Crisis Management and Communications Plan Template (ISO 22361)

Crisis Management and Communications Plan: [Organization name]

Plan for leading the organization through a crisis: a situation that threatens its people, customers, reputation, finances or ability to operate, and that ordinary incident and continuity processes cannot resolve on their own. It defines the crisis management team, activation criteria, decision-making, stakeholder communications (staff, customers, regulators, media, suppliers, investors), holding statements, a cyber crisis scenario and the interfaces with incident response and business continuity. It draws on the guidance of ISO 22361:2022 (crisis management, cited) and supports ISO/IEC 27001:2022

• Amd 1:2024 controls A.5.24 to A.5.29 and A.5.5 (contact with authorities). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and definitions
2. Interfaces with incident response and business continuity
3. Crisis management team
4. Activation and escalation
5. Decision-making and battle rhythm
6. Communication principles and approval
7. Stakeholder map and communication matrix
8. Regulators, authorities and notification duties
9. Holding statements and message templates
10. Cyber crisis scenario: ransomware with data theft
11. Stand-down, recovery and review
12. Training and exercises
13. Size tiers
14. Records and evidence
15. References

1. Purpose, scope and definitions

This plan sets out how [Organization name] recognizes a crisis, brings together the people who can lead it, takes and records strategic decisions, and communicates with everyone affected, so that harm to people, customers, operations, reputation and legal standing is kept as low as possible and trust is rebuilt afterwards.

Scope: [all legal entities, sites, products and services of the organization]. The plan covers crises of any cause, including cyber attacks, major data breaches, prolonged service outages, supplier failure, product safety issues, serious misconduct allegations, natural hazards and events that affect staff safety. Life-safety emergencies are first handled by the site emergency procedures; the crisis team takes over the strategic response once people are safe.

2. Interfaces with incident response and business continuity

Rules: the incident commander keeps authority over technical response; the crisis team does not give instructions to responders directly. All external messages about the event, including those to customers from account managers, go through the communications cell once the crisis team is active.

3. Crisis management team

Advisers called in as needed: data protection officer, customer success lead, finance lead, insurer and breach counsel, external forensic provider, public relations adviser. Their contact details sit in the contact annex and in the authorities and special interest groups contact list (DOC-ISMS-069).

Crisis room: [primary meeting room], virtual bridge [out-of-band conference line not dependent on corporate identity], backup location [alternate site]. Out-of-band messaging group: [tool], tested every quarter.

4. Activation and escalation

4.1 Activation criteria

Any one of these is enough to alert the crisis lead:

4.2 Escalation steps

1. The person who identifies a possible crisis calls the crisis lead or deputy at once, day or night, and gives a short summary: what happened, when, what is affected, what is known and unknown.
2. The crisis lead decides within [30] minutes to activate, to put the team on standby, or to leave the event with the incident or continuity team.
3. On activation, the crisis coordinator alerts all members through the out-of-band channel; members confirm within [15] minutes and join the first meeting within [60] minutes.
4. The coordinator opens the decision log and the action tracker.

Activation is recorded with the time, the criteria met and who decided. Activating and standing down early is acceptable and is not counted as a failure.

5. Decision-making and battle rhythm

5.1 First meeting agenda

1. Situation report from the security or operations lead: facts, assumptions and unknowns, kept separate.
2. Impact on people, customers, operations, legal duties and reputation.
3. Priorities for the next [4] hours, in order.
4. Immediate decisions (for example taking systems offline, engaging forensic or legal support, informing the insurer).
5. Notification clocks that may have started (section 8).
6. First communications: staff, customers, holding statement readiness.
7. Next meeting time and owner of each action.

5.2 Decision principles

• Protect people first, then customers, then the organization's ability to recover, then reputation and finances.
• Separate facts from assumptions in every briefing, and say how confident the team is.
• Prefer reversible decisions when uncertainty is high; record the trigger for revisiting them.
• Record each decision with the options considered, the reasons and the owner, even when the decision is to wait.
• Seek legal advice before any statement that admits cause or liability, but do not let legal review delay safety or regulatory notices.

5.3 Decision log

5.4 Battle rhythm

6. Communication principles and approval

Principles:

• Speak early, even if only to say what is known, what is being done and when the next update will come.
• Be accurate. Never guess at cause, scope or numbers; say "we are investigating" instead.
• Show care for those affected before talking about the organization.
• Keep one source of truth: every message comes from the approved fact sheet maintained by the communications cell.
• Tell staff before or at the same time as the public.
• Give practical guidance to affected people (for example password resets or how to spot phishing that uses the event as a lure).

Only the chief executive, the communications lead and named deputies speak to media. All staff are reminded to refer media and social media questions to [press contact].

7. Stakeholder map and communication matrix

8. Regulators, authorities and notification duties

Record the time of awareness for each duty in the decision log. The examples below are international examples to check, not a complete or authoritative list.

Use the personal data breach assessment (compliance/personal-data-breach-assessment) to decide whether the GDPR thresholds are met and to record the reasoning, including decisions not to notify.

9. Holding statements and message templates

Holding statement for media and website (first hours):

[Organization name] is responding to [an incident affecting some of our
systems / a disruption to our services] identified on [date]. We acted
immediately to [contain the issue / protect our customers' information]
and are working with [specialist advisers]. Our priority is the
[safety of our people and] service to our customers. We will share more
information at [time or channel]. Customers with questions can contact
[contact point].

First customer notice (affected customers):

Subject: Service incident affecting [service], [date]

We are writing to tell you about an incident that affects [service].
What happened: on [date and time UTC] we identified [short factual
description]. What we are doing: [containment and recovery actions].
What this means for you: [impact known so far, or "we are still
investigating whether your data is affected"]. What you can do now:
[practical steps]. We will update you by [time] and at least [daily].
Contact: [named contact and channel].

Internal staff message:

Team, we are managing [an incident affecting our systems]. The crisis
team is leading the response. Please: do not discuss the incident on
social media or with anyone outside the company; send any media or
customer questions to [contact]; follow instructions from IT about
[systems or passwords]; report anything suspicious to [security
contact]. Your welfare matters: contact [people lead] if you need
support. Next update at [time].

Statement after containment:

[Organization name] has contained the incident identified on [date].
[Services are restored / Most services are restored, with remaining
services expected by date]. Our investigation, supported by [independent
specialists], has found [confirmed facts]. We have [notified relevant
authorities and affected customers]. We have taken steps to [prevent a
repeat]. We apologise for the disruption and thank our customers for
their patience.

10. Cyber crisis scenario: ransomware with data theft

Setting (Example): Quillmere Health Systems (320 staff), clinical scheduling software and managed service for hospitals. On a Monday morning, scheduling services for hospital customers fail and files on the managed service hosts are encrypted. A ransom note claims that patient appointment data has been copied and will be published in 7 days.

Key questions for the exercise:

• Who decides to disconnect services that hospitals depend on, and how is clinical safety considered?
• How do the processor duties to hospitals and any direct duties under NIS2 fit together, and who speaks to which regulator?
• What do staff tell hospital users who call before the customer notice is out?
• What evidence does the team need before saying data was or was not taken?

11. Stand-down, recovery and review

Stand down when:

• the situation is stable and handed to normal incident, continuity or project management;
• remaining legal notifications have owners and dates;
• customer and staff communication has moved to normal channels;
• the decision log is complete and stored.

After stand-down:

1. Hold a post-incident review within [10] working days (isms/post-incident-review), covering both the response and the crisis management: timeliness of activation, quality of decisions, communication effectiveness, stakeholder feedback.
2. Enter actions in the corrective action process (DOC-ISMS-087) and the continual improvement register (DOC-ISMS-088).
3. Update this plan, the holding statements and the contact annex.
4. Report the crisis and lessons to management review (DOC-ISMS-085) and to the board.
5. Plan follow-up communication with affected customers and individuals.

12. Training and exercises

Each exercise has objectives, an observer who records performance and a short report with actions (security/tabletop-exercise).

13. Size tiers

14. Records and evidence

Set final retention in the documented information register (DOC-ISMS-028) after legal advice.

15. References

Official pages: ISO 22361 https://www.iso.org/standard/50267.html, ISO 22301 https://www.iso.org/standard/75106.html, ISO/IEC 27001 https://www.iso.org/standard/82875.html, Amd 1 https://www.iso.org/standard/88435.html, ISO/IEC 27035-1 https://www.iso.org/standard/78973.html.

Related templates: compliance/incident-response-plan, compliance/business-continuity, isms/ict-readiness-business-continuity-plan, ops/incident-commander-handbook, ops/incident-severity-matrix, security/tabletop-exercise, compliance/personal-data-breach-assessment, isms/authority-special-interest-contacts, isms/isms-communication-plan, isms/post-incident-review, isms/supplier-register, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with the crisis management guidance of ISO 22361:2022 and with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A controls A.5.5 and A.5.24 to A.5.29. The team structure, criteria, matrices, holding statements, scenario and guidance are original wording. ISO/IEC text is not reproduced: standards are cited by number and clause or control number only, with short descriptions written for this template. ISO and IEC standards are copyrighted; obtain the official standards from ISO or your national standards body before relying on this template. Check the current edition of each standard and the current text of each law before use. This is a documentation format, not legal advice. Template licence: MIT.