Italian Crisis Management in 2020

Abstract

Approaches to risk analysis, crisis management and resilience enhancement for Critical Infrastructure (CI) Protection will be considered starting from a case study related to the management of the pandemic in Italy. Business continuity and crisis management models for CI are analyzed aiming to deal with complexity and reduce uncertainty relating pandemic and long-time crisis. Furthermore, is presented a methodology highlighting the functioning of the Italian Civil Protection and its systemic nature: a complex apparatus made up of different elements and organizations, which derives from the functioning of different organizational systems in interaction with each other. As a baseline for the coordination management the Augustus Method is considered for its strategical, tactical and operational aspects. One of the main outputs of the research consists in creating a “what if” forecasting model, configured as a visualization of the propagation of negative effects on the supply chain and manpower over time.

1. Introduction

Dealing with complexity and reducing uncertainty during 2020 crisis is a priority, for Countries, Critical Infrastructures, and companies.

Due to the interdependency of Critical Infrastructures, companies, and the civil society their protection and management represent a significant challenge and, somehow, an opportunity.

The present contribution aims to support the understanding of the tangled pandemic scenario, studying the interdependencies between different sectors and their supply chain, proposing a model addressed to the complexity management for ensure the Business Continuity both of Critical Infrastructure and companies.

The Italian response to the crisis generated by the pandemic was observed, from the study of the impact of the crisis on Critical Infrastructures, to the response strategies, the remediation plans, passing through the reference standards on business continuity and supply chain (in the ISO family of standards).

The imposed lockdown has led to a forced acceleration of digitization, with the challenges and opportunities that could be derived from it.

The crisis management, supported by the experience generated by the avian influenza, together with the support tools provided by the Italian government has proved to be effective and efficient, also relaunching several SMEs through their productive conversion.

The human factor has become evident as the cornerstone of any service, from the provision of essential services falling within the competence of the Critical Infrastructures, which have involved a particular attention to the continuous security and business protocols to be followed, to the most disparate production sectors. It is also necessary to remember how the interconnection between the different sectors and services now characterizes our reality, and therefore how the so call “What-If Analysis” s fundamental in the development of decision support tools for crisis management. In this context is clear that resilience is founded on risk analysis and the drawing of recovery plans, together with measures for an increased control over the value chain.

2. Addressing complexity and impacts of pandemic in critical infrastructure

Dealing with complexity and reducing uncertainty during 2020 crisis is a priority for Countries, Critical Infrastructures, and companies.

Complexity could represent a risk but also an opportunity to create a new competitive advantage.

Society is dependent on composed critical networks, becoming more complex as are strong interdependent both within and between infrastructure systems [1].

Nowadays, complexity and uncertainty assess the search for new and effective management strategies and methods. Embracing unpredictability and planning to adapt is crucial to manage the complexity that cannot be eliminated, although, it can be reduced to manageable levels. Complexity and vulnerability of Critical Infrastructure systems has been explored and assessed [2, 3].

Complexity is related with composite systems and problems that are dynamic, unpredictable, and multi-dimensional. It consists of a collection of interconnected relationships and parts. Unlike traditional “cause and effect” or linear thinking, complexity science is characterized by nonlinearity [4]. Complexity management needs to consider several layouts of complexity, in fact an IC or a company internal value chain is strongly dependent on external complexity.

For each area of complexity regulation, as avoidance and reduction related to causes, transfer, and division, exist several theories, approaches and methods.

Effective complexity management aim to develop an appropriate and effective incident response plan. Finally, complexity must be addressed proactively.

In fact, in such complex scenario, different actors (institutional and non) have responded to the crisis in multiple ways, according to the regulations issued. Moreover, these troubled times show how strategic and essential are some sectors.

In the crisis generated by the pandemic it has been confirmed that the daily life of the citizens depends on the reliability of the Critical Infrastructures (CI) to supply essential services such as energy and water. In recent years, Critical Infrastructure control systems have become more complex, with increasingly interconnected devices; a trend that will probably continue with the Internet of Things.

The need for increased resilience to resist extreme events of both natural and malicious origin has become more acute. With Critical Infrastructure continuously exposed to threats, especially cyber-attacks, there are severe security implications, most notably in the energy sector which is ranked as one of the most affected sectors with the highest incident costs [5]. Any attack of this nature is likely to have knock-on effects on a country’s overall economy and the lives of its citizens.

The pandemic, all in all, has had modest effects on the electrical service. Electricity consumption has been reduced by about 10% on average, but with a very uneven distribution on the Italian territory. Fortunately, the phenomenon has been well controlled and there have been no perceptible effects, but it is easy to imagine the consequences of possible inefficiencies. The effect of the pandemic could be very marked on geopolitical balances, in a context of possible tensions deriving from the rebalancing of the primary energy market and the challenge of the Fourth Industrial Revolution (4IR) [6].

The energy issue brings us back to the more general field of critical infrastructures: electricity and energy system, communication networks, infrastructures for the transport of people and goods (air, sea, rail and road), health system, economic-financial circuits, administrative and state organizations and bodies.

What happened on the Istituto Nazionale della Previdenza Sociale (the Italian Social Security), website is a symptom of a strong criticality in the Country System, where technical shortcomings make the fundamental rights of citizens even more vulnerable, and how IC and companies must equip themselves to manage crisis situations that are not predictable. For this reason there have been several episodes in Italy which have triggered the alarm by the Centro Nazionale Anticrimine Informatico per la Protezione delle Infrastrutture Critiche (CNAIPIC - National Anti-Crime Information Centre for the Protection of Critical Infrastructures).

In terms of crisis management, thanks to the experience of avian influenza (H5N1), which has highlighted how the human factor is the most valuable element for any company and as such must be safeguarded and protected, operators of critical infrastructure have been able to develop a series of effective initiatives, as demonstrated by the fact that no essential service, i.e. the supply of gas, water, electricity, transport, etc. has suffered interruptions or dysfunctions in recent months. And this despite the problems related to difficulties in supply, reduced mobility, the presence of staff in quarantine fiduciary and/or infected and considering the commitment of companies to safeguard the health of their workers.

This achievement is the result of an effort which in recent years has seen a significant change in the role of the security managers, which has shifted to the top management in order to bring strategic choices back to specific task forces capable of having a prompt impact on all levels of the company’s organization, being equipped with the financial and decision-making capacity appropriate to the criticality of the situation [7].

2020 long time crisis and consequent lock down were managed asking to every operators of critical services to maintain business continuity and to guarantee services if critical. This means that not only critical infrastructures at national level, but also critical infrastructures at regional or city or province level had to maintain operation, even having the supply chains partly or completely locked and also even having manpower partly or completely in smart working.

The Office of the Military Advisor of the Presidency of the Council, in consideration of the necessity to guarantee the essential services provided by Critical Infrastructures, has provided the precautionary principles, to which Critical Infrastructure Operators are required to comply in order to contain and contrast the spread of the pandemic, while ensuring the continuity of the supply of essential services, the operability of the facilities and the security of the personnel involved.

These lines suggest, first, a reduction in the number of staff working in situ by reducing activities to those that cannot be postponed for business continuity, and to review the maintenance programs, limiting them to those that cannot be postponed and postponing those that are not indispensable, promoting the adoption of smart working at all levels, necessary for the continuity of the service. The Precautionary Principles highlight the need to provide specific training and tools to operators to prevent and combat the threat of cybersecurity, the importance of which is growing today, to equipping all staff with adequate IT support, including the use of dedicated connections, VPN systems and anything else in order to ensure adequate levels of cybersecurity, including the issue of appropriate rules of conduct by staff working in smart working mode.

Furthermore, is required to prepare all the necessary measures related to sanitization.

The Companies are invited to organize the personnel involved in activities that cannot be postponed at the work sites or field operations in teams composed of the minimum number of people necessary for the safe execution of the various activities. The composition of each team, to increase its resilience, must not, where possible, change over time and specific procedural measures must be taken to avoid, or limit to a minimum, physical interaction between several teams.

With regard to the management of the control and management rooms, given that it is necessary to ensure their functionality in all conditions, it is recommended that all useful measures be taken to contain the pandemic; organizing the staff into several teams and adopting specific and more stringent safeguards for this type of personnel, for example, measures and/or adequately equipping several rooms, possibly in different locations, to allow the alternation of shifts in different rooms and/or sanitized each shift change [8]. Another taken measure was the “voluntary segregation”: the provision of temporary accommodation for groups of people who will operate in the control center for a period of not less than 14 days without physical contact with external personnel. The spaces to which such staff have access will be forbidden to those who do not implement voluntary segregation. To guarantee the continuous rotation of the activities, a second team of staff is set up at the same time, already in isolation at their homes.

Telespazio has set up a three-level system for its Space Center which, before entering the control room, requires a further period of voluntary quarantine within a camp facility located at the Fucino site [9].

The theme of cyber-security is particularly relevant in an increasingly interconnected world where threat vectors multiply and can affect the vulnerabilities of Critical Infrastructures. Moreover, the low level of cybersecurity preparedness of the country system is also reflected in low awareness among citizen-users.

In view of the above, we can say that for the management of emergencies and crises first of all it is necessary to develop a culture of security, supported by the necessary tools and strategies, also considering that we are moving towards the increasing digitalization of any area of the country. In order to do this we can combine the creation of high potential and distributed networks, to avoid in case of stress of infrastructure use, domino effects. It is not possible today to imagine an area of the country that is not covered by essential infrastructures and services that respond to adequate minimum levels of service delivery and security, especially cybersecurity.

It is therefore also essential to start a training process in line with the needs of the world of work and thus adapt to the new professions, together with a plan for the conversion of skills towards new professional qualifications [10].

A fundamental and new aspect of this crisis, which has led to a rethinking of the management of Critical Infrastructures, is that there was a clear “ day before” (in Italy between 10th and 11st March) and a lack of clarity in the “day after”. There is still the sensation of a prolonged crisis and the passage to a remote working that has reduced social relations. This situation has also led to a discontinuity in the visibility that the employer has towards his employees (with respect to how he is and what he feels) that had never been experienced before, while the knowledge of the human model is crucial.

When we make a reading of complexity, we consider a company (or a CI) and analyze it in all that is the flow of its value chain and we retrace all the places and moments of a not physiological complexity.

One type of challenge for Critical Infrastructure Protection is about the dependencies and interdependencies among different Critical Infrastructures [11].

In the context of this extremely long lock-down we had an enormous complexity of relations with suppliers and with those who had to remain in continuity and we would find in the re-opening a strong discontinuity, also in understanding for example the rules with which it was possible to re-open and the responsibilities (in fact, the provision of a suitable team that knows how to interpret the rules is also part of crisis management).

2.1 The Italian production strategy during the 2020 pandemic: statal measures and production conversion

Italian SMEs have worked out an appropriate response strategy to the crisis caused by the 2020 pandemic.

Starting from the importance of the role of each individual entrepreneur, through the constant and daily collection of information on a formal and informal basis, it was possible to identify the strategic levers and focus on new core businesses, based on corporate liquidity, assets and resources.

It emerged that the creation of balanced strategic levers, the make/buy balance, together with the dialog with the stakeholders represented a fundamental element for the conception of a response strategy that represented an example of business resilience.

The crisis has certainly been, and still is, an opportunity to examine which lessons are learning for the future creation of resilience-oriented protocols [12].

There are many Italian companies that have reacted to the crisis by reconverting their production.

Phase two, co-existence with the pandemic, began on 4th May 2020. The Prime Minister’s Decree issued by the Government has made mandatory the use of the mask in closed places accessible to the public, such as public transport and shops. Wearing the mask is mandatory in all situations where “it is not possible to continuously guarantee a safe distance” [13].

Given the emergency and lack of access to this personal protective equipment, more and more companies have chosen to make a concrete contribution and boost their activities after the lockdown by aiming at the reconversion of production chains to manufacture masks. Initiatives that are born to make available the expertise and skills of entire sectors forced by the emergency and the upheaval of daily habits to rebuild their missions and restructure their short, medium- and long-term objectives.

Siare Engineering, an Emilian company specialized in the manufacture of lung ventilators (the unique company in Italy), at the outbreak of the emergency increased its production and changed its export market. In mid-March the company delivered 300 machines to the Civil Protection, originally destined for countries such as South Korea, India, the Philippines and Vietnam, its traditional clients. The company was supported by specialized Army technicians with the aim of producing over 2300 machines, tripling production. Siare Engineering’s efforts were supported by companies such as Ferrari, FCA and Magneti Marelli [14].

Grafica Veneta, a Paduan company active in the printing sector, has reconverted its production to produce 2 million masks. These products, even though they could not be intended for healthcare workers, provided (at a time of dramatic shortage) an initial protection to the population, and were distributed free of charge to the population by the Civil Protection and the Alpini (Italian Army’s mountain infantry).

Mestel Safety, a specialist in snorkeling and diving masks, deposited a patent at the beginning of March to transform this diving equipment into protective masks against contagion [15].

On 23rd March Confindustria Moda launched an adhesion campaign to make masks and PPE, to which 200 companies have immediately joined. A similar initiative was taken by CNA Federmoda. Some of the most important Italian fashion companies responded to the call, such as Armani, Calzedonia, Fendi, Gucci and Valentino.

Prada, on request of the Tuscany Region, has started the production of 80,000 white coats and 110,000 masks [16].

Toscano Alta Sartoria (ex Mabro) has promptly reconfigured its production starting, from March, to produce 3000–4000 masks per day [17].

A choice made also by Valigeria Roncato, a leading company in the sector in the production of luggage made in Italy, which has decided to make a strong contribution to the enduring battle at pandemic by converting its production lines for the production of long-lasting, non-disposable, washable and therefore reusable masks [18]. The core business of the Veneto industry responds to the urgent demand for protective masks that are becoming more and more indispensable.

These solidarity initiatives have been stimulated by the possibility to access incentives to activate the production and supply of medical devices and personal protective equipment (PPE) for the containment and fight against the epidemiological emergency.

And more: to deal with the pandemic, numerous measures have been taken to prevent and contain its expansion and its effects on the economic system. These are emergency measures issued at short distance from each other and linked to each other.

The financial support to SMEs has gone through interventions on the fiscal side, the suspension of the refund of loans, the public guarantee on those granted to companies that have suffered decreases in turnover, a fund for the promotion of Made in Italy, financing.

The objective was to prevent SMEs from shutting down due to lack of liquidity because of the emergency: according to Cerved the system could lose up to 650 billion in revenue between this year and the next.

In this picture, are extremely important the interventions to support the liquidity of the productive network, strongly strengthened by the Legislative Decree n. 23/2020 (so-called Liquidity Decree). This last measure has on one hand modified and on the other hand implemented the extraordinary measures introduced by Decree Law no. 18/2020. This is also thanks to the new regulatory framework for State aid, the EU Commission’s “State Aid Temporary Framework” [19], which has intervened in the meantime. On 14th April 2020, the European Commission authorized the extraordinary support aid schemes provided by Decree Law no. 23/2020. Further interventions to support the liquidity of companies are also contained in Decree-Law No 34 of the 2020.

The economic support measures for businesses adopted with the decrees of March–May 2020 (Decree-Law No 18/2020, Decree-Law No 23/2020 and Decree-Law No 34/2020) are essentially attributable to the following main lines of intervention: liquidity support; export and internationalization support; capitalization support and non-repayable grants; suspension of certain obligations and tax payments, as well as temporary relief on the fixed costs of electricity bills for low-voltage non-domestic users; interventions for companies in crisis, industrial reconversion and development contracts; protection of the national economic and business fabric through changes, some of which are temporary, to the exercise of special powers in sectors of strategic importance (so-called golden power).

Among the measures for companies in crisis, industrial reconversion and development contracts, the following interventions are highly important.

Decree Law No. 18/2020 refinanced the measure of development contracts by €400 million for 2020 (Article 80). The Ministero dello Sviluppo Economico (MISE) Directive of April 15th, 2020 provided for the allocation of resources.

Finally, it should be noted that Law Decree no. 18/2020 authorized the Extraordinary Commissioner for the Epidemiological Emergency to provide funding to companies producing medical devices and personal protective equipment, using INVITALIA as the entity managing the measure. To this end, expenditure of EUR 50 million for 2020 has been authorized (Article 5). The aid scheme was authorized by the EU Commission (on 22nd March 2020). The Ordinance of the Extraordinary Commissioner of 23rd March 2020 (published in the Official Journal on 24 March 2020) implemented the measure.

The resources were assigned to the granting of aid to investment programs aimed at increasing the availability of medical devices and personal protection equipment in the national territory through the expansion of the capacity and/or the reconversion of an existing production unit. The facilities consist of subsidized financing of up to 75% of eligible expenditure. The maximum amount of the facilities that can be granted, in terms of aid (intended as Gross Grant Equivalent), may not exceed 800,000 euros, in accordance with the European Commission Communication of 19th March 2020 - COM (2020) 1863 final - “Temporary Framework for State aid measures to support the economy in the current COVID-19 outbreak”.

Manufacturing masks, gowns, gels and disinfection products, plexiglass spacers, medical devices. These are some of the production reconversions following the pandemic of companies in most of the textile-fashion sector, but also plastics, chemicals, cosmetics, manufacturing, medical, graphics and printing [20].

For some sectors, textiles and chemicals, the new production is opening stable business opportunities in the post 2020 long time crisis, through new channels, which also open opportunities for professional integration.

More than two thirds of companies in the chemical sector, which in the emergency produced alcohol-based disinfectant gels for the hospital sector, are planning to permanently convert, but now intend to extend to direct sales to consumers.

And two thirds of the companies in the plastics sector, which have taken the opportunity to make plexiglass spacers to be installed in the companies, will not stop production. By virtue of a demand that is still expected to be sustained, moreover, more than half of the companies in the textile sector, which are now also aiming to create joint ventures with fashion companies, and almost all the companies in the print sector, which have activated new channels, will maintain active production of masks.

Not all companies, however, are planning to maintain the conversion once the normality is restored, with profound differences between sectors, due to the specificities of the productions.

These are mainly temporary reconversions, on the other hand, for fashion companies that have turned for a few weeks to the production of masks and gowns, as for those in the automotive, cosmetics, medical devices, and manufacturing sectors.

In addition to interventions aimed solely at conversion, the whole world of work has had to face the need to change and adapt to the new situation. Another example of resilience, together with the reconversion of the production of different companies, was the adoption of smart working.

There are data on the transition to remote working collected by Associazione Italiana Esperti Infrastrutture Critiche (AIIC) with the help of other companies. It became clear that before the crisis and therefore until 2019 in companies 71% of employees did not even know what remote working was. During the pandemic 97% of people said they had been working remotely all the time and 43% of people interviewed said they would continue to work remotely.

Regarding the impact on the IT budget: 30% of companies said that investments on the 2020 roadmap projects reset and/or moved to 2021 or suspended.

In contrast, 30% of companies stated that investments will continue without any impact on the 2020 roadmap projects.

Finally, 60% of companies say they still do not know how to proceed with the investments.

The company management, however, has the advantage of being able to provide incentives for sanitization and safety at work: for companies are introduced incentives for sanitization and increased safety at work, through the granting of a tax credit equal to 50% of expenses up to a maximum of 20 thousand euros, and contributions through the establishment of an Inail fund.

The pandemic emergency has not only produced a strong acceleration of digital transformation, smart working and strong demands related to logistics, but also interesting productive reconversions, together with the consciousness of the complex interrelation through different sectors and their supply chain.

For SMEs, the introduction of new products has often meant a real revolution in the business, but able to ensure continuity in production that would otherwise have stopped. Moreover, in case the reconversions are expected to be permanent, are requiring new professional figures to support the activity.

And, most of all, the emergency confirmed the relevance of the human factor.

3. Concrete approaches to critical infrastructure protection

3.1 Supply chain continuity management and lack of manpower during the pandemic

Supply Chain Continuity Management (SCCM) must be considered as a necessary evolution of Business Continuity Management (BCM) models. SCCM is outlined in the ISO 22318 standard which is part of the group of standards for continuity management including ISO 22301, ISO 22313 Security and resilience (ISO 22318), and ISO 28000, which specifies the requirements for a security management system, including those aspects critical to security assurance of the supply chain. SCCM defines continuity in relation to external supplies, third parties or internal entities that play a supplier role in the context of the organization.

The simplified representation of the supply chain therefore provides a composite structure of internal and external suppliers (considering also the flexibility applicable to the relationships between the suppliers) that contribute to the operations of an organization and consequently of its customers.

If the relationship with suppliers is characterized by assets that are mainly intangible and movable and therefore related, for example, to the exchange of information or movable consumer goods, there will be greater control. An example in this sense, during the pandemic emergency management consisted in the possibility of maintaining relationships with suppliers through forms of smart working. This form of collaboration and coordination has been possible mainly between entities operating in sectors consisting of intangible assets such as professional, scientific and technical activities, financial and insurance activities, the activities of extraterritorial organizations, public administration and most professional services and, in general, all sectors that have not been affected by the suspension decrees.

In any case it will be necessary to have a management plan in case of crisis or incidents involving the supply chain.

The adoption of such measures will result in increasing control over the value chain in relation to an organization. In particular, the analysis carried out on the supply chain gives visibility to the mapping of interdependencies between different sectors allowing an analysis that goes beyond the single organization. Network analysis techniques could be combined with criticality and reliability metrics in order to produce composite methods that provide useful information to stakeholders [21].

As for ISO 22301, to plan the SCCM it will be necessary to carry out Impact Analysis activities with the individual suppliers involved, distinguishing critical suppliers from non-critical suppliers. For all relationships with critical suppliers, the guarantee of continuity can be determined by identifying a SCCM strategy to be agreed in transparency with these suppliers. Some strategic approaches may be:

• Reducing dependence on a supplier: direct engagement of substitute suppliers for a specific service; increasing on-site stock holding; establishing alternative solutions.

• Increasing resilience: loss mitigation; establishing mutual support policies with competitors.

• Working with suppliers: creating partnerships with suppliers; setting performance standard; monitoring and dealing with suppliers to increase their resilience; including SCCM requirements in supplier contracts.

The direct effects of the suspension decrees concerned the sectors directly involved and all those sectors that had to sustain the labor shortage caused by the lockdown. While other sectors not directly involved in the suspension decrees, such as financial services or wholesale trade, or sectors more prone to targeted reconversions and the adoption of smart working strategies such as online trade or the fashion sector, were able to stem the direct impact of the emergency or even profit from it.

The Italian National Institute of Statistics in May 2020 has provided a wide range of data and information about the positioning and contribution of the sectors within the Italian production system.

The database is based on the Extended Statistical Register on Economic Performance of Enterprises (Frame-SBS), which contains individual data on all industrial and service enterprises active in the country (about 4.4 million units), supplemented with additional statistical registers that provide detailed information on the characteristics of the employment, as well as import and export enterprises. The data have been further integrated with indicators taken from Italian Accounting.

Considering the enterprises that are part of the universe of reference of the system of Structural Business Statistics (SBS), those that from May 4 are operating in sectors still formally suspended are about 800 thousand (19.1% of the total), with an employment weight of 15.7% on the total of the sectors of industry and market services (excluding the financial sector) [22].

By revising and analyzing the Istat dataset updated in May 2020 [23] with regard to the pandemic, it can be observed in the Figure 1 below that the unavailability of manpower has most directly affected the following sectors in percentage terms:

1. Other mining and quarrying activities; creative, artistic and entertainment activities; travel agency, tour operator and reservation services and related activities; libraries, archives, museums and other cultural activities; rental and operative leasing activities; real estate activities; activities concerning lotteries, betting, gambling houses; Sports, entertainment and leisure activities; construction of buildings; Mining of metal ores; Manufacture of other transport equipment; Manufacture of leather and related products; Manufacture of motor vehicles, trailers and semi-trailers; Manufacture of furniture; Tobacco industry; Metallurgy; Advertising and market research: 100%

2. Manufacture of clothing, manufacture of leather and fur articles: 98,48%

3. Manufacture of fabricated metal products (except machinery and equipment): 93,98%

4. Manufacture of other non-metallic mineral products: 92,85%

5. Food service activities: 90,91%

6. Manufacture of machinery and equipment NCA: 89,48%

7. Textile industries: 86,77%

8. Other personal service activities: 83,46%

9. Wholesale trade (except of motor vehicles and motorcycles): 67,23%

10. Manufacture of rubber and plastic products: 63,67%.

Figure 1.

Unavailability of manpower.

3.2 Approaches to supply chain what if analysis: dependencies trees

Considering the analyses and remediation plans structured to protect the SCC, it is possible to structure What If models oriented to predict the consequences linked to the lack of a supply.

In relation to the manpower issue, for example, it is possible to structure time-oriented models that consider the negative effects of the manpower.

The Domino Effect methodology applied to manpower aims to study and quantify the consequences of a negative event that causes a lack of personnel and/or supply chain. The model is configured as a visualization of the propagation over time of the negative effects caused by the unavailability of a certain percentage of company personnel.

Such a predictive model can allow the decision maker to simulate different crisis scenarios resulting from the loss of personnel based on the formal organizational structure of the company. In order for the model to be effective, however, it will be essential to feed the model and the collection of information starting from the analysis of the organizational chart and the company function chart.

Information is needed that can be traced back to the following organizational areas:

• Administration (ADM)

• Actors in charge of Crisis Management (CM)

• Functions that have relationships with critical suppliers (SUP)

• Business (BSS)

• Commercial (COM).

The holistic evolution of this model consists in describing the interdependencies between different sectors starting from the simulation of a disservice concerning a sector. The generic example below can be applied to a single reality in order to understand what long-term effects the lack of manpower, considered as a distinguished sector, could have on the operational continuity of the organization itself (Figure 2).

Figure 2.

Manpower cascading effect on organizational areas.

The severity of the dependency corresponds to the extent to which the Quality of Service (QoS) perceived by the user is deteriorated. Depending on the item, the degradation can be measured by the variation of some specific parameters (coverage, signal reception, delivery time, etc.) with respect to the normal QoS values. In general, the measures that allow to characterize the QoS can be traced back to the general concepts of availability and capacity: the quality with which the service is provided can be described by quantifying the quantity of items provided in comparison to the demand and the time in which the service is actually available. The choice of the temporal moments in which to sample the phenomenon varies according to the item represented.

Metrics commonly agreed to in these cases include: Abandonment Rate; ASA (Average Speed to Answer); TSF (Time Service Factor); FCR (First-Call Resolution); TAT (Turn-Around Time); TRT (total resolution time); MTTR (Mean Time To Recover).

Starting from the elaboration of matrices that consider dependency relations, to represent a domino effect map it is necessary to apply a “filter” based on the degradation level of the service. an item will be considered compromised (and therefore will be represented in the domino effect map) only if the QoS degradation will be higher than a certain threshold, so the service is not considered acceptable (outage).

Various methods are described in the literature to perform this assessment. In general, the most common approaches consist in identifying some indicators that describe the various aspects of the consequences caused by an out of service event.

These indicators can fall into the following categories:

• number of people (evaluated in terms of people impacted by the disruption)

• economic damage (assessed in terms of the extent of economic losses and/or deterioration of products or services)

• effects on public opinion (assessed in terms of impact on public confidence, physical suffering, and disruption of daily life).

Simulation of interdependencies and graph-based model to understand critical infrastructure interdependencies are proposed in literature [24, 25, 26, 27].

The graphical output here proposed (Figure 3) from the described model consists of dependency trees, time-oriented, that describe the collapse of the internal structure of an organization following the manpower “sector” unavailability. This model can be applied to a single organization based on its SC analysis starting considering one or more products and services sectors.

Figure 3.

Manpower dependency tree.

By re-analyzing the ISTAT indices and considering the main sectors activated by the sectors impacted by the manpower shortage, it is possible to identify which related sectors have been most impacted by service interruptions than those listed above.

The sectors impacted indirectly by the shortage of manpower compared with the interruptions of those impacted directly are as follows:

• Rental and management of owned or leased properties

• Legal and accounting activities

• Road freight transport, removal and pipeline transport

• Financial service activities (except insurance and pension funding)

• Wholesale

• Manufacture of fabricated metal products (except machinery and equipment)

As we can see in Figure 4, some sectors such as Financial Services Activities that did not undergo significant effects during the first phase of the lockdown, are subject to an indirect impact due to the activity suspension of their main suppliers.

Figure 4.

Index of indirect impact on SCC for other sectors not highly affected by unavailability of manpower.

3.3 Augustus method and its application by the Italian civil protection

The Augustus method can be considered as another concrete approaches to Critical Infrastructure protection.

The Method is a tool used by the Civil Protection Department of the Italian Republic for emergency planning. The Augustus Method was created in order to equip the Italian Civil Protection Service with a unified strategy for planning the Civil Protection assistance at various levels of competence.

This method is named after the Roman Emperor Augustus (27 B.C. to 14 A.D.), who affirmed that: “The value of planning decreases with the complexity of the state of things.” In detail, Augustus stated that it is impossible to plan a strategy in the smallest detail, because the event when it happens will always present in a different way. The Augustus Method is generated from the need to harmonize the directions of emergency planning.

This approach to the complexity of modern reality was structured and adapted by Elvezio Galanti, who considers the “emergency” (a public situation of particular difficulty and danger) an “organism” with its own life and composed by physiological functions (endocrine system, cardiology, etc.), each one specialized in its own field in which normally carries out its ordinary activity. In the context of civil protection, the “organism” is defined as the territory in which they normally act, and each one because of its specific functions (municipal, regional, health, transport, etc.). In the event of a disaster, these activities must all work together and in synergy.

The Augustus Methodology highlights, therefore, a fundamental aspect of the functioning of the Italian Civil Protection: its systemic nature. A complex apparatus made up of different elements and different organizations, resulting from the functioning of different systems in interaction with each other and with the other organizational systems [28].

In the preventive design phase, the Civil Protection, first of all, must work to collect information (time of occurrence of an event, geological conformation, productive fabric, urban fabric, etc.), then it must proceed with basic examinations (hazard analysis, vulnerability analysis, etc.) and finally a first diagnosis will be made (scenario, i.e. what I expect to happen) and for this reason, facilities will be arranged (monitoring networks, cleaning of riverbeds, seismic adaptation of structures, etc.).

In the absence or in the impossibility of activating these protocols, minimum measures of confrontation will be taken through the constitution of a “resilient cell” to manage the “big 5”, i.e. five macro-areas in which the operational approach is divided into “acute emergency”. These are:

1. identification of sites per control room;

2. entry points for expected rescue;

3. reception areas and first assistance to the population;

4. identification of proximity sites to coordinate local interventions;

5. assistance to the population (health and management of any temporary camps for reception and stay).

In the “acute” emergency scenario the Augustus Method becomes a good practice to manage the situation through the identification of 14 basic support functions, or support, that match all the competent and specific institutional figures for each function at territorial level and that contribute to its ordinary and extraordinary functioning. These functions are usually involved during the emergency itself, while in the study phases prior to the emergency, such as forecasting and prevention, they are deactivated and delivered to their specific and ordinary institutional functioning. These functions are: F 1 - Technology and planning; F 2 - Health, social and veterinary assistance; F 3 - Mass-media and information; F 4 - Volunteering; F 5 - Materials and means; F 6 - Transport, traffic and roads; F 7 - Telecommunications; F 8 - Essential services; F 9 - Census of damage to persons and property; F 10 - Operational facilities; F 11 - Local authorities; F 12 - Hazardous materials; F 13 - Assistance to the population; F 14 - Coordination of operational centres.

The design of all coordinated activities and procedures of Civil Protection to respond to any disaster event that is expected in a specific territory is called “Emergency Plan”. The Emergency Plan must be implemented:

1. Forecasting and Prevention Programs

2. Information related to:

   • physical processes causing the risk conditions and their assessments

   • precursors

   • events

   • scenarios

   • available resources.

Therefore, it is necessary to represent graphically the information necessary for the characterization of possible risk scenarios for the implementation of intervention strategies for the rescue and management of the emergency, rationalizing and targeting the use of men and means.

According to the Method, the following conditions determine the success of a civil protection operation [29]:

• unitary direction: the unitary direction of emergency operations is implemented through the coordination of a complex system and not in a sectoral vision of the intervention.

• communication: constant exchange of information between the central and peripheral Civil Protection system.

• resources: rational and timely use of the resources really available and the availability of the men and means suitable for intervention.

The Emergency Plan structured according to the Augustus Method must be able to answer the following questions:

• what calamitous events may reasonably affect the municipality?

• which people, facilities and services will be affected or damaged?

• what operational organization is necessary to minimize the effects of the event with particular attention to the protection of human life?

• to whom are the different responsibilities at the various levels of command and control for emergency management assigned?

To satisfy these needs, it is first of all necessary to define the risk scenarios on the basis of the vulnerability of the portion of the territory concerned (areas, population involved, damaged structures, etc.) in order to have a global and reliable picture of the expected event and therefore to be able to dimension in advance the operational response necessary to overcome the disaster with particular attention to the protection of human life (how many firefighters, how many volunteers, which command and control structures, which roads or escape routes, which shelter structures, health areas, etc.).

The Emergency Plan is therefore a working tool calibrated on a likely situation based on scientific knowledge of the state of risk of the territory, which can be updated and integrated with reference to the list of men and means, but especially when new knowledge is acquired on the conditions of risk involving different assessments of the scenarios, or even when new or additional monitoring and warning systems to the population are available [30].

On the provincial level, the Emergency Plan will identify, at an inter-municipal or provincial scale: on the one side the situations that can configure a more extensive emergency of the single municipality, on the other side the situations, even localized, of greater risk, pointing out, when necessary, the need for an in-depth study of some aspects related to the Municipal scale.

On municipal level, a more detailed level of information is needed to allow the operators of the various components of the Civil Protection to have a reference framework corresponding to the size of the expected event, the population involved, the alternative road system, possible escape routes, waiting areas, shelter, storage areas and so on. Considering that the risk present in a given territory may refer to different types of events (floods, earthquakes, landslides, etc.), the Emergency Plan must provide for one or more “risk scenarios”, which must or may correspond to different types of intervention.

The Italian Civil Protection assumes primary and decisive roles on the institutional scene of civil protection in Italy. This body sums up three fundamental structures at national level:

• the Civil Protection Department at the Presidency of the Council of Ministers

• the General Directorate of Civil Protection and Firefighting Services at the Ministry of the Interior

• the National Seismic Service at the Department of National Technical Services (currently dependent on the Ministry of Public Works).

The Civil Protection plays a key role in the management of national emergencies but not only: the possibility of being activated by the Prefect (Prefetto) for emergencies and in particular cases also for events at local level, makes the Civil Protection an entity that can operate de facto across the board. The Prefect is the cornerstone of the command and coordination structure of the civil protection operational system.

Another key player is represented by the Mayor. He is the determining element in the operational chain of civil protection at municipal level in the assumption of all responsibilities related to civil protection tasks: from the preventive organization of control and monitoring activities to the adoption of emergency measures aimed primarily at safeguarding human life.

It is appropriate, at this point, to make one final consideration: the Emergency Plan is drawn up in any case on the basis of the scientific knowledge possessed at the time of writing, without waiting for studies in progress or future assignments or improvements. An “expeditious” plan, even if imprecise and precautionary, is better than no plan at all. As soon as possible, the Emergency Plan will be reviewed, improved, and completed with more data and more scientific bases.

The key concept of contingency planning is to try to predict all possible variables, however, it is necessary to be aware that it will always be possible, in any emergency, to face something unforeseen.

3.4 The Italian civil protection strategy for the management of the 2020 crisis

The coordination of the members of the National Service of Civil Protection is happening according to the provisions of the Augustus Method thanks to the synchronism of the representatives of each operational function (Health, Volunteering, Telecommunications, etc..) to interact directly with each other.

The intervention model adopted by civil protection for the management of the epidemiological emergency [31] based on the definition of the chain of command and control, the communication flow and the procedures to be activated in relation to the emergency state determined by the spread of the pandemic.

The chain of command and control includes the following levels of coordination:

• National level: the Head of the Civil Protection Department ensures the coordination of the necessary interventions, making use of the Department, the components, and operational structures of the National Civil Protection Service, as well as implementing entities. At the Department of Civil Protection is active the Civil Protection Operational Committee, with the task of ensuring the contribution and support of the National Civil Protection System on the basis of the health indications defined by the Ministry of Health, which makes use of the ISS (Istituto Superiore Sanità) and the Scientific Technical Committee specifically established with the OCDPC 630/2020 at the Department.

• Regional level: at all Regions must be activated a regional crisis unit, which operates in close connection with the SOR - Regional Operations Room, which must provide for the participation of the Regional Health Contact, which operates in connection with the Health Director of the local health agencies, and in constant contact with a representative of the Chief Prefecture, in order to ensure the connection with the other Prefectures - UTG of the regional territory.

• Provincial level: in the provinces in which at least one person is positive for whom the source of transmission is unknown or in any case where there is a case not attributable to a person from an area already affected by the virus, as provided by art. 1, paragraph 1 of Decree-Law no. 6 of 23.02.2020, the Prefect or his delegate provides for the activation of the CCS - Rescue Coordination Centre

• Municipal level: in the municipalities or areas in which at least one person is positive for whom the source of transmission is unknown or in any case where there is a case not attributable to a person from an area already affected by the aforementioned virus, as provided by art. 1 paragraph 1 of Decree-Law no. 6 of 23.02.2020, the Mayor or his delegate provides for the activation of the Municipal Operations Centre - COC of the municipality involved and neighboring municipalities in order to implement possible preventive actions.

Therefore, in order to cope with the pandemic and in accordance with the provisions of the Augustus Method, collaborative decision-making processes have been initiated in real time in the operational rooms of the various levels such as:

• Centro Coordinamento dei Soccorsi (CCS) - Rescue Coordination Centre

• Centro Operativo Comunale (COC) - Municipal Operations Centre

• Centro Operativo Misto (COM) - Mixed Operations Centre.

The CCS is the main body at provincial level and is chaired by the Prefect or his delegate. By COC is meant the Municipal Operations Centre, responsible for the activities at municipal-local level, whose maximum point of reference is the Mayor or his delegate (Law 225/1992 - Art. 15). Finally, the COM is the Mixed Operations Centre. They can be more than one and set up ad hoc to be as close as possible to the place of the event.

Originally established as emergency operational centres (i.e. support and operational coordination structures set up and organized exclusively in the full management phase of the emergency following catastrophic events), over time the term has moved to a broader interpretation of the term which also involves structures and organizational divisions of one or more local administrations in the construction of the local civil protection system as well as emergency planning activities to be carried out in ordinary time.

In this emergency caused by the pandemic, a key role is played by the COC, which have been activated in many Italian municipalities [32].

Specifically, the Mayor makes use of the COC to ensure the direction and coordination of rescue and assistance services to the population within his municipal territory in relation to the declaration of the state of emergency issued by the Italian Government. The choice of the location of this Centre must be in earthquake-proof structures, in areas with easy access and not vulnerable to any kind of risk. These facilities must be equipped with a square of enough size to accommodate heavy vehicles and anything else needed in a state of emergency. The COC is responsible for the decision-making levels of the entire municipal structure, summarized in the trade union responsibilities referred to in the previous paragraphs; as a rule, the decision-making level is taken by the Mayor who, through a municipal civil protection system, identifies the actions and strategies necessary to try to keep the infection curve and morbidity index under control. The COC operates in a place of coordination called “operations room” where all the news related to the event converge and where decisions are taken to overcome it. In many municipalities, the COC has been activated by the Mayor as an immediate consequence of the increase in infections within the national territory, and not necessarily in the municipal one, and it will remain operational until the resolution of the pandemic crisis [33].

According to the Civil Protection Operational Measures for the management of the epidemiological emergency [31] actions and operational measures identified for each level of coordination, without prejudice to the provisions issued by the Ministry of Health, are as follows:

• information to the population

• activation of local volunteering, in connection with the levels of coordination above

• organization of actions at the municipal level, in connection with the regional and provincial level, actions to ensure the continuity of essential services, as well as the collection of waste in areas affected, or that may be affected, by urgent measures of containment

• organization of actions at the municipal level, in connection with what has been prepared at the regional level, actions aimed at ensuring the continuity of the supply of basic necessities (including fuel supplies) in the areas concerned, or that could be affected by urgent containment measures;

• planning, or possible activation, of the actions of assistance to the population of the municipalities concerned, or that could be affected by urgent containment measures

• planning and organization of home care services for persons in home quarantine (e.g., basic necessities, medicines, pre-packaged meals…), possibly carried out by personnel of volunteer organizations, appropriately trained.

At this point, it can be stated that the success of a civil protection operation can be achieved if three parameters are satisfied: coordination, communication, and resource management.

4. Conclusion

As with any crisis management strategy, resilience strategies must be planned and prepared during the “peace” period and then implemented, appropriately adapted, during crisis situations. The variable structure, and a proactive response, is what succeeds in giving us a continuity and dealing successfully with the complexity.

Labor shortages directly affected all those sectors that had to close due to the impossibility to convert their business using smart working. Some activities, although part of sectors not directly involved in the lockdown, were indirectly affected by labor shortages caused by the inability of seasonal and commuting staff to move. Finally, the indirect repercussions that have affected those activities that, while remaining operational, have suffered significant economic repercussions due to the interruption of their supply chain caused by the shortage of labor in other sectors.

To be considered in the degree of dependence that an organization might have on its suppliers, beyond its intrinsic resilience, is the degree of flexibility applicable to relations with the various suppliers.

To plan the SCCM it will be necessary to carry out Impact Analysis activities with the individual suppliers involved, distinguishing critical suppliers from non-critical suppliers. For all relationships with critical suppliers continuity can be determined by identifying a SCCM strategy to be agreed transparently with these suppliers. Some strategic approaches may be:

• Reducing dependence on a supplier: direct engagement of alternative suppliers for a given service; increasing on-site stock holding; establishing alternative solutions.

• Increased resilience: mitigation of losses; identification of a set of alternative suppliers; establishing mutual support policies with competitors.

• Working with suppliers: creating partnerships with suppliers; setting performance standards (including through SLAs); monitoring and dealing with suppliers to increase their resilience; including SCCM requirements in supplier contracts.

The adoption of these measures will result in increasing control over the value chain in relation to an organization. In particular, the analysis carried out on the supplier chain gives visibility to the mapping of the interdependencies between the different sectors enabling an analysis that goes beyond the single organization.

Therefore, maximum flexibility and, at the same time, the ability to create the preconditions (e.g. through exercises) is needed to ensure that the best conditions for success are in place in these cases as well.

Moreover, most of all, the 2020 crisis confirmed the relevance of the human factor.

The Italian case is an example of how the set of private initiatives, the support of adequate policies of incentives and support from the State, together with a strong sense of solidarity with the population, can represent a positive reaction to a negative event, and that business strategies oriented towards business continuity are the basis for the development of resilience in the productive sector, and the resilience of the Critical Infrastructures.