5 Tips For Implementing Security and Business Continuity Systems

This is a guest post by Johan Lindström, Senior Advisor Quality and Compliance at Avinor, the government-owned operator of almost all of Norway's airports.

Few sectors operate under stricter safety and preparedness regimes than the aviation industry. At Avinor, we work towards a defined safety goal: No aviation accidents or serious incidents where Avinor is involved. As the senior safety advisor, it's my responsibility to implement a business continuity system that both supports our strict security regime and is intuitive enough to be used by anyone affiliated with our 45 airports.

Avinor is a significant public body and possesses lots of information that has to be accessible to emergency services, the Ministry of Transport, and the Civil Aviation Authority. This means that, in addition to managing our extensive network of airports – all of which comprise several different departments, Avinor must remain connected to the public security and emergency network.

It’s essential that our business continuity system handles this intricate web of connections without compromising security concerns such as keeping information up to date, dissemination, and data protection. Here are my tips for implementing a business continuity system in a major organisation, based on my extensive experience.

Make sure you are prepared for a crisis - book a demo of CIM here.

1. Get to Know Your People

I've implemented our business continuity system in over 45 airports, mostly by working face-to-face with operators but also over the internet using email and Skype. My experience has revealed that on-site, face-to-face implementation is three to four times more efficient than internet-based communications. Additionally, having a personal presence helps you build a closer relationship with the people actually using the system, ensuring they feel comfortable asking you for help and guidance further down the line.

Read more: 10 things the aviation industry can teach us about preparedness and safety

2. Make Sure the System is Role-Specific and Divided Into Levels

Our system is set up in a role-specific way. This means that a user's responsibilities determine the dashboards he or she sees when opening CIM. For instance, an external party, such as a municipality, will only be capable of adding information to the system, not extracting anything. 

The system is also divided into levels, but that doesn’t mean that top management has access to everything. The strategic team shouldn’t see all available data – it will appear cluttered and prevent them from fulfilling their strategic responsibilities.

3. Your System Must be Easy To Use

A crisis management system is only useful as long as employees make use of it – and people only fully utilise systems that are intuitive.

Some of our partners barely access their system, so I've tried to make it as simple to use as possible. I designed clear icons so users can navigate easily, my goal being to allow people to manage every task within three clicks.

In addition, we offer monthly training sessions to anybody who needs a refresher on how to use a system. Always keep simplicity in mind when implementing your business continuity system.

4. Build an Automatic Dashboard

I’ve implemented Avinor's crisis management system alone and am responsible for both building the system and training all users. For anyone undertaking a similar task, I recommend you keep a project management tool or automated spreadsheet that can be easily updated and shared with, for example, senior management. I made a form in Excel that gave me an overview of time management, costs, slack, and work packages at all times.

5. Set up Clear Notification Routines

A business continuity management system serves no purpose if the information within doesn’t reach the right people at the right time. Therefore, it’s essential to set up clear notification routines so that everyone knows whom to notify and where their responsibility begins and ends during an incident.

In the aviation industry, the staff in the air traffic control tower are often notified first. They have the best overall view of the airport, and can, in turn, call the operations centre who then notify relevant personnel. This can be the tactical crisis management team and local crew. If the situation is severe, the response can be escalated to the operational unit situated in Bjørvika. This is how we ensure that notification and mobilisation is efficiently and correctly executed, every time.


I hope this advice proves useful to you in your crisis management efforts. Remember, the size of your organisation shouldn't be a hindrance to effective preparedness planning – just make sure the system you have in place is intuitive and easy for employees to use.

Does your organisation have an effective emergency preparedness system? Why not try a demo of CIM today? New call-to-action

By Johan Lindström

Johan is a senior advisor at Avinor, the government-owned operator of almost all of Norway's airports. He manages the business continuity programme and is responsible for security and preparedness across Avinor's portfolio. He holds a degree in project management, a management degree from BI and has attended Räddningsskolan Rosersberg.

More blog posts from this author

Subscribe to the blog