Civil protest by day became decidedly uncivil by night in Ferguson, Missouri, following the grand jury decision not to indict the police officer involved in the Michael Brown shooting. Pharmaceutical retail giant Walgreens boasts being on street corners all across America, so in November 2014, when the National Guard was called in to support local public safety efforts in Ferguson, that included protecting Walgreens stores in the area, so they could continue serving the community. When all was said and done, eleven Walgreens stores were temporarily closed during the unrest with damage varying from broken glass to the near-leveling of a store from a fire started by rioters.
Whether natural or man-made, Walgreens’ priorities in an emergency are to provide for the safety of customers and team members, minimize business disruption, prevent losses, and restore full services to the community as quickly as possible.
Fortunately, Walgreens’ Asset Protection Solutions (APS) team was, like their mantra, “well prepared.” The preparation, response, and recovery all began in Walgreens’ Security Operations Center (SOC). To initiate preparation efforts, their SOC identified their potential impact zone by creating a radius around protest routes in Ferguson. They then familiarized themselves with each element of the security systems in those forty-five stores. They also coordinated with APS field resources to support store preparedness by encouraging team members to review procedures for civil disturbances, flash mobs, looting, and early store closings.
To improve their own preparedness, Walgreens’ SOC increased their staffing levels, expanded their social media monitoring capabilities by adding a Ferguson-specific situational awareness desk, and created a protest assessment guide for SOC specialists to monitor news reports, gather intelligence, assess risk, and control rumors. By the time the grand jury decision was announced, Walgreens stores were prepared to close, if necessary, as a precautionary measure. Their SOC was able to respond without missing a beat.
While official planning for the unrest in Ferguson started in August of 2014, true preparation had been underway since the development of Walgreens’ Security Operations Center in 2012.
Growth of Loss Prevention
Loss prevention has played an important role at Walgreens for more than fifty years. However, since the division expanded and rebranded to become APS and built a SOC, their impact and approach to risk mitigation have grown rapidly. Since its inception, Walgreens’ SOC has been leveraged to develop a robust Emergency Operations Center (EOC) and support other key functions, and it continues to evolve.
Before Walgreens built their state-of-the-art SOC, their IT service desk monitored store burglar alarms and outsourced fire-alarm monitoring to third parties. When a natural disaster or a widespread product recall struck, team members from across the country put their day jobs on hold to manage the corporation’s response. If a crime trend swept across the country, field team members from LP were left to manage the situation locally.
This decentralized approach to resource allocation is still used by many companies today, but not by Walgreens. In 2012 Walgreens Divisional Vice President Tim Gorman saw an opportunity. “I had a vison of bringing all the resources needed to best support our enterprise under one roof, and I knew APS was the right group to build it,” said Gorman.
Building an SOC
A hard look at the numbers was enough to build a business case for the development of an operations center. By converting to in-house monitoring of all alarms, projections indicated that the SOC would pay for itself in the first year and result in millions in savings in subsequent years.
With APS team members already involved in the enterprise’s security functions, the development of a formal operations center proved to be an opportunity to relieve corporate and field team members of additional responsibilities, centralize incident and emergency response, and continue developing APS’ scope and capabilities.
The APS team took the lead on designing Walgreens’ operations center by leveraging institutional knowledge, visiting other public- and private-sector operations centers, and incorporating Gorman’s vision to create a scalable solution. The finished product is a 24/7 Security Operations Center that monitors burglar alarms, fire alarms, and power outages and also provides situational awareness to the Walgreens enterprise.
Even with lofty goals and expectations, no one could have predicted how quickly Walgreens’ SOC would develop to support the preparation for and response to incidents like civil unrest in Ferguson.
Creating a Model of Resiliency
While designing Walgreens’ SOC, the potential benefit of streamlining communication and related escalation processes was clear. It was also evident that their SOC’s initial and continued success would hinge upon resiliency and redundancy.
Walgreens decided to store their technology in the cloud when possible, so even if physical infrastructure is challenged, the technological systems needed for daily operations could still be accessed. The technologies that are not cloud-based offer redundancies through multiple physical servers stored in strategically placed data centers.
A back-up SOC facility and “go kit” with mobile technology are also available in the event that team members need to quickly relocate. Both the technology and processes for relocating are tested on a regular basis.
To ensure adequate staffing coverage should a large-scale incident require additional SOC support, a group of APS staff trained in SOC roles works immediately outside of the facility.
As the single point of contact for the safety and security of more than 8,000 locations, Walgreens’ SOC responds to incidents of every size and scope. This provides opportunities for SOC team members to improve their skills and put response procedures to the test on a daily basis.
“We learned very quickly that our response procedures need to be specific enough to address our top security challenges and also broad enough to apply to the unexpected,” explained Gorman. “When a store called and asked what to do when a nest of snakes appeared in their store’s ceiling tiles, we had to be prepared. And we were.”
Activating the EOC
A formal, physically adjoined Emergency Operations Center was developed in conjunction with the Walgreens SOC. Should the SOC report a dramatic increase in call volume, a significant level of disruption to business operations, or the need to maintain accurate site status information for a large number of stores, an EOC activation is considered. With the EOC activation decision criteria flowing through APS’ SOC, it was a natural fit for APS to build out their business continuity function to oversee the EOC by making activation decisions, managing emergency response, and hosting other corporate representatives as needed.
When Hurricane Sandy hit the Northeast in 2012, Walgreens had more than 600 sites impacted. Determining the status of each store and specific needs of each community could have taken a significant amount of time. Instead, Walgreens reaped immediate benefits of their new SOC and activated their EOC.
Once their EOC was activated, Walgreens APS team invited the corporate support team to share their voices in the EOC, all while receiving instant location and situational awareness updates from the SOC.
The corporate support team comprises representatives from key functions critical to business resumption, including facilities, IT, pharmacy, store operations, community affairs, government relations, media relations, internal corporate communications, legal, compliance, and human resources. EOC activations also include location-specific attendees who participate by phone, which typically include representatives from distribution centers, transportation, and retail operations. By using the same agenda and reporting structure for every activation, the EOC is able to maximize its effectiveness regardless of incident type.
By leveraging the consolidation of information through their SOC and activating their EOC to bring representatives from various divisions together, Walgreens was able to begin their targeted response to Hurricane Sandy almost instantly. They set up pharmacy trailers in the parking lots of their destroyed stores to ensure medications were available to the community, deployed electric power generators, reopened the front end of stores that were only partially damaged, routed deliveries of daily essentials to these stores, assisted team members with getting to work, and even offered free cell phone charging stations at stores in communities without power. This immediate response was imperative for upholding APS’ strategic mission of safety, security, profitability, and resiliency.
“Our EOC was activated for two weeks straight with representatives from facilities to community affairs present. Through our partnered efforts, we were able to ensure our team members and communities in the Northeast were well taken care of, and we were able to resume operations in a dramatically reduced period of time,” explained Gorman.
Walgreens’ efforts and Gorman’s leadership around Hurricane Sandy were recognized by the Department of Homeland Security with the 2013 Rick Rescorla National Award for Resilience.
To keep their skills sharp for leading EOC activations, APS’ business continuity team members regularly lead and participate in exercises and drills. Internal tabletop exercises provide refresher opportunities for APS support functions, and external exercise participation provides business continuity with opportunities to develop relationships with various emergency management agencies as well as public- and private-sector partners.
Leveraging the SOC
Early on, infrequent events were more likely to require additional corporate support and lead to an EOC activation. Walgreens stores have since become more familiar with reporting incidents to their SOC, and the SOC’s capabilities have greatly expanded. These developments equip APS with more proactive information and enable them to manage most large-scale incidents without the need to fully activate their EOC.
In advance of the grand jury decision in Ferguson, the Walgreens SOC sent preparation guidelines to stores in the expected impact zone, and stores reciprocated by sharing their anticipated needs, plans for early closures, and information received from local law enforcement. The advance notifications proved valuable to stores and APS for implementing appropriate risk mitigation strategies.
Typically, when a store is broken into or vandalized, a Walgreens team member is dispatched to meet law enforcement at the location. Recognizing the inherent risk this would pose to team members during the expected unrest in Ferguson, APS worked with field resources to set up a temporary, small-scale command center in the St. Louis area.
The benefits of the centralization of Walgreens’ SOC were mirrored in this command center. Every time their SOC would have sent a notification to a local store team member for an alarm activation, act of vandalism, or other incident, they instead provided updates to the St. Louis command center, so repair efforts could be coordinated locally once the scene was deemed safe.
Jim Wilson, an APS director in St. Louis, worked in the temporary command center and led local preparation and recovery efforts. “The process that we used significantly affected the safety of our store personnel because good decisions were made with good data,” said Wilson, “and I think it significantly enhanced our ability to recover. The synergy after the event just continued.”
Gorman added, “The SOC was in their element during the unrest in Ferguson. Despite having a store set on fire, they worked calmly and diligently each night like a well-oiled machine.”
Developing Key Functions
In addition to supporting more than 8,000 locations and presenting intelligence to their EOC, Walgreens’ SOC continues to develop its scope. The role of their SOC has also expanded to support key functions across the enterprise, including corporate campus security, international travel, and consumer relations. Last year they responded to more than 10,000 incidents.
An added benefit of centralization is evident through the video capabilities of Walgreens’ SOC. Access to real-time video footage for their locations enables them to verify the root cause of alarm activations and thereby reduce instances of unnecessary dispatch, offer physical descriptions of suspected lawbreakers to responding law enforcement, and provide APS’ business continuity function with footage for performing initial site damage assessments when a store is physically inaccessible.
Video footage was especially beneficial to Walgreens during the unrest in Ferguson. Monitoring screens rotated through video clips from store cameras in the potential impact zone. This enabled their SOC to provide real-time information to law enforcement, which helped officers to arrive at a Walgreens store while crimes were still in progress.
The area growing most rapidly within Walgreens’ SOC is situational awareness. A combination of social media tools, numerous third-party intelligence sources, and details from stores helps them cast a wide net for learning of potential impacts to assets, from supply chain disruptions to personal safety threats.
Various social media aggregators with carefully designed search strings are particularly useful for providing proactive information to executives and stores. By leveraging various social media platforms during the unrest in Ferguson, they gleaned significantly more information than was offered by 24/7 news reports.
Live-stream social media video feeds from protesters were particularly helpful for gaining details on the sentiment of the area and learning of upcoming protest routes. This additional information enabled their SOC to provide details to the APS St. Louis command center and to key areas across the enterprise to ensure the stores likely to be impacted were secured and closed early.
“It’s incredible how the SOC is able to stay true to its roots with alarm monitoring and maintaining its valuable UL certification, while also growing to better meet the needs of key functions across our division and the enterprise,” reflected Gorman. “During Ferguson, using situational awareness information was paramount in significantly mitigating loss and reducing potential risk to team members.”
Lessons Learned
Through the development of an SOC and EOC and an evolution of key functions, Walgreens learned many lessons that may be of interest to others developing their own operations centers.
Maintain Up-to-Date Contact Information. Walgreens recognized the importance of this before they opened the doors to their SOC, but like many organizations, they were faced with the challenge of keeping up with an ever-changing stream of contact details. The solution was integrating their communication matrix with an enterprise system that updates personnel details and contact phone numbers regularly. This further streamlines their SOC’s communication and expedites the notification process.
Limit the EOC to Essential Participants. Early on Walgreens struggled to accommodate all interested parties on their call bridge during an activation. They quickly learned that many team members joined the EOC out of curiosity rather than need. By limiting the attendee list to divisions essential for response functions and asking only one person per division to participate in the EOC, discussions remain relevant, and everyone has a seat at the table, whether physical or virtual.
Expand Intelligence Sources as Much as Possible. Walgreens is continually adding to its resource repertoire. By following social media, the effectiveness of their SOC is improved. For instance, information about criminal activity in a store is often reported on social media much earlier than by traditional means. Using aggregators with fine-tuned search strings offers increased efficiency by allowing their SOC to monitor countless sources simultaneously.
Ferguson Successes
Many lessons Walgreens’ SOC learned in previous situations were valuable preparation points for Ferguson and were reaffirmed as the unrest unfolded.
Training Additional Staff Pays Off. By having additional APS team members trained to support the SOC’s daily needs, SOC team members were prepared to focus their attention specifically on Ferguson.
Effective Communication Is Key. The media coverage leading up to the grand jury decision in Ferguson incited fear in Walgreens team members in Ferguson, across the country, and at the corporate campus. Equipped with facts, their SOC communicated realistic expectations and actionable recommendations.
Walgreens SOC Lead Sean Dospoy explained: “The reality is that there were hundreds of protests throughout the country following the grand jury decision, but only a small percentage turned violent. Through our diligent research and methods of investigation, the SOC was able to determine which protests posed a potential threat to our stores and focus communications accordingly. We also leveraged our notification capabilities to provide preparation guidelines and reiterate the message that team member safety is more important than property.”
Speaking to the importance of effective communication, Dospoy said, “The sheer amount of information and number of notifications the SOC sent to all necessary stakeholders shows just how vital a streamlined process of communication between the field and the SOC is. This is true for all widespread events.”
Preparation Is Essential. Planning and preparation were of cardinal significance to Walgreens’ successful response and recovery to the chaos that transpired in Ferguson and at numerous Walgreens stores.
“Our SOC and field team members recognized the importance of using the time leading up to the grand jury decision wisely,” shared Gorman. “They coordinated efforts to ensure plans were in place, and everyone was prepared to execute them. For example, practicing closing 24-hour stores that had never closed before saved valuable time when team members needed to exit the store before the situation escalated.”
APS field team members liaised with local law enforcement and reviewed response plans, including how the stores would be notified of the release of the grand jury decision and which rally points to use.
“I can’t emphasize enough what a combined effort it was between the field asset protection managers, the region operations team, and the SOC. It was a collaborative effort, and we were in lockstep the whole way,” said Wilson. “We had outstanding support from the SOC. They were there for everything that we needed.”
For their successful implementation of a recovery plan that resulted in no injuries to team members and the restoration of services to the area, Walgreens was recently recognized by the Business Continuity Institute with the Most Effective Recovery Award.
Looking Forward
There is no doubt that Walgreens’ SOC has grown rapidly to exceed all expectations. Yet APS continues to keep their ear to the ground for more ways to leverage their capabilities to support the entire Walgreens enterprise. “We are always learning of needs that other areas have, and we know that we have the tools and reach to meet them,” said Gorman.
Loss prevention has played an important role at Walgreens for more than fifty years. However, since the division expanded and rebranded to become Asset Protection Solutions and built a Security Operations Center, their impact and approach to risk mitigation have grown rapidly.
Walgreens decided to store their technology in the cloud when possible, so even if physical infrastructure is challenged, the technological systems needed for daily operations could still be accessed. The technologies that are not cloud-based offer redundancies through multiple physical servers stored in strategically placed data centers.
When Hurricane Sandy hit the Northeast in 2012, Walgreens had more than 600 sites impacted. Determining the status of each store and specific needs of each community could have taken a significant amount of time. Instead, Walgreens reaped immediate benefits of their new SOC and activated their EOC.
The area growing most rapidly within Walgreens’ SOC is situational awareness. A combination of social media tools, numerous third-party intelligence sources, and details from stores helps them cast a wide net for learning of potential impacts to assets, from supply chain disruptions to personal safety threats.
