Crisis management under ISO 22301
Crisis management is the organised response of people and resources once a serious disruption goes beyond normal business operations. Within ISO 22301 it falls under clause 8: operational planning and control. Practical explanation is in ISO 22313 . The difference from your business continuity plan is concrete: the BCP describes how you restore critical processes, while the crisis plan describes how you manage the situation and communicate.
A crisis team decides and communicates. A continuity team restores processes. In smaller organisations these are the same people, but in different roles.
Crisis management vs. business continuity plan
Many organisations use “crisis management” and “business continuity” interchangeably. That is understandable, but the distinction helps when you set up your BCMS structure.
| Aspect | Crisis management | Business continuity plan (BCP) |
|---|---|---|
| Focus | Managing the situation and decision-making | Restoring critical processes |
| Owner | Crisis team (board/management) | Continuity team (operational) |
| When active | When escalation takes place | As soon as processes must be restored |
| Core activity | Assessing, communicating, deciding | Carrying out recovery steps |
| Result | Controlled handling | Critical processes running again |
In practice both run in parallel. The crisis coordinator decides to switch to an alternative work location. The continuity team then carries out that decision.
The crisis team: composition and roles
A crisis team is a fixed, pre-appointed group of people who take the lead during a serious disruption. The composition depends on your organisation’s size, but the core roles are much the same everywhere.
| Role | Responsibility | Typical profile |
|---|---|---|
| Crisis coordinator | Leads the team, keeps oversight and escalation under control | COO, operations manager or risk manager |
| Process owner | Directs the recovery of their process | Department head, IT manager |
| Communications lead | Manages internal and external messaging | Communications manager or board secretary |
| IT/facilities | Technical recovery and infrastructure | IT manager, facilities manager |
| Legal/compliance | Contractual and reporting obligations | Lawyer or compliance officer |
For example, an insurer with 200 employees forms a crisis team of five people: the COO (coordinator), two process owners (claims handling and IT), a communications manager and a compliance officer. Everyone knows in advance what their role is and who replaces them if they are unavailable.
Always name a substitute for each crisis role. If the crisis coordinator is on holiday or is affected by the incident themselves, the organisation must still be able to escalate.
Crisis communication: internal and external
Crisis communication is a separate part of ISO 22301. The standard requires you to record who communicates, through which channel, to which audiences and at what moment. Poor communication during an incident often adds more damage than the disruption itself.
Internal communication
Internally, this is about informing employees, management and the supervisory board. Think of:
- a crisis message template for each incident type (fire, ransomware, supplier failure);
- a fixed escalation line with names and phone numbers;
- an alternative communication channel if normal IT infrastructure fails (for example a Signal group or an external call centre).
External communication
Externally, this covers customers, suppliers, regulators and the media. Contractual and legal reporting deadlines often apply here. In the case of a data breach, the GDPR breach notification duty applies alongside crisis management. In the Netherlands this is set out in the AVG (Dutch GDPR, General Data Protection Regulation).
| Audience | What you want to communicate | When? |
|---|---|---|
| Customers with an SLA | Status, expected recovery time, next update moment | As soon as possible, within the SLA deadline at the latest |
| Suppliers | Impact on orders/services, expected duration | As soon as the scale is clear |
| Regulator | Notification of data breaches or critical outages | Within the statutory notification period |
| Media | Only via the designated spokesperson | After internal approval |
How crisis management fits into your BCP
Your business continuity plan contains a separate chapter on the crisis organisation. This is not a standalone document, but an integrated part of the plan. The structure works as follows:
- Activation: the crisis coordinator decides whether the plan comes into effect (activation criteria).
- Situation assessment: the crisis team establishes what has happened, what the impact is and what the priorities are.
- Communication: internal and external messages go out through the designated channels.
- Recovery coordination: the crisis team directs the process teams that carry out your BCP.
- Stand-down: once critical processes are stable, the crisis team stands down and aftercare begins.
An exercise in which you walk through this process is called a tabletop exercise. You can read more about exercise formats on the page about exercising and testing.
Common mistakes in crisis management
| Mistake | Consequence | Better alternative |
|---|---|---|
| Crisis team never practised | Roles fail during a real incident | Practise at least once a year |
| No communication plan | Contradictory messages to the outside world | Prepare templates per incident type |
| No substitutes named | Crisis team cannot be fully deployed | Each role has a primary and a secondary person |
| Activation criteria too vague | Doubt about whether to escalate | Concrete threshold values per scenario |