Crisis Management

Crisis Management

Required Inputs

• Organization: Company name, industry, size, and geographic footprint.
• Crisis History: Past incidents, near-misses, and lessons learned.
• Stakeholder Map: Key internal and external stakeholders (board, regulators, media, customers, employees, investors, partners).
• Existing Plans: Current BCP, DR, incident response, and communication plans.
• Risk Profile: Top enterprise risks from enterprise-risk-assessment skill output.
• Regulatory Requirements: Mandatory notification obligations (breach notification laws, regulatory reporting, stock exchange disclosure).

Execution Steps

1. Crisis Classification Framework

Classify every potential crisis by severity to drive proportional response.

Severity Level Definitions

Escalation Triggers (Any One Triggers Escalation to Next Level)

2. Crisis Management Team (CMT) Structure

Core CMT Roles

CMT Activation Protocol

3. Decision Trees by Crisis Type

Each decision tree follows: Detect --> Assess --> Decide --> Act --> Communicate --> Review.

3A. Operational Crisis (Supply Chain Failure, Facility Loss, Key Vendor Collapse)

START: Operational disruption detected
  |
  +--> Can operations continue at >80% capacity?
  |     YES --> Level 1-2: Monitor, activate backup procedures
  |     NO  --> Proceed
  |
  +--> Is customer delivery impacted?
  |     YES --> Level 3+: Activate BCP
  |     |       +--> Backup facility available?
  |     |       |     YES --> Failover within RTO
  |     |       |     NO  --> Invoke mutual aid / emergency vendor contracts
  |     |       +--> Customer notification required?
  |     |             YES --> Activate customer communication template
  |     NO  --> Level 2: Internal remediation, enhanced monitoring
  |
  +--> Duration estimate?
        < 24 hours --> Manage internally with status updates
        24-72 hours --> CMT activated, stakeholder communication
        > 72 hours --> Level 4: Full crisis response, regulatory notification if required

3B. Reputational Crisis (Negative Media, Social Media Viral, Executive Misconduct)

START: Reputational threat identified
  |
  +--> Is the allegation/story true?
  |     YES --> Acknowledge, take responsibility, announce corrective action
  |     NO  --> Prepare factual rebuttal with evidence
  |     PARTIAL/UNCERTAIN --> Acknowledge concern, announce investigation, do NOT deny
  |
  +--> Is media coverage active?
  |     YES --> Activate Communications Lead
  |     |       +--> Prepare holding statement (within 1 hour)
  |     |       +--> Designate single spokesperson
  |     |       +--> Monitor media and social channels continuously
  |     NO  --> Prepare reactive statement, monitor for escalation
  |
  +--> Does it involve executive misconduct?
  |     YES --> Legal privilege immediately; board notification;
  |     |       outside counsel leads investigation; consider executive leave
  |     NO  --> Standard investigation protocol
  |
  +--> Social media velocity?
        Trending --> Activate social media war room (see Section 6)
        Contained --> Standard monitoring cadence

3C. Cyber Crisis (Data Breach, Ransomware, System Compromise)

START: Cyber incident confirmed
  |
  +--> Invoke incident response plan (link to cyber-risk-assessment skill)
  +--> Contain: Isolate affected systems (DO NOT power off -- preserve forensics)
  |
  +--> Is personal data affected?
  |     YES --> Start breach notification clock
  |     |       +--> GDPR: 72 hours to supervisory authority
  |     |       +--> US state laws: Varies (30-90 days; check specific state)
  |     |       +--> HIPAA: 60 days to HHS, affected individuals, media if > 500
  |     |       +--> Engage breach counsel and forensic firm
  |     NO  --> Assess operational and IP impact
  |
  +--> Is it ransomware?
  |     YES --> DO NOT pay without legal, insurance, and law enforcement consultation
  |     |       +--> Engage law enforcement (FBI IC3, local field office)
  |     |       +--> Activate offline backups
  |     |       +--> Check cyber insurance policy for ransom coverage
  |     NO  --> Standard containment and eradication
  |
  +--> Business impact?
        Critical systems down --> Activate BCP/DR; CMT Level 4+
        Non-critical systems --> Targeted remediation; Level 2-3

3D. Financial Crisis (Liquidity Event, Restatement, Covenant Breach)

START: Financial crisis indicator
  |
  +--> Going concern risk?
  |     YES --> Level 5: Board emergency session; engage restructuring advisor
  |     NO  --> Assess severity
  |
  +--> Covenant breach?
  |     YES --> Immediate lender notification (most agreements require prompt notice)
  |     |       +--> Engage financial advisor for waiver negotiation
  |     |       +--> Prepare covenant compliance remediation plan
  |     NO  --> Proceed to liquidity assessment
  |
  +--> Financial restatement required?
  |     YES --> Audit committee notification; SEC 8-K filing; investor communication
  |     |       +--> Engage restatement counsel and forensic accountants
  |     NO  --> Standard financial remediation
  |
  +--> Stock exchange disclosure required?
        YES --> Draft 8-K/6-K with legal counsel within required timeframe
        NO  --> Internal remediation with board reporting

3E. Legal Crisis (Litigation, Regulatory Action, Government Investigation)

START: Legal crisis identified
  |
  +--> Government investigation / subpoena?
  |     YES --> IMMEDIATELY invoke legal privilege on ALL related communications
  |     |       +--> Engage outside counsel with relevant expertise
  |     |       +--> Implement litigation hold (preserve ALL documents, emails, data)
  |     |       +--> DO NOT conduct internal interviews without counsel present
  |     |       +--> Board notification (audit committee)
  |     NO  --> Standard legal assessment
  |
  +--> Class action or mass litigation?
  |     YES --> Assess insurance coverage; engage mass tort counsel;
  |     |       prepare investor communication; assess disclosure obligation
  |     NO  --> Individual matter management
  |
  +--> Regulatory enforcement action?
        YES --> Cooperate unless counsel advises otherwise
        |       +--> Assess self-disclosure benefit (DOJ cooperation credit, SEC whistleblower)
        |       +--> Prepare remediation narrative
        NO  --> Monitor and prepare defensive position

3F. Natural Disaster / Physical Crisis

START: Physical threat detected
  |
  +--> Is there immediate danger to life?
  |     YES --> Evacuate. Call emergency services. Account for all personnel.
  |     |       NOTHING else matters until people are safe.
  |     NO  --> Assess facility and asset impact
  |
  +--> Facility accessible?
  |     YES --> Damage assessment; secure affected areas
  |     NO  --> Activate alternate work locations; remote work protocol
  |
  +--> Duration estimate?
        < 3 days --> Temporary measures; employee communication
        3-14 days --> BCP activation; customer notification
        > 14 days --> Full relocation; insurance claim; regulatory notification if applicable

4. First 24 Hours Playbook (Golden Hour Protocol)

Hour 0-1: Detection and Initial Response

Hour 1-4: Assessment and Mobilization

Hour 4-12: Containment and Communication

Hour 12-24: Stabilization

5. Stakeholder Communication Templates

5A. Employee Communication (Level 3+)

Subject: Important Update -- [Brief Description of Situation]

Team,

We are aware of [brief, factual description of what happened]. We are actively
managing the situation with the following steps:

1. [Immediate action taken]
2. [What we are doing to resolve]
3. [What employees should/should not do]

Your safety and well-being are our top priority. [If physical safety: follow
evacuation/safety procedures. If cyber: change passwords, be alert for phishing.]

We will provide updates every [frequency]. Direct questions to [designated contact].

Please do NOT speak to media, post on social media about this incident, or
share information outside the company. Direct all media inquiries to [name/number].

[Signature -- CEO or appropriate senior leader]

5B. Customer Communication (Level 3+)

Subject: [Company Name] -- Important Notice Regarding [Issue]

Dear [Customer],

We are writing to inform you of [factual description]. We take this matter
very seriously.

What happened: [Clear, factual explanation -- no speculation]
What we are doing: [Specific remediation steps]
What this means for you: [Direct impact assessment]
What you should do: [Specific, actionable steps for the customer]

[If data breach: We are offering [credit monitoring / identity protection]
at no cost. Enroll at [link] or call [number].]

We sincerely apologize for [the inconvenience / concern this may cause].
For questions, contact [dedicated support line/email].

[Signature -- CEO or relevant executive]

5C. Media Statement (Holding Statement -- Level 3+)

[Company Name] is aware of [brief description]. We are taking this matter
seriously and are actively [investigating / responding / working to resolve
the situation].

[The safety of our people / the security of our customers' data / the
continuity of our operations] is our highest priority.

We are working with [relevant authorities / external experts / law enforcement]
and will provide updates as more information becomes available.

Media contact: [Name], [Phone], [Email]

5D. Regulator Notification (Template)

[Date]

[Regulatory Body Name]
[Address]

Re: [Notification Type] -- [Company Name] -- [Reference Number if applicable]

Dear [Title/Name],

Pursuant to [specific regulation/statute requiring notification], we are
notifying [regulatory body] of [description of incident/event].

Date of discovery: [Date]
Nature of incident: [Brief factual description]
Scope of impact: [Number of individuals/entities affected]
Immediate actions taken: [Containment measures]
Ongoing investigation: [Status and expected timeline]
Point of contact: [Name, title, phone, email]

We will provide supplemental information as our investigation progresses.

Respectfully,
[Name, Title]

5E. Investor/Board Communication (Level 4+)

[Confidential -- Board / Investor Communication]

Subject: [Incident Type] -- Board Briefing [Date/Time]

Situation Summary:
[2-3 sentence factual summary]

Current Status: [Contained / Active / Escalating]
Financial Impact Assessment: [Estimated range or "under assessment"]
Regulatory Exposure: [Notification obligations and status]
Legal Exposure: [Litigation risk assessment -- privileged]
Reputational Impact: [Media coverage assessment]
Insurance Coverage: [Applicable policies and status of claim]

Actions Taken:
1. [Action and owner]
2. [Action and owner]

Board Action Required:
- [Approval / oversight / decision needed]

Next Update: [Date/time]

6. Social Media Response Protocol

Monitoring and Escalation

Response Decision Matrix

Golden Rules for Crisis Social Media

1. NEVER delete posts or comments (it will be screenshot and amplified).
2. NEVER argue, be defensive, or blame others.
3. ONE consistent voice -- all posts approved by Communications Lead.
4. Acknowledge the situation even if you cannot share details.
5. Provide a single link for updates (crisis landing page).
6. Pause all scheduled marketing/promotional posts immediately.

7. Business Continuity Activation Triggers

8. Post-Crisis After-Action Review

Conduct within 2-4 weeks of crisis resolution while memory is fresh.

After-Action Review Structure

After-Action Review Template

## After-Action Review: [Crisis Name]

### Incident Summary
| Field | Detail |
|---|---|
| Crisis Type | [Classification] |
| Severity Level | [1-5] |
| Duration | [Start date/time -- End date/time] |
| Total Duration | [Hours/Days] |
| Financial Impact | [$X actual + $X estimated ongoing] |
| People Impacted | [Employees, customers, public] |

### Timeline of Key Events
| Date/Time | Event | Decision Made | By Whom | Outcome |
|---|---|---|---|---|
| [Timestamp] | [Event] | [Decision] | [Role] | [Result] |

### What Went Well
1. [Specific positive action or decision with evidence]

### What Did Not Go Well
1. [Specific gap or failure with evidence]

### Root Cause Analysis
[5 Whys or fishbone diagram output]

### Improvement Actions
| ID | Finding | Action | Owner | Deadline | Priority |
|---|---|---|---|---|---|
| AAR-001 | [Finding] | [Specific action] | [Role] | [Date] | [High/Med/Low] |

### Plan Updates Required
[List specific changes to crisis management plan, BCP, communication templates]

9. Crisis Simulation / Tabletop Exercise Design

Exercise Design Framework

Tabletop Exercise Template

Exercise Evaluation Criteria

10. Reputation Recovery Roadmap

Phase 1: Immediate (Week 1-4 Post-Crisis)

Phase 2: Rebuild (Month 2-6)

Phase 3: Sustain (Month 6-18)

11. Legal Coordination Protocol

What TO Say

• Facts that are confirmed and verified
• Steps being taken to address the situation
• Commitment to transparency and accountability
• Specific remediation being offered to affected parties
• Information required by law or regulation to be disclosed

What NOT to Say

• Speculation about cause, scope, or blame before investigation is complete
• Admission of legal liability (distinguish "responsibility" from "liability")
• Number of affected individuals before count is confirmed
• Specific dollar amounts of damages or losses
• Anything that contradicts or could contradict regulatory filings
• Details that could compromise an ongoing investigation
• Information protected by attorney-client privilege

Legal Privilege Preservation

Output Template

## Crisis Management Plan: [Organization]

### Document Control
| Field | Detail |
|---|---|
| Version | [#] |
| Approved By | [CEO / Board] |
| Last Updated | [Date] |
| Next Review | [Date -- annual minimum] |
| Distribution | [Confidential -- CMT members, General Counsel, Board] |

### Crisis Classification Framework
[Severity levels 1-5 with escalation triggers]

### Crisis Management Team
[Roles, contact info, backup assignments]

### Decision Trees
[Crisis-type-specific decision trees]

### Golden Hour Protocol
[First 24 hours playbook]

### Communication Templates
[Pre-approved templates for each stakeholder group]

### Business Continuity Activation Triggers
[Trigger-response matrix]

### Reputation Recovery Roadmap
[Post-crisis recovery phases]

### Legal Coordination Protocol
[What to say / not say; privilege preservation]

### Exercise Schedule
[Annual tabletop and simulation calendar]

### Appendices
- A: CMT contact list (wallet card format)
- B: External advisor contact list (counsel, PR firm, forensics, insurance broker)
- C: Regulatory notification requirements by jurisdiction
- D: Insurance policy summary (coverage, limits, deductibles, notification requirements)
- E: Pre-approved holding statements by crisis type

Quality Checks

• Crisis classification framework has 5 distinct severity levels with specific, measurable escalation triggers between each level.
• CMT roles are defined with primary and backup assignments -- no single points of failure.
• Decision trees exist for all 6 crisis types (operational, reputational, cyber, financial, legal, natural disaster) and use branching logic, not linear checklists.
• Golden hour protocol covers the first 24 hours in specific time blocks with named owners and defined deliverables.
• Stakeholder communication templates exist for all key audiences (employees, customers, media, regulators, investors/board).
• Social media response protocol includes monitoring thresholds, response decision matrix, and explicit "do not" rules.
• Business continuity activation triggers link to specific BCP components with RTO targets.
• After-action review methodology includes root cause analysis (5 Whys or equivalent), not just "lessons learned."
• Tabletop exercise design includes injects, evaluation criteria, and scoring -- not just a discussion guide.
• Reputation recovery roadmap spans 3 phases (immediate, rebuild, sustain) over 18 months minimum.
• Legal coordination protocol explicitly defines what to say and what not to say, with privilege preservation procedures.
• All templates include attorney-client privilege markings where applicable.