# Crisis Management and Communications Plan: [Organization name] > Plan for leading the organization through a crisis: a situation that > threatens its people, customers, reputation, finances or ability to > operate, and that ordinary incident and continuity processes cannot > resolve on their own. It defines the crisis management team, > activation criteria, decision-making, stakeholder communications > (staff, customers, regulators, media, suppliers, investors), holding > statements, a cyber crisis scenario and the interfaces with incident > response and business continuity. It draws on the guidance of ISO > 22361:2022 (crisis management, cited) and supports ISO/IEC 27001:2022 > + Amd 1:2024 controls A.5.24 to A.5.29 and A.5.5 (contact with > authorities). Replace every `[bracketed]` value and every row marked > *Example*. This is a documentation format, not legal advice. ## Document control | Field | Value | |---|---| | Document ID | [DOC-ISMS-078] | | Version | [1.0] | | Status | [Draft / In review / Approved / Superseded] | | Owner | [@coo] (crisis management lead) | | Approvers/reviewers | [@ceo], [@ciso], [@general-counsel], [@head-of-communications], [@business-continuity-lead] | | Last updated | YYYY-MM-DD | | Classification | [Confidential; contact annex Restricted] | | Standard and edition | ISO 22361:2022 (cited); ISO/IEC 27001:2022 + Amd 1:2024 (A.5.5, A.5.24 to A.5.29); ISO 22301:2019 + Amd 1:2024 | | Next scheduled review | YYYY-MM-DD (at least annually and after every activation or major exercise) | | Last exercised | [Exercise ID, YYYY-MM-DD] | | Contact annex reference | [CMT-CONTACTS, last verified YYYY-MM-DD] | | Incident response plan reference | [DOC-ISMS-020] | | Business continuity plan reference | [DOC-ISMS-121] | | Offline copy location | [Printed copies with each team member, encrypted copy outside the corporate environment] | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | Crisis management lead | [@coo] | [Prepared] | YYYY-MM-DD | | General counsel | [@general-counsel] | [Reviewed] | YYYY-MM-DD | | CISO | [@ciso] | [Reviewed] | YYYY-MM-DD | | Chief executive | [@ceo] | [Approved] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 1.0 *(Example)* | YYYY-MM-DD | [@coo] | First approved plan | | 1.1 *(Example)* | YYYY-MM-DD | [@coo] | Holding statements updated after the ransomware tabletop (EX-2027-02) | ## Contents 1. Purpose, scope and definitions 2. Interfaces with incident response and business continuity 3. Crisis management team 4. Activation and escalation 5. Decision-making and battle rhythm 6. Communication principles and approval 7. Stakeholder map and communication matrix 8. Regulators, authorities and notification duties 9. Holding statements and message templates 10. Cyber crisis scenario: ransomware with data theft 11. Stand-down, recovery and review 12. Training and exercises 13. Size tiers 14. Records and evidence 15. References ## 1. Purpose, scope and definitions This plan sets out how [Organization name] recognizes a crisis, brings together the people who can lead it, takes and records strategic decisions, and communicates with everyone affected, so that harm to people, customers, operations, reputation and legal standing is kept as low as possible and trust is rebuilt afterwards. | Term | Meaning in this plan | |---|---| | Event | Something that happens and may need attention. Most events are handled by normal operations. | | Incident | An event that disrupts or threatens normal operations or information security, handled under the incident response plan (DOC-ISMS-020) or the operational incident process. | | Disruption | An incident that stops or degrades prioritized activities, handled under the business continuity plan (DOC-ISMS-121) and the ICT readiness plan (DOC-ISMS-047). | | Crisis | A situation with high uncertainty and potentially severe impact on the organization as a whole, needing strategic decisions and coordinated communication beyond what the plans above can deliver. | Scope: [all legal entities, sites, products and services of the organization]. The plan covers crises of any cause, including cyber attacks, major data breaches, prolonged service outages, supplier failure, product safety issues, serious misconduct allegations, natural hazards and events that affect staff safety. Life-safety emergencies are first handled by the site emergency procedures; the crisis team takes over the strategic response once people are safe. ## 2. Interfaces with incident response and business continuity ```mermaid flowchart TD EV["Event detected"] --> IR["Incident response team (DOC-ISMS-020)"] EV --> OPS["Operational incident process"] IR --> SEV{"Crisis criteria met? (section 4)"} OPS --> SEV SEV -- "No" --> IR SEV -- "Yes" --> CMT["Crisis management team (this plan)"] CMT --> BCP["Business continuity plan (DOC-ISMS-121)"] CMT --> ICT["ICT readiness plan (DOC-ISMS-047)"] CMT --> COM["Communications cell (sections 6 to 9)"] IR -- "situation reports" --> CMT BCP -- "status of prioritized activities" --> CMT ``` | Level | Team | Decides | Reports to | |---|---|---|---| | Strategic | Crisis management team | Priorities, risk trade-offs, external communication, spending beyond limits, legal positions, ransom stance | Board | | Tactical | Incident commander, business continuity lead, ICT recovery manager | How to carry out the strategic priorities, resource allocation within limits | Crisis management team | | Operational | Response, recovery and support teams | Technical and process actions | Tactical leads | Rules: the incident commander keeps authority over technical response; the crisis team does not give instructions to responders directly. All external messages about the event, including those to customers from account managers, go through the communications cell once the crisis team is active. ## 3. Crisis management team | Role | Responsibilities | Primary | Deputy | |---|---|---|---| | Crisis lead (chair) | Convenes the team, sets priorities, takes final decisions, keeps the board informed | [@coo] | [@cfo] | | Chief executive | Public face of the organization, decisions with board-level impact | [@ceo] | [@coo] | | Legal lead | Legal duties, notifications, privilege, contracts, law enforcement contact | [@general-counsel] | [@legal-counsel] | | Security lead | Situation picture for cyber events, link to the incident commander | [@ciso] | [@security-lead] | | Operations and continuity lead | Status of prioritized activities, link to BCP and ICT readiness | [@business-continuity-lead] | [@head-of-it-operations] | | Communications lead | Runs the communications cell, drafts and releases messages | [@head-of-communications] | [@marketing-lead] | | People lead | Staff welfare, internal communication, HR issues | [@head-of-people] | [@hr-partner] | | Crisis coordinator (secretariat) | Decision log, action tracker, meeting logistics, information board | [@executive-assistant] | [@pmo-lead] | Advisers called in as needed: data protection officer, customer success lead, finance lead, insurer and breach counsel, external forensic provider, public relations adviser. Their contact details sit in the contact annex and in the authorities and special interest groups contact list (DOC-ISMS-069). Crisis room: [primary meeting room], virtual bridge [out-of-band conference line not dependent on corporate identity], backup location [alternate site]. Out-of-band messaging group: [tool], tested every quarter. ## 4. Activation and escalation ### 4.1 Activation criteria Any one of these is enough to alert the crisis lead: | Code | Criterion | Typical source | |---|---|---| | C1 | Incident rated at the top severity level in the incident severity matrix (`ops/incident-severity-matrix`) | Incident commander | | C2 | Prioritized activity expected to exceed its maximum tolerable period of disruption (BIA) | Business continuity lead | | C3 | Confirmed or likely theft or exposure of personal data or customer confidential data at large scale | CISO, data protection officer | | C4 | Threat of extortion, including ransom demands | CISO | | C5 | Media, regulator or law enforcement interest, or social media spreading fast | Communications lead, legal lead | | C6 | Risk of serious harm to people, or a fatality | Site emergency lead | | C7 | Event likely to have a material financial impact or to require disclosure to investors | Finance lead | | C8 | Any situation the chief executive or crisis lead considers a crisis | Any member | ### 4.2 Escalation steps 1. The person who identifies a possible crisis calls the crisis lead or deputy at once, day or night, and gives a short summary: what happened, when, what is affected, what is known and unknown. 2. The crisis lead decides within [30] minutes to activate, to put the team on standby, or to leave the event with the incident or continuity team. 3. On activation, the crisis coordinator alerts all members through the out-of-band channel; members confirm within [15] minutes and join the first meeting within [60] minutes. 4. The coordinator opens the decision log and the action tracker. Activation is recorded with the time, the criteria met and who decided. Activating and standing down early is acceptable and is not counted as a failure. ## 5. Decision-making and battle rhythm ### 5.1 First meeting agenda 1. Situation report from the security or operations lead: facts, assumptions and unknowns, kept separate. 2. Impact on people, customers, operations, legal duties and reputation. 3. Priorities for the next [4] hours, in order. 4. Immediate decisions (for example taking systems offline, engaging forensic or legal support, informing the insurer). 5. Notification clocks that may have started (section 8). 6. First communications: staff, customers, holding statement readiness. 7. Next meeting time and owner of each action. ### 5.2 Decision principles - Protect people first, then customers, then the organization's ability to recover, then reputation and finances. - Separate facts from assumptions in every briefing, and say how confident the team is. - Prefer reversible decisions when uncertainty is high; record the trigger for revisiting them. - Record each decision with the options considered, the reasons and the owner, even when the decision is to wait. - Seek legal advice before any statement that admits cause or liability, but do not let legal review delay safety or regulatory notices. ### 5.3 Decision log | Decision ID | Time (UTC) | Decision | Options considered | Reasons | Decided by | Owner | Review trigger | |---|---|---|---|---|---|---|---| | CD-001 *(Example)* | 2027-03-15 07:40 | Disconnect the office network and the managed service jump hosts from production | Keep running with extra monitoring, disconnect | Lateral movement seen in two systems | Crisis lead | Incident commander | Forensic confirmation of containment | | CD-002 *(Example)* | 2027-03-15 08:10 | Publish a status page notice and e-mail affected customers within 2 h | Wait for full scope, notify now | Customers already see failures; silence harms trust | Chief executive | Communications lead | New facts on data exposure | | [CD-NNN] | YYYY-MM-DD hh:mm | [decision] | [options] | [reasons] | [@decider] | [@owner] | [trigger] | ### 5.4 Battle rhythm | Time *(Example)* | Activity | Participants | |---|---|---| | Every 4 h in the first 24 h, then twice daily | Crisis team meeting | Crisis team | | 30 min before each meeting | Situation report from the incident commander | Incident commander, security lead | | After each meeting | Internal update to staff | Communications lead, people lead | | As agreed per audience | External updates (section 7) | Communications cell | | Daily | Board briefing | Crisis lead, chief executive | ## 6. Communication principles and approval Principles: - Speak early, even if only to say what is known, what is being done and when the next update will come. - Be accurate. Never guess at cause, scope or numbers; say "we are investigating" instead. - Show care for those affected before talking about the organization. - Keep one source of truth: every message comes from the approved fact sheet maintained by the communications cell. - Tell staff before or at the same time as the public. - Give practical guidance to affected people (for example password resets or how to spot phishing that uses the event as a lure). ```mermaid sequenceDiagram participant SEC as Security or operations lead participant COM as Communications cell participant LEG as Legal lead participant CL as Crisis lead participant OUT as Audience channels SEC->>COM: Confirmed facts for the fact sheet COM->>COM: Draft message from the approved template COM->>LEG: Legal review within 30 minutes LEG-->>COM: Changes or clearance COM->>CL: Final draft for approval CL-->>COM: Approved with release time COM->>OUT: Release to staff, customers, media or regulators OUT-->>COM: Questions and reactions COM->>SEC: Questions needing new facts ``` | Message type | Drafted by | Approved by | Target approval time *(Example)* | |---|---|---|---| | Internal staff update | Communications lead | Crisis lead | 30 min | | Customer notice and status page | Communications lead with customer success | Crisis lead, legal lead | 60 min | | Regulatory notification | Legal lead with data protection officer | Legal lead, chief executive | Within the legal deadline | | Media statement | Communications lead | Chief executive, legal lead | 60 min | | Investor or lender notice | Finance lead | Chief executive, legal lead | As required by law or contract | Only the chief executive, the communications lead and named deputies speak to media. All staff are reminded to refer media and social media questions to [press contact]. ## 7. Stakeholder map and communication matrix | Audience | What they need | Owner | Channel | First contact *(Example)* | Update frequency *(Example)* | |---|---|---|---|---|---| | Staff and contractors | What happened, what to do and not do, who to ask, welfare support | People lead | Out-of-band messaging, all-staff call | Within 2 h of activation | Every crisis meeting | | Board | Situation, decisions, exposure, support needed | Crisis lead | Call, briefing note | Within 2 h | Daily | | Affected customers | Impact on their service or data, actions they should take, next update time | Customer success lead with communications | E-mail, status page, account managers | Within the contractual period, aim 4 h | At least daily | | All other customers | Whether they are affected, reassurance based on facts | Communications lead | Status page, website notice | Same day | When status changes | | Supervisory and competent authorities | Legally required notifications | Legal lead | Regulator portals or channels in the contact list (DOC-ISMS-069) | Within legal deadlines (section 8) | As required | | Law enforcement | Report of crime, evidence cooperation | Legal lead with CISO | Designated contact | As decided by the crisis team | As requested | | Insurer and breach counsel | Notice of claim, approval of external providers | Finance lead, legal lead | Policy hotline | Within the policy notice period | As required | | Critical suppliers and partners | Actions needed (block, monitor, assist), confidentiality | Supplier manager | Supplier contacts in the supplier register (DOC-ISMS-066) | Within 4 h when they must act | As needed | | Media | Short factual statement, spokesperson availability | Communications lead | Press release, website | Holding statement ready within 1 h, released when needed | When facts change | | Investors and lenders | Material information as required | Finance lead | Disclosure channel | As required by law or contract | As required | | Affected individuals (data subjects) | What happened to their data, risks, steps to protect themselves, contact point | Data protection officer | E-mail, letter, website | When the high-risk threshold is met (section 8) | Until closure | ## 8. Regulators, authorities and notification duties Record the time of awareness for each duty in the decision log. The examples below are international examples to check, not a complete or authoritative list. | Regime *(Example)* | Who it applies to | Duty | Deadline | Owner | |---|---|---|---|---| | GDPR, Regulation (EU) 2016/679, Art. 33 | Controllers subject to the GDPR (territorial scope in Art. 3) | Notify the supervisory authority of a personal data breach unless it is unlikely to result in a risk to people | Without undue delay and, where feasible, within 72 h of becoming aware | Data protection officer | | GDPR, Art. 34 | Controllers | Inform affected individuals when the breach is likely to result in a high risk to them | Without undue delay | Data protection officer | | GDPR, Art. 33(2) | Processors | Inform the controller (the customer) | Without undue delay | Legal lead, customer success | | NIS2, Directive (EU) 2022/2555, Art. 23 | Essential and important entities under national law | Early warning, incident notification and final report of a significant incident to the CSIRT or competent authority | 24 h, 72 h and one month after the notification, as transposed nationally | Legal lead with CISO | | DORA, Regulation (EU) 2022/2554 | EU financial entities | Classify and report major ICT-related incidents under the DORA technical standards | Deadlines set in the DORA technical standards | Legal lead | | Contracts and data processing agreements | Customers | Notice of incidents affecting their data or service | As written in each contract | Customer success lead | | [Sector or national rule] | [scope] | [duty] | [deadline] | [@owner] | Use the personal data breach assessment (`compliance/personal-data-breach-assessment`) to decide whether the GDPR thresholds are met and to record the reasoning, including decisions not to notify. ## 9. Holding statements and message templates Holding statement for media and website (first hours): ```text [Organization name] is responding to [an incident affecting some of our systems / a disruption to our services] identified on [date]. We acted immediately to [contain the issue / protect our customers' information] and are working with [specialist advisers]. Our priority is the [safety of our people and] service to our customers. We will share more information at [time or channel]. Customers with questions can contact [contact point]. ``` First customer notice (affected customers): ```text Subject: Service incident affecting [service], [date] We are writing to tell you about an incident that affects [service]. What happened: on [date and time UTC] we identified [short factual description]. What we are doing: [containment and recovery actions]. What this means for you: [impact known so far, or "we are still investigating whether your data is affected"]. What you can do now: [practical steps]. We will update you by [time] and at least [daily]. Contact: [named contact and channel]. ``` Internal staff message: ```text Team, we are managing [an incident affecting our systems]. The crisis team is leading the response. Please: do not discuss the incident on social media or with anyone outside the company; send any media or customer questions to [contact]; follow instructions from IT about [systems or passwords]; report anything suspicious to [security contact]. Your welfare matters: contact [people lead] if you need support. Next update at [time]. ``` Statement after containment: ```text [Organization name] has contained the incident identified on [date]. [Services are restored / Most services are restored, with remaining services expected by date]. Our investigation, supported by [independent specialists], has found [confirmed facts]. We have [notified relevant authorities and affected customers]. We have taken steps to [prevent a repeat]. We apologise for the disruption and thank our customers for their patience. ``` ## 10. Cyber crisis scenario: ransomware with data theft Setting *(Example)*: Quillmere Health Systems (320 staff), clinical scheduling software and managed service for hospitals. On a Monday morning, scheduling services for hospital customers fail and files on the managed service hosts are encrypted. A ransom note claims that patient appointment data has been copied and will be published in 7 days. | Time from detection *(Example)* | Event | Crisis team action | |---|---|---| | 0 h 00 | Monitoring alerts on mass file changes; incident commander declares top severity | Incident commander calls the crisis lead (criteria C1, C4) | | 0 h 25 | Crisis lead activates the team | Coordinator opens decision log, team assembles on the out-of-band bridge | | 1 h 00 | First meeting | CD-001 disconnect affected segments, engage forensic provider and breach counsel, inform the insurer, record awareness time for notification clocks | | 1 h 30 | Hospitals report missed appointment bookings | CD-002 status page notice and customer e-mail within 2 h; hospitals advised to use manual booking workaround from the BCP | | 3 h 00 | Forensic triage confirms data staging on one server | Legal lead and data protection officer start breach assessment; as processor, inform controller hospitals without undue delay | | 6 h 00 | Backup integrity confirmed on immutable copies | ICT recovery manager plans restore under the ICT readiness plan | | 20 h 00 | NIS2 assessment: entity in scope under national law, incident significant | Legal lead submits early warning before 24 h | | 30 h 00 | Ransom stance decided | Crisis team records decision and reasons with counsel, in line with law and sanctions checks | | 48 h 00 | Core scheduling restored for 90% of hospital customers | Containment statement released, staff update, customer calls | | 70 h 00 | Incident notification to the authority | Legal lead submits before 72 h | | Day 10 | All services restored, monitoring increased | Stand-down decision prepared (section 11) | Key questions for the exercise: - Who decides to disconnect services that hospitals depend on, and how is clinical safety considered? - How do the processor duties to hospitals and any direct duties under NIS2 fit together, and who speaks to which regulator? - What do staff tell hospital users who call before the customer notice is out? - What evidence does the team need before saying data was or was not taken? ## 11. Stand-down, recovery and review Stand down when: - the situation is stable and handed to normal incident, continuity or project management; - remaining legal notifications have owners and dates; - customer and staff communication has moved to normal channels; - the decision log is complete and stored. After stand-down: 1. Hold a post-incident review within [10] working days (`isms/post-incident-review`), covering both the response and the crisis management: timeliness of activation, quality of decisions, communication effectiveness, stakeholder feedback. 2. Enter actions in the corrective action process (DOC-ISMS-087) and the continual improvement register (DOC-ISMS-088). 3. Update this plan, the holding statements and the contact annex. 4. Report the crisis and lessons to management review (DOC-ISMS-085) and to the board. 5. Plan follow-up communication with affected customers and individuals. ## 12. Training and exercises | Exercise type | Purpose | Frequency *(Example)* | Participants | |---|---|---|---| | Contact and call-out test | Prove the team can be reached and assembled out of hours | Quarterly | All members and deputies | | Plan walkthrough | Familiarize new members, check roles and contacts | On joining, and annually | New members | | Tabletop exercise | Practise decisions and communications on a scenario | Twice a year | Crisis team, incident commander, BC lead | | Joint exercise | Test interfaces with incident response, BCP and ICT recovery together | Annually | Crisis, incident and recovery teams | | Media training | Prepare spokespeople | Annually | Chief executive, communications lead, deputies | ```mermaid gantt title Crisis management exercise programme 2027 (Example) dateFormat YYYY-MM-DD section Call-out tests Callout_Q1 :c1, 2027-01-12, 1d Callout_Q2 :c2, 2027-04-13, 1d Callout_Q3 :c3, 2027-07-13, 1d Callout_Q4 :c4, 2027-10-12, 1d section Exercises Tabletop_ransomware :t1, 2027-03-02, 1d Joint_exercise_with_ICT_recovery :t2, 2027-06-08, 2d Tabletop_supplier_failure :t3, 2027-09-21, 1d section Training Media_training :m1, 2027-05-18, 1d ``` Each exercise has objectives, an observer who records performance and a short report with actions (`security/tabletop-exercise`). ## 13. Size tiers | Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) | |---|---|---|---| | Crisis team | 5 people: CEO (lead), Head of Engineering Operations (security and continuity), finance lead, a founder for communications, external breach counsel on retainer | 8 roles as in section 3, with the full-time ISMS manager as crisis coordinator | Group crisis team plus a site crisis team at each of the 6 sites; country leads in the 4 countries | | Communications | Status page, customer e-mail, one spokesperson | Communications lead plus customer success for hospital customers | Group communications with country press contacts and local languages | | Regulators | Customers as controllers; supervisory authority only for own staff and marketing data | Hospitals as controllers, own controller duties, possible NIS2 duties as a managed service provider (ICT service management, NIS2 Annex I) under national law | Several regulators in 4 countries; OT safety authorities for plants | | Exercises | One tabletop and two call-out tests a year | Programme in section 12 | Group exercise plus site exercises, aligned with the existing ISO 22301 programme | | Integration | One document with the BCP | Separate plan linked to BCP and incident response | Part of the integrated management system, alongside the certified ISO 22301 BCMS | ## 14. Records and evidence | Record | Proves | Owner | Location | Retention *(Example)* | |---|---|---|---|---| | Approved plan and revision history | Plan is controlled and current | Crisis lead | Document management system and offline copies | Current plus 3 superseded versions | | Contact annex verification log | Contacts are current | Crisis coordinator | Contact annex | 3 years | | Activation records, decision logs, action trackers | Plan was used and decisions can be explained | Crisis coordinator | Restricted crisis folder | At least 6 years, or longer if litigation is possible | | Communications issued (final versions with time and approver) | Messages were approved and timely | Communications lead | Restricted crisis folder | At least 6 years | | Regulatory notifications and acknowledgements | Legal duties were met | Legal lead | Legal register (DOC-ISMS-014), incident register (DOC-ISMS-021) | As required by law | | Exercise reports and actions | Team is trained and plan is tested | Crisis lead | Exercise records | 3 years | | Post-incident review reports | Lessons were learned | ISMS manager | DOC-ISMS-022 | 3 years | Set final retention in the documented information register (DOC-ISMS-028) after legal advice. ## 15. References | Reference | Edition | Use | |---|---|---| | ISO 22361:2022, security and resilience, crisis management, guidelines | 2022 | Crisis leadership, decision-making and communication concepts (cited) | | ISO 22301:2019 + Amd 1:2024, business continuity management systems, requirements | 2019, Amd 1 2024 | Response structure and link to business continuity | | ISO/IEC 27001:2022 + Amd 1:2024, information security management systems, requirements | 2022, Amd 1 published 2024-02-23 | A.5.5, A.5.24 to A.5.29 | | ISO/IEC 27035-1:2023, information security incident management, principles and process | 2023 | Interface with incident management | | Regulation (EU) 2016/679 (GDPR) | As amended | Articles 33 and 34 breach notification | | Directive (EU) 2022/2555 (NIS2) | OJ L 333, 27.12.2022 | Article 23 reporting obligations, as transposed nationally | | Regulation (EU) 2022/2554 (DORA) | OJ L 333, 27.12.2022 | Major ICT-related incident reporting for financial entities | Official pages: ISO 22361 https://www.iso.org/standard/50267.html, ISO 22301 https://www.iso.org/standard/75106.html, ISO/IEC 27001 https://www.iso.org/standard/82875.html, Amd 1 https://www.iso.org/standard/88435.html, ISO/IEC 27035-1 https://www.iso.org/standard/78973.html. Related templates: `compliance/incident-response-plan`, `compliance/business-continuity`, `isms/ict-readiness-business-continuity-plan`, `ops/incident-commander-handbook`, `ops/incident-severity-matrix`, `security/tabletop-exercise`, `compliance/personal-data-breach-assessment`, `isms/authority-special-interest-contacts`, `isms/isms-communication-plan`, `isms/post-incident-review`, `isms/supplier-register`, `isms/control-evidence-matrix`. ## Standard and licence note Structure aligned with the crisis management guidance of ISO 22361:2022 and with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A controls A.5.5 and A.5.24 to A.5.29. The team structure, criteria, matrices, holding statements, scenario and guidance are original wording. ISO/IEC text is not reproduced: standards are cited by number and clause or control number only, with short descriptions written for this template. ISO and IEC standards are copyrighted; obtain the official standards from ISO or your national standards body before relying on this template. Check the current edition of each standard and the current text of each law before use. This is a documentation format, not legal advice. Template licence: MIT.