A crisis management team (CMT) is the small group of senior people, named and trained in advance, who take charge of an organisation when an event outgrows normal incident management. It assesses the situation, sets priorities, makes decisions under uncertainty, coordinates the response teams and speaks for the organisation until operations return to normal.
Almost every organisation has one on paper. On the day, it fails on details: a crisis director who cannot be reached and has no deputy, a call-out sent over an email system the attacker is reading, a crisis log nobody keeps. This guide covers how to staff, activate and run a crisis management team that holds up, drawing on ISO 22361, guidance from France's national cybersecurity agency (ANSSI), NIS2 and DORA.
The 30-second version
- The team is activated when normal incident management is no longer enough, against written criteria, by named people.
- Two tiers: a strategic team that decides and an operational layer that executes.
- Every critical role has a primary and a deputy; membership changes with the type of crisis (cyber: CISO, DPO and legal are non-negotiable).
- The crisis log timestamps every piece of information, decision and action: it is your steering tool, your handover tool and your evidence.
- Prepare fallback channels outside corporate IT and exercise the team at least once a year.
What is a crisis management team?
A crisis is not a big incident. It is an unstable, potentially severe situation that normal procedures cannot handle: information is incomplete, time is short and decisions commit senior management. The crisis management team does not fix servers. It decides what matters (protecting people, choosing which activities to keep running, accepting some losses to avoid worse ones) and speaks to stakeholders.
Three references frame the subject:
- ISO 22361:2022, published in October 2022, provides guidelines for strategic crisis management: leadership, team decision-making, communication, training and learning. You can align with it or draw on it; it is not a certifiable standard.
- ISO 22301:2019 requires a response structure (clause 8.4.2): identified teams with their roles, competencies and designated alternates.
- NIS2 lists "crisis management" among the measures of Article 21, and DORA requires financial entities, other than microenterprises, to have a crisis management function (Article 11(7)).
The crisis management team is the decision-making core of your business continuity plan.
Incident or crisis: when should you activate the crisis management team?
Activating too late is the most common mistake; activating for nothing wears down the team's credibility. The fix: written thresholds and an intermediate level.
| Level | Trigger | Who decides | Who is mobilised |
|---|---|---|---|
| Incident | Event covered by a known procedure | Incident manager | Operational teams, on-call staff |
| Alert | An activation criterion is met or likely | On-call manager or any authorised member | Core group: crisis director, coordinator, relevant expert, communications |
| Crisis | Criterion confirmed, situation not under control | Crisis director | Full strategic team and operational teams |
Any single criterion is enough to move to alert: a threat to people's safety; an outage of a critical activity approaching the maximum tolerable period of disruption set by the BIA; several sites or critical activities hit at once; a likely notification to an authority; a data leak; media exposure; an extent nobody can yet describe.
These thresholds are about business impact, not technical cause. On 19 July 2024, a faulty CrowdStrike update took down around 8.5 million Windows devices, according to Microsoft. For many organisations, a routine IT incident became a crisis within hours.
Who can activate it? The crisis director or one of the named deputies on a written list; the on-call manager can trigger the alert level without waiting for anyone. ANSSI recommends providing both routes: bottom-up, when a threshold is crossed, and top-down, by decision of the strategic level. Record the time the organisation became aware of the event: notification deadlines run from it.
Crisis team structure: who sits on a crisis management team?
Two tiers: strategic and operational
The strategic team sets objectives, arbitrates, approves external communication and deals with authorities. In practice, six to ten people: beyond that, the room debates instead of deciding. The operational layer executes: an IT and cyber cell (investigation, containment, recovery), business-unit teams running continuity procedures and workarounds, and logistics or HR cells as needed. ANSSI's guide to cyber crisis management, published in December 2021 (French page; an English version exists), describes exactly this structure.
One liaison per operational team reports into each situation update; decisions flow back down through the crisis log, each with a named owner and a deadline. The strategic team does not run the restore server by server, and no operational team communicates externally without approval. When two business units compete for the same resources, the strategic team decides, based on the priorities set by the BIA.
Crisis management team roles
| Role | Job during the crisis |
|---|---|
| Crisis director | Sets objectives, makes the final call, commits the organisation (CEO or a mandated executive) |
| Crisis coordinator | Runs situation updates, tracks actions (often the business continuity manager) |
| Log keeper | Keeps the crisis log |
| Communications and spokesperson | Internal and external messages; the spokesperson is the only public voice |
| Legal | Legal and contractual obligations, police complaints, evidence preservation |
| HR | Staff safety and information, working arrangements, shift rotation |
| CIO / IT | State of IT, realistic recovery options and timings |
| CISO | Attack qualification, containment, liaison with the CSIRT and incident response experts |
| DPO | Personal data breaches, notification to the data protection authority |
| Finance | Cash, critical payments, insurance claims |
| Business representatives | Real impact on operations, activation of workarounds |
| DORA / ICT risk lead (financial entities) | Classification of major ICT-related incidents, notifications to the supervisor |
Three jobs are never combined: the person who decides, the person who chairs and the person who writes.
A primary and a deputy for every critical role
Crises happen at night, at weekends, while the CEO is on a plane. Every critical role therefore has a named deputy, trained, invited to exercises and given the same access as the primary. The deputy does not share the primary's site or travel, and never covers two critical roles at once. The crisis directory, with personal phone numbers, is kept offline.
Membership changes with the type of crisis
| Type of crisis | Roles to mobilise first | External support to line up |
|---|---|---|
| Cyberattack | CISO, CIO, DPO, legal, communications; DORA lead for a financial entity | Incident response provider, cyber insurer, CSIRT, external counsel |
| Physical incident (fire, flood) | Security and facilities, HR, site managers | Emergency services, insurer, local authorities |
| Critical supplier failure | Procurement, legal, business units, IT for an ICT provider | Alternative supplier, legal advice |
| Reputational crisis | Communications, legal, CEO | Crisis communications adviser |
The first 60 minutes after activation
The first hour does not solve the crisis. Its purpose is to regain the initiative.
| Time | Goal | What has to happen |
|---|---|---|
| T+0 to T+10 | Alert | Qualify the event, call the team out on the primary channel and a fallback channel, open the crisis log (time of detection, time of awareness) |
| T+10 to T+20 | Roll-call | Who has confirmed, who is unreachable? Call the deputies; start without waiting for a full quorum |
| T+20 to T+35 | First situation update | What we know (with sources), what we don't, the worst plausible case, the impacts, the actions already under way |
| T+35 to T+50 | First decisions | Protect people, approve containment measures that affect operations, activate plans, start the notifications, appoint the spokesperson |
| T+50 to T+60 | First message | Tell staff what is happening, what to do and when the next update will come; prepare a holding statement; set the battle rhythm |
"We don't know yet" is an acceptable answer. Silence is not.
Running the crisis: battle rhythm, crisis log and handovers
Battle rhythm
The battle rhythm is the cadence of situation updates: short (20 to 30 minutes), at fixed times, with the same agenda every time (situation, impacts, actions, decisions needed, communication, next update). As a rough guide, every one to two hours at first, then two or three times a day once things stabilise. Between updates, let the teams work. For who recommends and who decides, see our article on the RAPID framework for crisis management plans.
The crisis log: what to record, and why it protects you
The crisis log (also called the decision log) is the chronological record of the crisis. Each entry carries a timestamp, its source and its type: information received, decision, action, communication or notification. A decision is logged with the options considered, the rationale and who made it; an action with an owner and a deadline; a notification with the time sent and the filing reference. A dedicated log keeper maintains it, nothing is ever deleted (a correction is a new entry), and an offline copy is kept.
The log is how you steer, hand over between shifts, feed the post-crisis review and prove what you did. DORA requires financial entities to keep readily accessible records of activities before and during disruption events when their ICT continuity and response plans are activated (Article 11(8)). In front of an insurer, a regulator or a court, it shows that each decision was reasonable given what was known at the time. A decision that was never logged is hard to defend.
Fatigue and rotation in long crises
A cyber crisis can last several weeks, ANSSI warns, and nobody decides well after twenty hours awake. Plan the rotation from the first hours: shifts with staggered changeovers, a formal handover based on the crisis log, a crisis director who hands the chair to the deputy, and one person dedicated to tracking hours and logistics (meals, accommodation, transport, building access).
The crisis room: physical, virtual and fallback channels
A physical crisis room must work when everything else is down: a backup room on another site, backed-up power, a network connection independent of the corporate network, printed plans and directory, and wall boards for the timeline and decisions. A virtual crisis room (a standing video bridge) brings dispersed members together, but often depends on the corporate identity directory and email.
If a compromise is possible, do not discuss the response over corporate email: the attacker may be reading it. Prepare, before any crisis, the members' personal phone numbers, a messaging and video space outside the corporate environment with accounts already set up, and a directory stored offline, as ANSSI recommends. Test these channels during exercises.
Communication and notification obligations
Three principles: staff hear the news before the press, one voice speaks, and every message gives the time of the next one. DORA requires at least one person to be in charge of the communication strategy for ICT-related incidents and of the public and media function (Article 14(3)).
| Regime | Recipient | Deadlines | Owner in the team |
|---|---|---|---|
| NIS2 (significant incident) | CSIRT or competent authority | Early warning within 24 h, incident notification within 72 h, final report no later than one month after the notification | CISO, legal |
| DORA (major ICT-related incident) | Competent authority | Initial notification within 4 h of classifying the incident as major (and no later than 24 h after becoming aware); intermediate report within 72 h of the initial notification; final report no later than one month after the latest intermediate report | DORA / ICT risk lead |
| GDPR (personal data breach) | Data protection authority | Where feasible, no later than 72 h after becoming aware | DPO |
| Contracts and insurance | Customers, partners, insurer | As set in the contracts: check before the crisis | Legal, finance |
The DORA deadlines come from Commission Delegated Regulation (EU) 2025/301; for NIS2, see NIS2 incident notification: 24 h, 72 h and one month. Ready-to-use templates: our crisis communication plan template and incident report generator.
Exiting the crisis, learning and training
Exit criteria
Exit criteria are set at activation and reassessed as the crisis evolves: people are safe, critical activities are back above their minimum agreed level, the threat is contained and monitored, mandatory notifications are done, and no decision remains that needs senior management. The rest (rebuilding, catching up, disputes) moves into project mode. Stand down in stages (crisis, alert, business as usual), tell everyone, settle overtime and rest days, and thank the teams.
Post-crisis review
ANSSI describes two stages: a "hot" debrief through interviews in the days that follow, then a "cold" review with a synthesis and an action plan. It is not an audit and nobody is looking for someone to blame. Each finding becomes a dated corrective action, then an update to the plan, the directory and the activation criteria.
Training the team
An alert and roll-call test twice a year, a tabletop exercise at least once a year for the strategic team, every deputy playing the primary role once a year, and realistic constraints: email down, director unreachable, a journalist on the phone in the first hour. DORA already requires ICT continuity plans to be tested at least yearly, and crisis communication plans to be tested too. Scenario ideas: 10 crisis exercise scenarios.
Tooling for the crisis management team
A tool does not replace training, and it must stay useful when corporate IT goes down: keep offline exports of the crisis organisation and the directory.
What ResiPlan does, concretely
- Crisis team inside the crisis management plan: a library of 16 executive crisis roles, with a primary holder and a deputy for each.
- Automatic gap check: critical roles without a deputy and, for a cyber crisis plan, missing CISO, DPO or DORA officer roles.
- Crisis command cockpit: a 6-phase stepper, a roll-call (not contacted, contacted, confirmed, unreachable) and actions per phase that can be acknowledged, started, completed or reassigned.
- Notifications by email and Slack, Teams or Discord, and a clearly flagged exercise mode.
- Decision log and optional capture of crisis team sessions: the transcript pre-fills draft decisions that a person must validate (consent required, speakers anonymised).
- One incident register: a crisis is an escalated incident. Tabletop exercises and crisis gaming.
- A crisis management module aligned with the ISO 22361:2022 guidelines.
An honest caveat: software does not make anyone compliant and certifies no one. ResiPlan structures, links and keeps a record of the work your teams do. Free 7-day trial, no credit card.
Checklist: is your crisis management team ready?
- Activation criteria are written down, and the people allowed to activate the team are named.
- The strategic and operational tiers are defined, with one liaison per operational team.
- Every critical role has a trained primary and deputy.
- A log keeper and a crisis log template are ready.
- The crisis directory is kept offline and tested twice a year.
- A crisis room and a backup room are equipped.
- Fallback channels outside corporate IT are set up and tested.
- NIS2, DORA and GDPR notification templates are drafted.
- A rotation plan exists for crises lasting more than 24 hours.
- A tabletop exercise took place in the last 12 months and its corrective actions are tracked.
FAQ
Who should be on a crisis management team?
At a minimum: a crisis director, a coordinator, a log keeper, communications, legal, HR, IT and the affected business units. Depending on the crisis, add the CISO and DPO (cyber), security and facilities (physical incidents) or the DORA lead (financial entities). Every critical role has a deputy.
Who decides to activate the crisis management team?
The crisis director or one of the named deputies declares the crisis. The on-call manager can trigger the alert level as soon as a criterion is met, so the core group meets without delay.
What is a crisis log?
It is the chronological, timestamped record of everything the team receives, decides, does and communicates. It is used to steer the response, hand over between shifts, prepare the post-crisis review and justify decisions to a regulator, an insurer or a court.
How many people should be on a crisis management team?
In practice, six to ten people in the strategic team. Beyond that, discussions drag and decisions slow down. Other experts join on demand or work in the operational teams.
Is a crisis management team mandatory?
NIS2 includes crisis management among the Article 21 measures for essential and important entities, and DORA requires financial entities, other than microenterprises, to have a crisis management function. ISO 22301 requires a response structure with identified teams and alternates. Outside regulated sectors, customers and insurers increasingly expect one.
Can you be certified against ISO 22361?
No. ISO 22361:2022 contains guidelines, not certifiable requirements. You can align your crisis management with it; certification of a business continuity management system is done against ISO 22301.
Further reading
- Crisis management plan and the RAPID framework
- 10 crisis exercise scenarios
- NIS2 incident notification: 24 h, 72 h, one month
- Incident response plan template
- Crisis management with ResiPlan
A crisis management team is not judged by its organisation chart, but by the quality of its decisions at 3 a.m. with half the information: that is what you need to prepare for.