How to Develop an Effective Crisis Plan

When a major incident occurs, the challenge lies not only in its severity. It stems primarily from the need to make quick decisions based on incomplete information, while protecting people, critical operations, and the organization’s reputation. Knowing how to develop a crisis plan therefore involves establishing this decision-making capacity before the crisis limits the organization’s room to maneuver.

A crisis plan is more than just an emergency contact list or a set of sample press releases. It formalizes governance, activation criteria, roles, coordination procedures, and communication mechanisms. It must be consistent with the organization’s business continuity framework, disaster recovery plans, risk management, and compliance requirements.

Distinguishing the Crisis Plan from the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP)

The business continuity plan defines how to maintain or restore priority operations within an acceptable timeframe. The disaster recovery plan deals more specifically with the restart of systems, infrastructure, or services following an outage. The crisis plan addresses another need: managing the event, making decisions, coordinating stakeholders, and preserving the organization’s ability to act.

In practice, these measures overlap. A cyberattack may require the activation of a disaster recovery plan, the use of business continuity solutions, and the immediate mobilization of a crisis response team. However, confusing them often creates a gap: the organization knows how to technically restore a service, but does not know who decides on a planned outage, who notifies the authorities, or how to approve sensitive external communications.

For regulated or highly digital-dependent environments, the relationship between these plans must be clearly defined. The crisis plan establishes the command structure. The Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP) provide the operational and technical options necessary for decision-making.

Define the scope and objectives of the plan

Before drafting procedures, it is necessary to specify the situations the plan is intended to address. A plan that is too generic becomes difficult to implement. Conversely, a plan built solely around a specific scenario risks being ill-suited to a different event. The right approach is to define a common framework and then provide action sheets or appendices for each type of crisis.

The scope depends on the risk analysis, the business impact analysis, and industry-specific requirements. Depending on the organization, it may cover widespread IT downtime, ransomware, a data breach, a supply chain disruption, an on-site incident, a labor dispute, the failure of a critical service provider, or an event affecting personal safety.

Objectives must be formulated in operational terms. These include, for example, protecting employees and third parties, quickly assessing the incident, ensuring decisions are made at the appropriate level, minimizing the impact on critical services, and providing reliable information to the parties involved. This clarification prevents the crisis response team from becoming merely a forum for sharing information.

Establish a governance structure capable of making decisions

The quality of a crisis plan depends first and foremost on the clarity of its governance structure. In a crisis situation, standard approval processes are often too slow. Responsibilities, delegations of authority, and escalation procedures must therefore be defined in advance.

The crisis management team typically includes a crisis management leadership team, a coordination lead, and representatives from the affected business units, IT or cybersecurity, communications, legal affairs, human resources, and, when necessary, security or compliance. Its exact composition depends on the size of the organization and the nature of the risk. A structure that is too broad slows down decision-making; a structure that is too narrow may deprive the team of critical information.

Each position must have a documented role. The crisis director acts as the decision-maker and leads the organization. The coordinator organizes meetings, follows up on decisions, and maintains an overview of the situation. Experts provide the facts, hypotheses, impacts, and options. The communications team should not be called upon only at the end; it must be involved from the outset in managing messages, channels, and target audiences.

The plan must also provide for substitutes. A critical role without an available substitute—especially outside of business hours—is a common point of vulnerability. Contact information must be protected, regularly verified, and accessible in a fallback mode if the usual tools become unavailable.

Developing Alert and Activation Criteria

The activation of a crisis response team should not depend solely on an intuitive assessment. The plan must include thresholds or criteria based on potential consequences: harm to individuals, disruption of a critical activity, compromise of sensitive data, mandatory reporting requirements, media exposure, significant financial impact, or lasting disruption of an essential service.

These criteria do not replace the judgment of those in charge. They provide a common language and reduce the risk of underestimating the situation during the initial hours. It is helpful to distinguish between several response levels, such as local incident management, enhanced coordination, and a formal crisis response. This graduated approach prevents the unnecessary mobilization of the entire organization, while ensuring that escalation occurs promptly when necessary.

The activation procedure must specify who can trigger the alert, how to contact the response team members, where the team meets, and which fallback solutions to use. A virtual crisis room may be appropriate, but it should not be the sole point of reliance. In the event of a cyber incident, standard communication channels may no longer be trustworthy.

Formalize the procedures that support the decision

An operational plan does not seek to anticipate every detail. It provides the essential guidelines so that teams can act in a coordinated manner. At the onset of a crisis, the response team must be able to establish an initial assessment: the nature of the event, the time it was detected, the affected area, observed impacts, measures already taken, major uncertainties, and upcoming decisions.

A crisis log is essential. It records information received, hypotheses, decisions, the rationale behind them, the actions taken, and their status. This practice improves coordination during the incident and subsequently facilitates lessons learned, audits, and communication with authorities.

The procedures must also include the following functions:

• assessing and updating the situation;
• the protection of people, assets, and evidence;
• assessing the business, legal, financial, and reputational impacts;
• managing decisions and priority actions;
• internal, external, and institutional communication;
• monitoring the return to a stable situation.

For each procedure, prioritize short, actionable checklists that can be used under pressure. A quick-reference checklist can specify the trigger, the person in charge, the initial actions, the information to gather, the people to contact, and the decisions to be submitted. The level of detail depends on the maturity of the teams: a new program will need more step-by-step instructions, while an experienced organization will prefer more flexible decision-making frameworks.

Prepare a well-thought-out message, without rushing

Crisis communication must balance speed, accuracy, and consistency. Prolonged silence creates a vacuum that rumors can fill. However, communicating too hastily can spread inaccurate information, undermine an investigation, or create commitments that are impossible to fulfill.

The plan must identify priority audiences: employees, customers, suppliers, partners, shareholders, government authorities, the media, or individuals affected by a data breach. It must specify authorized spokespersons, approval processes, and alternative communication channels. Preformatted messages are useful for announcing that an incident has been acknowledged, outlining immediate actions, and providing a timeline for further updates. They must never be used to downplay a situation where the facts remain unclear.

In the event of a cyber incident, coordination among communications, the legal department, the information security department, incident response teams, and business unit leaders is particularly critical. The information disclosed must be consistent with technical findings, regulatory requirements, and the organization’s interests, without compromising remediation efforts.

Test the plan before you need it

An untested plan is a working hypothesis, not a proven capability. Exercises make it possible to verify participants’ availability, their understanding of their roles, the smooth operation of procedures, and the effectiveness of communication channels. They also reveal discrepancies between the organization described in documents and the actual organization.

Table-top exercises are a good starting point. They present participants with a timeline of events and guide them in making decisions, communicating, and coordinating actions. More advanced simulations can incorporate technical disruptions, media constraints, the unavailability of a service provider, or requests from authorities. The goal is not to trip up the teams, but to develop collective reflexes and assess their governance capabilities.

Each exercise must result in a formalized debriefing. Any discrepancies identified must be prioritized, assigned to a responsible party, and tracked until they are resolved. This continuous improvement cycle aligns with the logic of business continuity management systems based on ISO 22301: document, test, measure, correct, and maintain.

Ensuring the plan’s long-term viability

The crisis plan must evolve along with the organization. An acquisition, outsourcing, a change in cloud service provider, a new regulatory requirement, or a change in on-call schedules can render it partially obsolete. A periodic review—at least once a year and after any significant incident—ensures that it remains relevant.

Training plays a central role here. Managers called upon to join a crisis response team must understand the mechanisms of coordination, decision-making, and communication, beyond their functional expertise alone. For business continuity and resilience professionals, a structured approach makes it possible to link the crisis plan to impact analyses, continuity strategies, and governance requirements.

Developing a crisis plan is not about producing yet another document. It is about enabling the organization to make decisions in a systematic manner when its usual points of reference disappear. This capability is built over time by clarifying responsibilities, conducting drills, and rigorously incorporating lessons learned from each experience.

This post is also available in: