The Ultimate Guide to Crisis Management

What is Crisis Management?

Crisis management is how your organization prepares for, responds to, and recovers from events that threaten its people, operations, reputation, or survival.

The threats come from every direction: a ransomware attack, a data breach, a product recall, a natural disaster, workplace violence, executive misconduct, a viral reputational attack, the loss of a critical supplier. Crises almost always cause damage. What you control is how much.

A crisis management program gives you four things:

• Preparation. A framework, a plan, and a trained team, in place before you need them.
• Response. A way to escalate, convene the right people, make decisions, and communicate with everyone who needs to hear from you.
• Recovery. A path back to normal operations, short and long term.
• Learning. A process to capture what happened and make the next response better.

The goal is a system that coordinates the response, the resources, and the communication before, during, and after the critical moment. How well you do that shapes your reputation and your recovery.

Go deeper: What Is Crisis Management?

Why Crisis Management Matters

The case for crisis management is simple to make and easy to forget until the day you need it:

• It protects your people. Life safety comes first, and a prepared team takes care of employees faster.
• It protects your reputation. Reputations take decades to build and minutes to lose. How you respond in the first hours is what people remember.
• It protects the business. A coordinated response limits operational, financial, and legal damage.
• It meets expectations. Regulators, auditors, insurers, customers, and boards increasingly ask how you’ll respond, and when you last practiced.

For more on making the case to your executives, see the value section of our Business Continuity guide and Executive Buy-In for Business Continuity.

Your Crisis Management Framework and Plan

Start with a framework, then build the plan on top of it.

The framework

Your crisis management framework is your philosophy for how the organization will make, communicate, and carry out decisions in any crisis. Settle it now. A crisis is no time to invent your governance. A good framework answers:

• When is it a crisis, and who declares it? Most crises start as problems in one function. Define when they escalate.
• What are your levels of response? Not every incident needs the same response. Severity levels set the triggers (see the next section).
• What’s your battle rhythm? The schedule of updates, status meetings, and reports that keeps the response moving even when the situation changes by the hour.
• Who is on the crisis team? A cross-functional team with defined roles and an escalation path to executives.
• Who leads? The crisis leader runs the response process. That person should not be an executive; executives make the strategic calls and lead the organization.

The Bryghtpath Crisis Management Framework is a free four-page starting point, with a program “placemat,” an organizational view, and severity levels.

The plan

The plan brings the framework to life. Keep it short enough to use under stress:

• Focus it. No one reads a 200-page binder in a crisis. Cover the most likely situations precisely and concisely.
• Ground it in your risks. Your risk assessment and Business Impact Analysis (BIA) tell you what matters most.
• Define the scope and your assumptions about the resources you’ll have.
• Explain activation: how to activate the plan, assemble the team, and where to meet, including an alternate location.
• Specify severity levels and escalation, with a diagram of the escalation path.
• Define roles and the chain of command, with names and contact information.
• Build in communications: audiences, channels, approval, and prepared messages.
• Use checklists, with brief, clear steps, and link the plan’s contents so people can jump to what they need.

Go deeper: How to Craft Your Crisis Management Framework, Managing Uncertainty Episode #59: All Roads Lead to One, and our Crisis Management Plan Templates, the same templates we use with clients.

How a Crisis Unfolds

Crises follow predictable patterns. Knowing them helps your team stay ahead instead of reacting:

1. The news hits. Through social media, a reporter’s call, or an internal channel.
2. The scramble. People freeze, rush, or both. A plan, and practice, ground them.
3. Details emerge. Communicate early. Most trouble comes from being late or getting the tone wrong.
4. The peak. Media calls, trending posts, activists, regulators.
5. About 48 hours later, you’re often yesterday’s news, if you’ve handled it well.
6. Re-ignition. A poorly handled crisis comes back as a secondary crisis. Beware the false calm; it may just be the eye of the storm.

Go deeper: Predictable Patterns During a Crisis.

The Crisis Leader

The crisis leader, also called the incident leader or incident commander, coordinates the response and leads the crisis team to decisions. It’s a demanding role. The skills that matter most:

• Cross-functional leadership. Communicating up to executives, down through the organization, and across functions at the same time. Harvard’s National Preparedness Leadership Initiative calls this meta-leadership.
• Perspective. Thinking strategically and tactically at once.
• Situational awareness. Seeing what’s changing and pivoting quickly.
• Self-awareness. The leader sets the tone. Calm is contagious, and so is panic.

You don’t need a dedicated crisis professional for the role. Strong business leaders with these skills often make excellent crisis leaders. Build them with exercises, debriefs of past events (yours and others’), and leadership-focused training such as Harvard’s NPLI program. Two books we recommend: Emotional Intelligence 2.0 by Travis Bradberry and Jean Greaves, and You’re It: Crisis, Change, and How to Lead When It Matters Most by Leonard Marcus and colleagues.

Go deeper: Suiting Up for a Crisis, Part I: The Crisis Leader.

HR and Communications: Two Critical Parts of Your Team

Two functions are often poorly integrated into crisis programs, and they’re two of the most important.

Human resources

People need to know they and their families are safe before they can focus on the response. HR makes that possible.

• Before: plans to reach employees when normal channels fail, access to employee records, contingency plans for payroll and benefits, and an understanding of legal and bargaining obligations.
• During: employee wellbeing, accountability roll calls for employees, contractors, and visitors, emergency notifications, employee relations, morale, and briefings for families of anyone injured.
• After: assistance for affected staff and families, and access to counseling and mental health support.

Go deeper: The Role of HR in Crisis Management.

Communications

Every crisis has a communications element: employees, leadership, customers, regulators, media, and social media, each with its own needs and channels. Sometimes the crisis is a reputational one from the start. A strong crisis communications capability has:

• Activation thresholds tied to your severity levels
• Current, clear policies, including media and social media
• Processes with expedited approvals and a way to keep executives and the board informed
• Defined roles, from approvers to spokespeople to whoever keeps the communication log
• Prepared content: key messages, templates, contact lists, and channels, approved in advance
• Vendors in place for surge needs such as contact centers, media monitoring, and web capacity
• Practice, with communications built into every exercise

Review your crisis communications strategy with your board. That relationship matters most in a reputational crisis.

Go deeper: The Importance of Having a Crisis Communications Strategy and Engaging Your Board of Directors on Your Crisis Communications Strategy.

Scenario Annexes

With a framework and plan in place, you can manage any crisis, whatever caused it. Scenario annexes add specific checklists, actions, and resources for the situations you’re most likely to face. They aren’t a different process; they plug into the one you have.

Don’t build dozens of them. Focus on your top scenarios. Common choices:

• Fire
• Natural disasters, such as floods, tornadoes, earthquakes, and hurricanes
• Active assailant
• Civil unrest
• Protests and reputational attacks
• Cyberattack and data breach
• Loss of a critical vendor
• Loss of critical technology
• Power failure

Annex templates are part of our Crisis Management Plan Templates, and our Scenario Library lists the scenarios we exercise most.

Major events

Large public events need their own planning. We were part of the planning for Super Bowl 52 in Minneapolis in 2018 and talked through it on the podcast before and after. See Conference and Public Event Crisis Management and Managing Uncertainty episodes #3: Major Events, #27: Super Bowl 52, and #32: Super Bowl 52 Recap.

Go deeper: Managing Uncertainty Episode #63: Prioritizing Top Risks.

Crisis Management Exercises

A plan nobody has practiced won’t be used. Exercises build muscle memory, expose gaps, and turn a document into a capability.

Build an exercise program, not a single exercise

• Microsimulations: under an hour, focused on a few decisions. Easy to schedule and a good way to keep the team sharp.
• Tabletop exercises: facilitated discussions of a realistic scenario. The right starting point for a new program or a new team.
• Simulations: the response played out through real channels with a live control cell, over hours or days.
• Executive exercises: the decisions only leaders can make.

A sound cadence: microsimulations and tabletops through the year, with a major simulation every one to two years. Plan 4 to 6 weeks to design a tabletop and 8 to 12 weeks for a full simulation.

Make exercises worth the time

• Tie them to what matters: your mission-critical processes and real risks.
• Set two to four clear objectives, agreed with your sponsor.
• Write realistic scenarios with the people who know the details, such as your IT and security teams for a cyber scenario.
• Exercise the seams: handoffs between teams, to executives, and to critical vendors.
• Include alternates and the functional experts the scenario needs.
• Mix scheduled and unannounced drills.
• Hot wash immediately, then deliver the After-Action Report (AAR).
• Don’t always facilitate. You need the practice too.

Go deeper: crisis exercises and simulations, How to Build a Crisis and Business Continuity Exercise Strategy, Using Crisis Microsimulations, How to Choose a Tabletop Exercise Facilitator, and Managing Uncertainty Episode #19: Exercises Are Boring.

Don't Forget the Human Element

Crises test people as hard as they test organizations: long hours, hard decisions, and sometimes injury or loss of life that affects survivors and families for years.

In Managing Uncertainty Episode #5, three crisis leaders who were inside a 2012 active shooter incident described the four hours as it unfolded. It’s a reminder of what these events ask of the people who lead through them.

Look after each other. Help each other stay “out of the basement”, where stress pulls leaders into fight-or-flight thinking (we talked about it in Episode #20). Use your Employee Assistance Program and professional counseling after a major event, for your employees, your team, and yourself. The crisis doesn’t end when the response does. Your HR team should own this as part of the crisis team.

Go deeper: Managing Uncertainty Episode #114: Mental Health in Our Profession.

Crisis Management Awareness and Culture

Most people only hear about crisis management when something has already gone wrong. Successful programs change that.

When I was first asked to take over my employer’s business continuity program, which included crisis management, I told my future boss I’d be a bad fit because I knew very little about it. He laughed. “I don’t need a subject matter expert, Bryan. I need someone who can communicate and can market and promote the program across the company.”

He was right. Tell the program’s story constantly: why it exists, how it supports the strategy, what it has achieved. Put that story into a walkaround deck and get it in front of every leader and team meeting that will have you. Make your internal communications team your best friend. And never be afraid to make yourself important.

Go deeper: the awareness and culture section of our Business Continuity guide, Effective Business Continuity Awareness Campaigns, and Building a Resilience Culture in Your Organization.

Crisis Management Case Studies

All of our client case studies are anonymized.

• Executive cyber-extortion exercise for a major health insurer. We extended an earlier crisis-team exercise to the executive leadership team, with a ransomware attack on core claims processing and decisions on payment, member and regulator notification, board engagement, and public messaging. Read the case study.
• Enterprise cyber simulation for a financial services firm. A two-day enterprise simulation with more than 70 participants, testing escalation from technical response to executive decision. Read the case study.
• Testing the full escalation chain for a global medical products manufacturer. A branching ransomware and data-extortion simulation, from technical detection through the cyber, corporate, and site teams to the executive leadership team. Read the case study.
• AI-accelerated threats for a healthcare technology company. A first-of-its-kind tabletop built around an AI-driven vulnerability storm. Read the case study.
• Crisis management as a service for a global quick service restaurant chain. With limited internal staffing, the chain relies on Bryghtpath for quarterly crisis team meetings and training, four exercises a year, plan maintenance, and strategic advice during disruptions. Read the case study.
• Crisis preparedness for a large U.S. nonprofit. One of the largest nonprofits in the United States built its first crisis management and business continuity program with Bryghtpath. Read the case study.
• A crisis management framework for a global quick service restaurant brand. An enterprise framework and plan, role-specific checklists, five scenario annexes, a trained crisis team, and a tabletop exercise. Read the case study.
• C-level active shooter exercise for a major utility. A half-day exercise at headquarters with the enterprise crisis team, the communications team, and the entire executive leadership team. Read the case study.
• Super Bowl 52. We were part of the planning for Super Bowl 52 in Minneapolis in 2018, and documented the planning and the recap on the podcast.

See all case studies.

Lessons from public crises

• Hurricane Sandy. Lessons in crisis management from the 2012 storm.
• Deepwater Horizon. Eleven workers died when the rig exploded on April 20, 2010, and BP’s communication after the disaster compounded the damage to its brand.

Where to Learn More

Free training

• FEMA’s Emergency Management Institute: free courses on crisis management, continuity, and emergency management.
• Bryghtpath’s free intro courses: 101-level courses in crisis management, crisis communications, and business continuity.
• Webinars and videos and our YouTube channel.

Business Continuity, Crisis Management, and Resiliency Facebook group

Connect with hundreds of resilience professionals in our free Facebook group: daily articles, discussion, and a welcoming place to ask questions about your program or career.

Books

Our Professional Reading List has our best recommendations.

Podcasts

Managing Uncertainty is our weekly podcast on crisis management, business continuity, and crisis communications, with more than 330 episodes. For more, see Top Business Continuity and Crisis Management Podcasts.

Executive education

• Harvard’s National Preparedness Leadership Initiative
• MIT’s Crisis Management and Business Resiliency course

See Top Business Continuity and Crisis Management Executive Programs.

Free resources

Start with The Polycrisis Playbook and the Weekly Briefing, our weekly email for resilience leaders. More on our Free Resources page.

About the Author

This guide was written by Bryan Strawser, founder and CEO of Bryghtpath.

Bryan has more than 30 years of experience in crisis management, business continuity, and intelligence. Before founding Bryghtpath in 2014, he led crisis management, business continuity, and intelligence at Target. He is a Master Business Continuity Professional (MBCP), a Member of the Business Continuity Institute (MBCI), and a Certified Information Systems Security Professional (CISSP).