Training builds confidence – how Secapp supports organizational drills

Preparedness has risen on the agenda for an increasing number of organizations’ leadership teams. Plans are drafted, responsibilities are defined, and technologies are implemented. Organizations want to be ready for disruptions – whether it’s a security threat, a cyberattack, or another exceptional situation.

But the real question is: have the plans been tested in practice? Are drills an integral part of the organization’s preparedness?

In many organizations, operating models are well known in theory. They may be documented in guidelines that also describe roles for different scenarios. Still, they may also never have been run through in a realistic, high-pressure situation.

This is especially emphasized when it comes to communications:

• Do you reach the right people?
• Do the alerts work?
• Does anyone gain real-time situational awareness?

Secapp’s alerting and information functions enable all of the above – provided the groundwork has been done carefully and the operating model for exceptional situations has been built to fit the organization’s needs. The Secapp Drill Assist service has been developed to ensure that using Secapp becomes part of drills in a structured and practical way.

When an organization is planning, for example, an evacuation or cyber drill, Secapp can join in to support the preparation and debriefing of the exercise.

In practice, most of the work is done before the drill. Together with the customer, the following are reviewed:

• how Secapp is intended to be used in the drill
• whether the alert templates are in order
• whether the right target groups have been defined
• who sends the message and to whom
• whether all necessary functionalities are being utilized.

“Most often, the drill content has already been well thought through by the customer. Our role is to ensure that Secapp supports it so clearly that in a real situation there’s no need to think about how the system works anymore,” describe Secapp Customer Success Managers Tero Koivikko and Janne Hänninen.

Joint planning often brings up things the organization would not have thought of on its own. The drill content may be clear, but Secapp’s role in it may still be undefined. In the preparation it may be noticed, for example, that the message template needs clarification, the target group is too narrow, or a useful functionality has been left unused.

The drill is always carried out by the organization itself. Secapp’s experts can be involved on site or remotely if there are questions related to usage or technical challenges.

An educational institution is preparing for an evacuation drill covering all staff and students. The drill is part of the annual safety plan, and Secapp has been in use in the organization for some time. However, Secapp has not yet been used as part of a drill situation even once, and the admin user wants to ensure that the system works as intended and that all relevant parties know how to use it.

In the preparation phase, Secapp’s expert and the customer’s admin user review together how the alert will be carried out with Secapp. At the same time, they notice that:

• one staff group is missing from the target selection
• the message template does not include clear action instructions for recipients
• OK/NOK responses have not previously been used to build situational awareness.

The message template is refined, the target group is updated, and the course of the drill is reviewed once more.

During the drill, the alert is sent as planned. Responses begin to accumulate, and the responsible persons can see in real time who has acknowledged the message.

In the debrief, it is noted that technically everything worked, but some staff still need more confidence in using the app. A short refresher training and fine-tuning of the message template are agreed. Without the drill, these development needs might have gone unnoticed.

The industrial company’s IT and cyber team practices a situation in which key communication and collaboration systems are not available. Secapp has been in use in the organization for a longer time, but it has not previously been tested in a situation where the primary communication channels are down at the same time.

In the preparation, they review:

• who initiates the alert
• how messages are prioritized
• who is invited to manage the situation
• how situational awareness is formed.

In the joint planning, it is noticed that outside the crisis team there are also other actors who should be reached quickly. Target selections are expanded and message templates are clarified. In addition, they specify whether, after the alert, they move to using Secapp’s chat functions or open Secapp Meet video meeting directly through the app for the crisis team.

During the drill, the alert is initiated as planned and the crisis team moves to using Secapp to coordinate the situation. Communication works, but in the debrief it is noted that responsibilities for situation updates can still be clarified: who provides the updates and at what intervals.

The drill builds confidence that communication does not rely on a single channel – and that roles and responsibilities related to using Secapp are clear before a real situation.

A critical infrastructure operator participates in an External Emergency Plan (EEP) exercise. Rescue authorities, the police, and other regional actors are involved.

The drill is based on ensuring inter-organizational communication. In previous situations, it has been observed that relying solely on phone connections is not a sufficiently reliable solution.

Following this observation, Secapp has been implemented in the organization to ensure continuity and reachability of communication also in exceptional situations. Because communication crosses organizational boundaries and involves multiple actors, it is important to practice using Secapp specifically as part of the EEP drill.

In the preparation, they review:

• how different organizations are reached
• how responsibilities and roles are reflected in communications
• how situational awareness is shared among different actors
• how it is ensured that communication is not dependent on a single connection channel.

In the joint planning, it is noticed that the contact details and grouping of different actors require refinement. At the same time, a clear operating model is defined: who initiates communication and how situational information is shared among everyone participating in the drill.

During the drill, communication works as planned, and situational awareness can be shared with multiple actors simultaneously. In the debrief, it is concluded that Secapp brings much-needed confidence especially in situations where multiple organizations operate together.

Whether it’s an educational institution, an industrial company, or a critical infrastructure operator, the common denominator is the same: a drill makes visible the points that would otherwise easily go unnoticed. Often it’s not about major shortcomings, but about refinements – target groups, message templates, division of responsibilities, or forming situational awareness.

The core of the Secapp Drill Assist service is that the organization gets the perspective of an expert specialized in Secapp to support its own drill. The service includes preparation, monitoring of the drill, a report of key observations, and a joint debrief where next steps are reviewed.

– Training builds confidence – not because everything goes perfectly, but because you know what still needs to be developed, Koivikko and Hänninen sum up.

After the drill, the organization has a clearer picture of how the system supports operations and what should still be developed. The development needs identified in the drill are prioritized and advanced step by step together with Secapp’s experts. This can mean additional training, adopting new use cases, or planning the next drill.