Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Crisis Management and Continuity Governance
When an incident becomes a crisis
Most incidents are handled by the incident response team. A crisis is different: it threatens the organisation itself, its finances, reputation, people’s safety or its licence to operate. Decisions then belong to executives, who need a structure that lets them decide quickly without getting lost in technical detail.
Three levels of response
| Level | Who | Focus |
|---|---|---|
| Strategic | Crisis management team: executives | Business decisions, reputation, regulators, media, stakeholders |
| Tactical | Incident and continuity managers | Coordinating response and recovery; allocating resources |
| Operational | IR, IT recovery, facilities, business teams | Doing the work |
Separating the levels stops executives trying to fix servers and engineers talking to the press.
What the crisis team decides
- Operations: shut down services, move to manual operation, close sites.
- Money: emergency spending; ransom decisions, with legal advice.
- Stakeholders: regulators, customers, investors, staff.
- Reputation: public statements, their timing and tone.
Crisis communications must be timely, honest and consistent, through designated spokespeople. And in any disaster, the safety of people comes first, before systems or data.
Example. A water utility’s control system is attacked. The crisis team (CEO, COO, legal, communications and the CISO) decides to switch treatment plants to manual operation, notifies the regulator within the hour and issues a public statement that the water is safe, while the IR team investigates.
Continuity governance
- a continuity policy approved by senior management
- named owners for each plan
- a testing schedule, tracked and reported
- plans updated after changes, tests and incidents
- independent review by internal audit
A crisis team that meets for the first time during a crisis performs badly, so exercise it regularly.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First priority in any disaster | The safety of people |
| Who leads crisis decisions? | The executive crisis management team |
| The strategic level of response | The crisis management team |
| Who speaks publicly? | A designated spokesperson |
| How to prepare the crisis team | Regular exercises |
In short
- A crisis threatens the organisation as a whole (finances, reputation, safety, licence to operate) and needs executive leadership.
- Response is organised in three levels: strategic (crisis management team), tactical (incident and continuity coordination), operational (response and recovery teams).
- The crisis team makes business decisions: shutting down operations, paying or not, public statements, regulator engagement.
- Crisis communications protect trust: timely, honest, consistent messages through designated spokespeople.
- Continuity governance assigns ownership, approves plans, monitors testing and ensures plans stay current.
- Safety of people always comes first.
Exam traps
- Executives shouldn't run technical recovery; engineers shouldn't make public statements.
- A crisis team that first meets during a crisis performs badly; exercise it.
- Reputation decisions belong to executives, not to the security team.
- In any disaster, human safety is the first priority, before systems or data.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Three levels of response