tested (drills) and revised at least every six months or after any major change. National staff, often more exposed and harder to evacuate, must be explicitly taken into account.

2Managing a critical incident

A critical incident (kidnapping, attack, death, serious assault) is managed by two teams: an incident management team on site and a crisis management team at headquarters. The steps: alert, fact-finding, securing other staff, informing families through a single point of contact, controlled external communication, decisions recorded in a crisis log.

Kidnappings follow a written policy: who negotiates, with what specialist support, and within what limits. Nobody negotiates alone in the field.

3Duty of care and post-incident support

The duty of care requires the organisation to take reasonable steps to protect its staff from foreseeable risks: information and training, equipment, insurance, procedures, psychosocial support. It applies to national and international staff alike, and to partners in a shared-risk approach.

After an incident, provide psychosocial support (psychological first aid, referral), a blame-free lessons-learned review, and update the security plan.

4Writing a usable security plan: structure, levels and triggers

An 80-page security plan that nobody reads is an audit document, not a tool. A useful plan is short in its operational part (the procedures everyone needs to know fit into about fifteen pages), precise, and accompanied by reference annexes. The GISF guides and GPR8 propose a widely adopted structure.

Recommended structure

Security levels: indicators, not impressions

Moving from one level to another must be based on observable indicators defined in advance; otherwise the decision depends on the mood of the moment and comes too late. Example of a five-level system for a fictional base:

Returning to a lower level is also governed by written criteria (for example 14 days without a major incident in the district and confirmation by two independent sources). Without return criteria, bases remain stuck at a high level or return to normal too early.

Keeping the plan alive

• Review at least every six months, and after any major incident or change of level.
• Briefing for every new arrival, with a dated signature, and an annual refresher for all staff.
• Exercises: at least one hibernation or evacuation exercise per year, and a test of the alert chain (calling all staff outside working hours) every quarter.
• Translation into the staff's languages; a short version posted on the wall (contacts, levels, key instructions).

5Hibernation, relocation and evacuation: planning for decisions made in a few hours

Decisions and their triggers

These three options are planned in calm conditions and decided under pressure. Experienced planners insist on one point: the window for leaving safely often closes faster than expected. A relocation decided too late becomes forced hibernation; an evacuation decided too late may become impossible if the airport or roads close.

Hibernation: detailed preparation

• Location: one or more identified buildings (office, main residence) with solid walls, an interior room without windows, a water reserve, means of communication, and the capacity to accommodate all the staff planned for.
• Planning duration: usually 7 to 14 days, longer in isolated areas.
• Stocks per person per day: at least 3 to 4 litres of water for drinking and cooking, which corresponds to the Sphere Handbook survival minimum (2.5 to 3 litres for drinking, more depending on the climate), plus water for hygiene if possible; about 2,100 kilocalories of rations requiring little or no cooking; medicines; torches and batteries; generator fuel (calculated on limited running hours, for example 4 hours a day); rubbish bags; bedding.
• Communications: at least two independent means, with backup power (batteries, solar panels) and a schedule of twice-daily check-ins with the capital or headquarters.
• House rules: stay indoors, away from windows, rotating watch, rationing, social media discipline.

Relocation and evacuation

• Lists of people updated every week: category (international staff, national staff from another region, local national staff, any dependants), priority, documents.
• Main and fallback assembly points, known to everyone, with a cut-off time.
• Main and alternative overland routes, with resupply points; air options (humanitarian flight, commercial flights, aircraft chartered by the insurer or by a coordination of organisations).
• Grab bag for each person, with limited weight (often 10 to 15 kg depending on the flights): passport and copies, cash, medicines, charger and power bank, clothes for 3 days, paper contact list.
• Office: list of what is taken, destroyed or left behind (sensitive documents, personal data of assisted people, cash, communications equipment).

The question of national staff

In most organisations, evacuation out of the country applies to international staff and, sometimes, to national staff whose lives are directly threatened because of their employment. Local national staff are generally not evacuated, but the organisation has obligations towards them: in-country relocation for staff from other regions, salary advances (often one to three months), means of communication, maintaining contact, clear instructions on the suspension of work, and support in the event of an individual threat. These options are discussed with staff in advance, not discovered on the day of the crisis. An evacuation that leaves national staff without instructions or resources does lasting damage to trust and acceptance.

The day national staff are told what is planned for them must not be the day of the evacuation. This dialogue takes place on arrival, and then at each review of the plan.

6Managing a critical incident: structure, roles and the first hour

A critical incident is an event that seriously threatens the life or safety of staff, or the organisation's ability to continue its activities, and that goes beyond ordinary procedures: kidnapping, disappearance, armed attack on a base, death, serious assault, arbitrary arrest, disaster affecting staff. Managing it relies on a structure activated according to written criteria and on pre-assigned roles.

Two levels of management

Roles to pre-assign (with deputies)

• Team leader: decides, arbitrates, reports. They do not take on detailed tasks themselves.
• Crisis log keeper: keeps the crisis log (time, information received, source, decision, who took the decision, action, person responsible). This log is essential for managing the crisis, for insurance and for any subsequent legal proceedings.
• Family liaison officer: the single point of contact for each family, with regular contact at agreed times, even when there is nothing new.
• Communications lead: the only person authorised to speak to the media, using approved messages; instructions to staff on social media.
• Staff support lead: teams still in the field, colleagues close to the victim, national staff.

First-hour checklist

1. Confirm the available facts and their source; distinguish what is certain from what is probable and from rumour.
2. Secure the other teams: suspend movements, recall them to the base or to a safe location, check that everyone can be reached (roll call).
3. Notify the management line according to the planned chain; activate the incident management team.
4. Open the crisis log.
5. Secure information: restricted list of people informed; instruction to stay silent on social media; retrieval of the personal data of those concerned (confidential file, proof-of-life questions).
6. Assess the medical need and activate the medical plan if necessary.
7. Decide who informs the family, when and how (never by phone from a colleague who has not been mandated; never before the facts are sufficiently established, unless there is a risk that the family will find out otherwise).
8. Inform relevant actors (security forum, Saving Lives Together coordination, embassy for international staff) in line with the organisation's policy.
9. Set the time of the next situation update (for example every 2 hours at the beginning).

Specific features of a kidnapping

Managing a kidnapping is exclusively the responsibility of the crisis management team, with specialist support. Nobody in the field negotiates on their own initiative; if the kidnappers call, the person who answers has received written instructions: listen, take notes, ask for proof of life, promise nothing, propose a new contact at a set time and pass the information on. The first call is often decisive for what follows. Organisations that have not prepared for this situation improvise under pressure, with serious consequences (rising ransom demands, exposure of other staff members).

Death of a staff member

Procedures provide for notification of the family by a mandated person, in person if possible and accompanied; repatriation or burial according to the family's wishes and religious and legal rules; administrative and insurance formalities; support for colleagues; and a collective moment of mourning. For national staff, the organisation respects local mourning practices and provides practical support (funeral costs, allowances provided for by the contract and labour law).

7Full example: 72 hours managing a disappearance in Nord-Dalé

Fictional context: the NGO "Horizons Humanitaires" works in Nord-Dalé province, where two armed groups are fighting for control of the roads. On Thursday at 2 p.m., Samuel K., a national community health worker, misses his check-in. At 3.10 p.m., his vehicle is found empty by another NGO on a secondary track, engine off, with no sign of a struggle. The driver, Joseph M., is also missing.

Extracts from the crisis log

Analysis and follow-up

• What worked: missed check-in procedure, rapid securing of the other teams, a single point of contact for the family, a sober media statement, written instructions for the first call, up-to-date proof-of-life questions, a network of community acceptance.
• What was missing: the family was informed by a villager before the organisation; the vaccination programme on both sides of the front line had not been explained to the armed group, which fuelled the suspicion of spying; no perception analysis had been carried out since the change of control of the area two months earlier.
• Decisions: formal access negotiation with both groups before resuming; gradual resumption after 3 weeks; psychological follow-up offered to the two colleagues and their families for 3 months; Samuel and Joseph choose their position on their return (Joseph asks for a posting in town, which is granted); review of the risk assessment and the security plan.

8Duty of care: obligations, liability and post-incident support

Duty of care (duty of care) refers to an employer's moral and legal obligation to take reasonable measures to protect its staff against foreseeable risks. It is grounded in labour law (the employer's health and safety obligations), in the sector's quality commitments (CHS, Commitment 8) and, for travel, in the ISO 31030 (2021) standard on travel risk management.

A court ruling that left its mark on the sector

In 2015, the Oslo District Court found the Norwegian Refugee Council (NRC) grossly negligent in the case of the kidnapping of several of its staff members in the Dadaab camp (Kenya) in 2012, following a claim brought by one of them, Steve Dennis. The court noted in particular that the risks were foreseeable and that reasonable measures (such as an escort or a postponement) had not been taken. This ruling led many organisations to review their policies, how they document decisions and their insurance cover. It is a reminder that duty of care is not demonstrated by the existence of a plan, but by proof that the risks were assessed and that decisions were taken in full knowledge of the facts.

The components of a credible duty of care

Equal treatment of national and international staff

Several studies by GISF and Humanitarian Outcomes have shown that national staff account for the vast majority of victims of serious incidents, while often benefiting from lesser protection (limited insurance, no evacuation, less training, inaccessible psychological support). Duty of care does not require identical measures, since the risks differ, but it does require an analysis specific to each category and measures that provide equivalent protection. An auditor or evaluator will check in particular: national staff insurance contracts, access to training, participation in the risk assessment, and the existence of options in the event of a personal threat.

Post-incident support and lessons learned

1. Immediately: safety, care, practical needs (accommodation, communication with loved ones), psychological first aid.
2. In the following days: one-to-one meeting with a trained manager; offer of professional support; information on normal reactions; adjusted work arrangements or temporary leave according to the person's wishes.
3. At one month: follow-up; referral to specialist care if symptoms persist.
4. Organisational after-action review (within 2 to 6 weeks): a structured meeting, separate from psychological support, focused on procedures and decisions, without seeking to apportion blame. Questions: what happened, what was planned, what worked, what did not work, what are we changing?
5. Closure: update of the plan, anonymised sharing of lessons with security forums, informing the people concerned of the changes made.

9Exercises, audits, variations and interview questions

Organising a crisis simulation exercise

A 3 to 4-hour tabletop exercise (tabletop exercise) makes it possible to test the plan without risk. A proven method:

1. Objectives: two or three specific points to test (team activation, communication with families, relocation decision).
2. Scenario: realistic and local, divided into successive injects (for example one every 20 minutes: missed check-in, vehicle found, call from a journalist, call from the kidnappers, rumour on social media).
3. Participants: the actual members of the incident management team with their deputies; a facilitator from outside the team; an observer who records decisions and timings.
4. Immediate hot debrief (30 minutes), followed by a written report with an action plan within 2 weeks.

What a security management audit checks

Variations by context

• Sudden-onset crisis: the plan starts as a short version (5 to 10 pages) produced in the first week: contacts, movement rules, curfew, simplified levels, assembly points, medical plan. The full version follows within the month.
• Protracted crisis: the risk is obsolescence; mandatory reviews are scheduled and plans are actually tested.
• Urban setting: scattered residences, hence more complex regrouping and hibernation plans; dependence on mobile phone networks, which can be cut.
• Remote management: the incident management team may be outside the country; a person on site must be designated with authority to take urgent decisions, with written delegations of authority.
• Local partners: plans must include partners (alerts, support in the event of an incident, access to emergency funds), and exercises can be conducted jointly.

Interview questions

1. "How do you define the indicators for moving between security levels?"

A strong answer talks about observable indicators defined in advance, linked to the threat analysis, return criteria, the decision-making chain and informing all staff. It gives an example with figures.

2. "You are head of mission; a colleague has been kidnapped. What are your priorities in the first hour?"

Safety of the other teams, confirmation of the facts, alerting the management line and activating the teams, crisis log, information management, the family, preparation for the kidnappers' first contact. The answer specifies that negotiation is the responsibility of the crisis team.

3. "What do you plan for national staff in the event of an evacuation?"

Prior dialogue, in-country relocation for staff from other regions, salary advances, communications, instructions, support in the event of a personal threat, possible evacuation when the threat is linked to their employment.

4. "What does duty of care mean to you in practice?"

The answer cites concrete, verifiable measures (information, training, procedures, insurance, support), and mentions the Dennis v. NRC ruling, equal treatment and extension to partners.

5. "How do you conduct an after-action review following a serious incident?"

Distinction between psychological support and the organisational after-action review, no search for someone to blame, structured questions, an action plan with people responsible and deadlines, feedback to the people concerned.

Key references

• Operational Security Management in Violent Environments (GPR8): Humanitarian Practice Network.
• GISF guides on crisis management, security planning and duty of care, including Security to go.
• Security Risk Management Manual and critical incident management procedures: UNDSS.
• ISO 31030 (2021) standard on travel risk management and ISO 31000 (2018) standard on risk management.
• Core Humanitarian Standard on Quality and Accountability (CHS), Commitment 8.
• Sphere Handbook (2018), for the minimum water and food standards used in hibernation planning.
• Humanitarian Outcomes reports (Aid Worker Security Report) on the exposure of national staff.
• Managing Stress in Humanitarian Workers: Guidelines for Good Practice: Antares Foundation.