# Crisis Management

> Crisis management and incident response planning engine that builds classification frameworks, decision trees, communication playbooks, and post-crisis recovery roadmaps. USE THIS SKILL when the user mentions crisis response, crisis management plan, incident playbook, reputation risk, business continuity activation, crisis communication, tabletop exercise, crisis simulation, golden hour protocol, stakeholder notification, or post-crisis after-action review. Covers the full crisis lifecycle from preparedness through recovery.

- Skill: `kaakati/crisis-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kaakati/crisis-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kaakati/crisis-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: Kaakati (https://skillmd.com/u/kaakati)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kaakati/crisis-management

---


# Crisis Management

## Required Inputs

- **Organization**: Company name, industry, size, and geographic footprint.
- **Crisis History**: Past incidents, near-misses, and lessons learned.
- **Stakeholder Map**: Key internal and external stakeholders (board, regulators, media, customers, employees, investors, partners).
- **Existing Plans**: Current BCP, DR, incident response, and communication plans.
- **Risk Profile**: Top enterprise risks from `enterprise-risk-assessment` skill output.
- **Regulatory Requirements**: Mandatory notification obligations (breach notification laws, regulatory reporting, stock exchange disclosure).

## Execution Steps

### 1. Crisis Classification Framework

Classify every potential crisis by severity to drive proportional response.

**Severity Level Definitions**

| Level | Name | Definition | Examples | Escalation Authority |
|---|---|---|---|---|
| **5** | Existential | Threatens organizational survival. Regulatory shutdown, mass casualty, systemic fraud discovery. | Major regulatory sanction, CEO arrested, product causes deaths | Board of Directors, CEO |
| **4** | Severe | Material financial, operational, or reputational impact. Multi-day disruption. National/international media attention. | Major data breach (>100K records), facility destroyed, class action lawsuit, hostile activist campaign | CEO, Crisis Management Team |
| **3** | Significant | Meaningful disruption to operations or reputation. Regional media attention. Regulatory inquiry likely. | Localized data breach, key system outage >24h, executive misconduct allegation, product recall | CMT Lead, C-suite sponsor |
| **2** | Moderate | Contained disruption. Internal impact primarily. Local media possible. | Single-site disruption, employee injury, negative social media trend, vendor failure | Business unit head, Communications |
| **1** | Minor | Routine incident handled through normal operations. No media interest. | IT help desk spike, minor customer complaint trend, small policy violation | Department manager |

**Escalation Triggers (Any One Triggers Escalation to Next Level)**

| From | To | Trigger |
|---|---|---|
| Level 1 | Level 2 | Media inquiry received; regulatory contact; social media amplification |
| Level 2 | Level 3 | National media pickup; regulatory investigation opened; financial impact > $1M; customer attrition spike |
| Level 3 | Level 4 | International media; multiple regulatory investigations; financial impact > $10M; stock price impact > 5% |
| Level 4 | Level 5 | Going concern risk; criminal investigation of leadership; mass harm confirmed; regulatory shutdown threatened |

### 2. Crisis Management Team (CMT) Structure

**Core CMT Roles**

| Role | Filled By | Primary Responsibility | Backup |
|---|---|---|---|
| CMT Leader | CEO or COO | Final decision authority, strategic direction | Deputy CEO or designated successor |
| Operations Lead | COO or VP Ops | Business continuity, operational response | Senior operations director |
| Communications Lead | CCO or VP Comms | All external and internal messaging, media | Senior communications manager |
| Legal Counsel | General Counsel | Legal exposure assessment, regulatory liaison, privilege protection | Outside counsel (pre-retained) |
| Finance Lead | CFO | Financial impact assessment, insurance, investor relations | VP Finance |
| HR Lead | CHRO | Employee safety, workforce communication, labor relations | VP HR |
| IT/Cyber Lead | CIO or CISO | Technology response, cyber incident management, forensics | IT Director |
| Business Unit Lead | Relevant BU Head | Subject matter expertise for affected area | BU deputy |
| External Advisors | Pre-retained firms | Crisis communications firm, forensic accountants, outside counsel | Identified alternates |

**CMT Activation Protocol**

| Severity Level | Activation | Assembly | Communication Mode |
|---|---|---|---|
| Level 5 | Automatic, full CMT | Immediate (within 1 hour), war room or secure virtual | Secure channel, all communications privileged |
| Level 4 | Automatic, full CMT | Within 2 hours | Dedicated crisis channel, attorney-client privilege invoked |
| Level 3 | CMT Lead activates relevant members | Within 4 hours | Designated crisis platform |
| Level 2 | Business unit lead notifies CMT Lead | Within 8 hours (assessment only) | Standard secure channels |
| Level 1 | No CMT activation | N/A | Normal escalation |

### 3. Decision Trees by Crisis Type

Each decision tree follows: **Detect --> Assess --> Decide --> Act --> Communicate --> Review**.

**3A. Operational Crisis (Supply Chain Failure, Facility Loss, Key Vendor Collapse)**

```
START: Operational disruption detected
  |
  +--> Can operations continue at >80% capacity?
  |     YES --> Level 1-2: Monitor, activate backup procedures
  |     NO  --> Proceed
  |
  +--> Is customer delivery impacted?
  |     YES --> Level 3+: Activate BCP
  |     |       +--> Backup facility available?
  |     |       |     YES --> Failover within RTO
  |     |       |     NO  --> Invoke mutual aid / emergency vendor contracts
  |     |       +--> Customer notification required?
  |     |             YES --> Activate customer communication template
  |     NO  --> Level 2: Internal remediation, enhanced monitoring
  |
  +--> Duration estimate?
        < 24 hours --> Manage internally with status updates
        24-72 hours --> CMT activated, stakeholder communication
        > 72 hours --> Level 4: Full crisis response, regulatory notification if required
```

**3B. Reputational Crisis (Negative Media, Social Media Viral, Executive Misconduct)**

```
START: Reputational threat identified
  |
  +--> Is the allegation/story true?
  |     YES --> Acknowledge, take responsibility, announce corrective action
  |     NO  --> Prepare factual rebuttal with evidence
  |     PARTIAL/UNCERTAIN --> Acknowledge concern, announce investigation, do NOT deny
  |
  +--> Is media coverage active?
  |     YES --> Activate Communications Lead
  |     |       +--> Prepare holding statement (within 1 hour)
  |     |       +--> Designate single spokesperson
  |     |       +--> Monitor media and social channels continuously
  |     NO  --> Prepare reactive statement, monitor for escalation
  |
  +--> Does it involve executive misconduct?
  |     YES --> Legal privilege immediately; board notification;
  |     |       outside counsel leads investigation; consider executive leave
  |     NO  --> Standard investigation protocol
  |
  +--> Social media velocity?
        Trending --> Activate social media war room (see Section 6)
        Contained --> Standard monitoring cadence
```

**3C. Cyber Crisis (Data Breach, Ransomware, System Compromise)**

```
START: Cyber incident confirmed
  |
  +--> Invoke incident response plan (link to cyber-risk-assessment skill)
  +--> Contain: Isolate affected systems (DO NOT power off -- preserve forensics)
  |
  +--> Is personal data affected?
  |     YES --> Start breach notification clock
  |     |       +--> GDPR: 72 hours to supervisory authority
  |     |       +--> US state laws: Varies (30-90 days; check specific state)
  |     |       +--> HIPAA: 60 days to HHS, affected individuals, media if > 500
  |     |       +--> Engage breach counsel and forensic firm
  |     NO  --> Assess operational and IP impact
  |
  +--> Is it ransomware?
  |     YES --> DO NOT pay without legal, insurance, and law enforcement consultation
  |     |       +--> Engage law enforcement (FBI IC3, local field office)
  |     |       +--> Activate offline backups
  |     |       +--> Check cyber insurance policy for ransom coverage
  |     NO  --> Standard containment and eradication
  |
  +--> Business impact?
        Critical systems down --> Activate BCP/DR; CMT Level 4+
        Non-critical systems --> Targeted remediation; Level 2-3
```

**3D. Financial Crisis (Liquidity Event, Restatement, Covenant Breach)**

```
START: Financial crisis indicator
  |
  +--> Going concern risk?
  |     YES --> Level 5: Board emergency session; engage restructuring advisor
  |     NO  --> Assess severity
  |
  +--> Covenant breach?
  |     YES --> Immediate lender notification (most agreements require prompt notice)
  |     |       +--> Engage financial advisor for waiver negotiation
  |     |       +--> Prepare covenant compliance remediation plan
  |     NO  --> Proceed to liquidity assessment
  |
  +--> Financial restatement required?
  |     YES --> Audit committee notification; SEC 8-K filing; investor communication
  |     |       +--> Engage restatement counsel and forensic accountants
  |     NO  --> Standard financial remediation
  |
  +--> Stock exchange disclosure required?
        YES --> Draft 8-K/6-K with legal counsel within required timeframe
        NO  --> Internal remediation with board reporting
```

**3E. Legal Crisis (Litigation, Regulatory Action, Government Investigation)**

```
START: Legal crisis identified
  |
  +--> Government investigation / subpoena?
  |     YES --> IMMEDIATELY invoke legal privilege on ALL related communications
  |     |       +--> Engage outside counsel with relevant expertise
  |     |       +--> Implement litigation hold (preserve ALL documents, emails, data)
  |     |       +--> DO NOT conduct internal interviews without counsel present
  |     |       +--> Board notification (audit committee)
  |     NO  --> Standard legal assessment
  |
  +--> Class action or mass litigation?
  |     YES --> Assess insurance coverage; engage mass tort counsel;
  |     |       prepare investor communication; assess disclosure obligation
  |     NO  --> Individual matter management
  |
  +--> Regulatory enforcement action?
        YES --> Cooperate unless counsel advises otherwise
        |       +--> Assess self-disclosure benefit (DOJ cooperation credit, SEC whistleblower)
        |       +--> Prepare remediation narrative
        NO  --> Monitor and prepare defensive position
```

**3F. Natural Disaster / Physical Crisis**

```
START: Physical threat detected
  |
  +--> Is there immediate danger to life?
  |     YES --> Evacuate. Call emergency services. Account for all personnel.
  |     |       NOTHING else matters until people are safe.
  |     NO  --> Assess facility and asset impact
  |
  +--> Facility accessible?
  |     YES --> Damage assessment; secure affected areas
  |     NO  --> Activate alternate work locations; remote work protocol
  |
  +--> Duration estimate?
        < 3 days --> Temporary measures; employee communication
        3-14 days --> BCP activation; customer notification
        > 14 days --> Full relocation; insurance claim; regulatory notification if applicable
```

### 4. First 24 Hours Playbook (Golden Hour Protocol)

**Hour 0-1: Detection and Initial Response**

| Action | Owner | Deliverable |
|---|---|---|
| Confirm the incident is real (not rumor/false alarm) | First responder | Incident confirmation report |
| Classify severity level (1-5) | First responder + manager | Initial severity classification |
| Notify CMT Leader | First responder | Phone call (not email) |
| Activate CMT if Level 3+ | CMT Leader | Activation notification sent |
| Invoke legal privilege if Level 4+ | General Counsel | Privilege notice to all participants |
| Secure evidence and preserve records | IT/Legal | Litigation hold if applicable |
| Draft initial holding statement | Communications Lead | Holding statement approved by Legal |

**Hour 1-4: Assessment and Mobilization**

| Action | Owner | Deliverable |
|---|---|---|
| CMT assembles (physical or virtual war room) | CMT Leader | Attendance confirmed |
| Situation briefing (facts known, facts unknown, assumptions) | Incident owner | Situation report v1 |
| Stakeholder impact assessment | All CMT members | Stakeholder impact matrix |
| Identify mandatory notification obligations | Legal Counsel | Notification checklist with deadlines |
| Assign workstreams with clear owners | CMT Leader | Workstream assignment sheet |
| Establish communication cadence (CMT update frequency) | CMT Leader | Schedule set (typically every 2-4 hours for Level 4+) |

**Hour 4-12: Containment and Communication**

| Action | Owner | Deliverable |
|---|---|---|
| Execute containment actions per decision tree | Operations/IT Lead | Containment status report |
| Issue internal communication to employees | HR Lead + Comms | Employee notification |
| Issue external holding statement if required | Communications Lead | Press release / statement |
| Notify regulators if mandatory | Legal Counsel | Regulatory notification filed |
| Notify insurance carrier | CFO / Risk Manager | Claim notification |
| Update board / audit committee chair | CMT Leader | Board briefing memo |

**Hour 12-24: Stabilization**

| Action | Owner | Deliverable |
|---|---|---|
| Updated situation assessment | CMT | Situation report v2 |
| Detailed stakeholder communication (customers, partners) | Communications Lead | Stakeholder messages sent |
| Remediation plan drafted | Relevant leads | Remediation plan v1 |
| Resource needs identified (external advisors, additional staff) | CMT Leader | Resource request |
| Media monitoring summary | Communications Lead | Media/social media report |
| Next 24-hour action plan | CMT Leader | Action plan for Day 2 |

### 5. Stakeholder Communication Templates

**5A. Employee Communication (Level 3+)**

```
Subject: Important Update -- [Brief Description of Situation]

Team,

We are aware of [brief, factual description of what happened]. We are actively
managing the situation with the following steps:

1. [Immediate action taken]
2. [What we are doing to resolve]
3. [What employees should/should not do]

Your safety and well-being are our top priority. [If physical safety: follow
evacuation/safety procedures. If cyber: change passwords, be alert for phishing.]

We will provide updates every [frequency]. Direct questions to [designated contact].

Please do NOT speak to media, post on social media about this incident, or
share information outside the company. Direct all media inquiries to [name/number].

[Signature -- CEO or appropriate senior leader]
```

**5B. Customer Communication (Level 3+)**

```
Subject: [Company Name] -- Important Notice Regarding [Issue]

Dear [Customer],

We are writing to inform you of [factual description]. We take this matter
very seriously.

What happened: [Clear, factual explanation -- no speculation]
What we are doing: [Specific remediation steps]
What this means for you: [Direct impact assessment]
What you should do: [Specific, actionable steps for the customer]

[If data breach: We are offering [credit monitoring / identity protection]
at no cost. Enroll at [link] or call [number].]

We sincerely apologize for [the inconvenience / concern this may cause].
For questions, contact [dedicated support line/email].

[Signature -- CEO or relevant executive]
```

**5C. Media Statement (Holding Statement -- Level 3+)**

```
[Company Name] is aware of [brief description]. We are taking this matter
seriously and are actively [investigating / responding / working to resolve
the situation].

[The safety of our people / the security of our customers' data / the
continuity of our operations] is our highest priority.

We are working with [relevant authorities / external experts / law enforcement]
and will provide updates as more information becomes available.

Media contact: [Name], [Phone], [Email]
```

**5D. Regulator Notification (Template)**

```
[Date]

[Regulatory Body Name]
[Address]

Re: [Notification Type] -- [Company Name] -- [Reference Number if applicable]

Dear [Title/Name],

Pursuant to [specific regulation/statute requiring notification], we are
notifying [regulatory body] of [description of incident/event].

Date of discovery: [Date]
Nature of incident: [Brief factual description]
Scope of impact: [Number of individuals/entities affected]
Immediate actions taken: [Containment measures]
Ongoing investigation: [Status and expected timeline]
Point of contact: [Name, title, phone, email]

We will provide supplemental information as our investigation progresses.

Respectfully,
[Name, Title]
```

**5E. Investor/Board Communication (Level 4+)**

```
[Confidential -- Board / Investor Communication]

Subject: [Incident Type] -- Board Briefing [Date/Time]

Situation Summary:
[2-3 sentence factual summary]

Current Status: [Contained / Active / Escalating]
Financial Impact Assessment: [Estimated range or "under assessment"]
Regulatory Exposure: [Notification obligations and status]
Legal Exposure: [Litigation risk assessment -- privileged]
Reputational Impact: [Media coverage assessment]
Insurance Coverage: [Applicable policies and status of claim]

Actions Taken:
1. [Action and owner]
2. [Action and owner]

Board Action Required:
- [Approval / oversight / decision needed]

Next Update: [Date/time]
```

### 6. Social Media Response Protocol

**Monitoring and Escalation**

| Metric | Threshold | Action |
|---|---|---|
| Mentions per hour | > 50 | Alert Communications Lead |
| Mentions per hour | > 500 | Activate social media war room |
| Sentiment score | < -0.5 (negative) | Prepare proactive response |
| Influencer amplification | > 100K follower account posts | Direct engagement consideration |
| Hashtag trending | Appears in trending topics | Full war room; executive approval on all posts |

**Response Decision Matrix**

| Post Type | Response | Timing |
|---|---|---|
| Factual question | Answer with approved facts | Within 1 hour |
| Misinformation | Correct with facts (no arguing) | Within 30 minutes |
| Emotional/angry customer | Empathize, move to DM, resolve | Within 1 hour |
| Troll/bad faith actor | Do not engage | N/A |
| Media journalist post | Redirect to media contact | Within 30 minutes |
| Employee post (policy violation) | Internal HR follow-up (NOT public correction) | Within 2 hours |

**Golden Rules for Crisis Social Media**

1. NEVER delete posts or comments (it will be screenshot and amplified).
2. NEVER argue, be defensive, or blame others.
3. ONE consistent voice -- all posts approved by Communications Lead.
4. Acknowledge the situation even if you cannot share details.
5. Provide a single link for updates (crisis landing page).
6. Pause all scheduled marketing/promotional posts immediately.

### 7. Business Continuity Activation Triggers

| Trigger | BCP Component Activated | RTO Target |
|---|---|---|
| Primary facility inaccessible > 4 hours | Alternate work location plan | 8 hours |
| Core IT system down > RTO threshold | IT disaster recovery plan | Per system classification |
| Key vendor failure (no service delivery) | Vendor contingency / alternate vendor | 24 hours |
| Workforce unavailable > 30% | Remote work / cross-training activation | 4 hours |
| Pandemic / public health emergency | Pandemic response plan | 24 hours |
| Payment systems failure | Manual payment processing | 4 hours |
| Regulatory shutdown order | Legal response + appeal + temporary cessation | Immediate compliance |

### 8. Post-Crisis After-Action Review

Conduct within 2-4 weeks of crisis resolution while memory is fresh.

**After-Action Review Structure**

| Phase | Activities | Output |
|---|---|---|
| **Data Gathering** (Week 1) | Collect all crisis logs, communications, decisions, timelines | Chronological fact base |
| **Stakeholder Interviews** (Week 1-2) | Interview CMT members, front-line responders, affected stakeholders | Interview summaries |
| **Analysis** (Week 2-3) | Timeline reconstruction, root cause analysis (5 Whys), decision assessment | Analysis report |
| **Findings Workshop** (Week 3) | CMT reviews findings, identifies improvements | Prioritized improvement list |
| **Report and Action Plan** (Week 4) | Document findings, assign improvement actions | After-action report |

**After-Action Review Template**

```markdown
## After-Action Review: [Crisis Name]

### Incident Summary
| Field | Detail |
|---|---|
| Crisis Type | [Classification] |
| Severity Level | [1-5] |
| Duration | [Start date/time -- End date/time] |
| Total Duration | [Hours/Days] |
| Financial Impact | [$X actual + $X estimated ongoing] |
| People Impacted | [Employees, customers, public] |

### Timeline of Key Events
| Date/Time | Event | Decision Made | By Whom | Outcome |
|---|---|---|---|---|
| [Timestamp] | [Event] | [Decision] | [Role] | [Result] |

### What Went Well
1. [Specific positive action or decision with evidence]

### What Did Not Go Well
1. [Specific gap or failure with evidence]

### Root Cause Analysis
[5 Whys or fishbone diagram output]

### Improvement Actions
| ID | Finding | Action | Owner | Deadline | Priority |
|---|---|---|---|---|---|
| AAR-001 | [Finding] | [Specific action] | [Role] | [Date] | [High/Med/Low] |

### Plan Updates Required
[List specific changes to crisis management plan, BCP, communication templates]
```

### 9. Crisis Simulation / Tabletop Exercise Design

**Exercise Design Framework**

| Element | Detail |
|---|---|
| **Objective** | Test specific plan components (e.g., CMT activation, communication, decision-making) |
| **Scenario Type** | Select from crisis types in Section 3 (rotate through all types over 2-year cycle) |
| **Participants** | CMT + relevant stakeholders (include board members annually) |
| **Duration** | 2-4 hours for tabletop; 4-8 hours for functional exercise |
| **Facilitator** | External facilitator recommended for objectivity |
| **Injects** | Pre-planned scenario escalations delivered at timed intervals |

**Tabletop Exercise Template**

| Phase | Duration | Activity | Inject |
|---|---|---|---|
| **Setup** | 15 min | Ground rules, scenario introduction, role confirmation | Initial scenario briefing |
| **Turn 1** | 30 min | Initial response decisions | "Media is calling. What's your statement?" |
| **Turn 2** | 30 min | Escalation and stakeholder management | "Regulator has contacted us. Social media is trending." |
| **Turn 3** | 30 min | Complications and secondary impacts | "A second incident has been discovered. An employee leaked info." |
| **Turn 4** | 30 min | Resolution and recovery decisions | "The immediate crisis is contained. What do you do next 30 days?" |
| **Hot Wash** | 30 min | Immediate participant feedback | Facilitated discussion |
| **Debrief** | 15 min | Key takeaways and next steps | Action item assignment |

**Exercise Evaluation Criteria**

| Criterion | Scoring (1-5) | Indicators |
|---|---|---|
| Detection and escalation speed | [1-5] | Time from inject to CMT notification |
| Decision-making quality | [1-5] | Decisions aligned with plan and good judgment |
| Communication effectiveness | [1-5] | Messages timely, accurate, appropriate for audience |
| Role clarity | [1-5] | Each CMT member knew their responsibilities |
| Coordination | [1-5] | Information shared across workstreams |
| Plan adherence | [1-5] | Team followed established procedures |
| Adaptability | [1-5] | Team adjusted when plan did not cover the scenario |

### 10. Reputation Recovery Roadmap

**Phase 1: Immediate (Week 1-4 Post-Crisis)**

| Action | Owner | Deliverable |
|---|---|---|
| Fulfill all commitments made during crisis | CMT Leader | Commitment tracker |
| Complete all regulatory notifications and filings | Legal Counsel | Filing confirmation |
| Launch customer remediation program (if applicable) | Business Lead | Program details and enrollment |
| Internal town hall -- transparent assessment | CEO | Town hall completed |
| Stakeholder check-in calls (top customers, partners, investors) | Relevant executives | Call log and feedback summary |

**Phase 2: Rebuild (Month 2-6)**

| Action | Owner | Deliverable |
|---|---|---|
| Publish remediation results and improvements | Communications Lead | Public update or report |
| Commission independent review (if warranted) | Board | Review engagement |
| Implement after-action review improvements | Relevant owners | Improvement progress report |
| Proactive media engagement (positive stories, executive visibility) | Communications Lead | Media plan and coverage |
| Customer and employee satisfaction pulse survey | HR / Marketing | Survey results and action plan |

**Phase 3: Sustain (Month 6-18)**

| Action | Owner | Deliverable |
|---|---|---|
| Track reputation metrics (NPS, trust scores, media sentiment) | Marketing / Communications | Monthly reputation dashboard |
| Demonstrate sustained improvement through third-party validation | Relevant function | Audit or certification |
| Share lessons learned externally (industry conferences, publications) | CEO / CMT Leader | Thought leadership content |
| Update all crisis plans based on lessons learned | Risk / CMT | Updated plans |

### 11. Legal Coordination Protocol

**What TO Say**

- Facts that are confirmed and verified
- Steps being taken to address the situation
- Commitment to transparency and accountability
- Specific remediation being offered to affected parties
- Information required by law or regulation to be disclosed

**What NOT to Say**

- Speculation about cause, scope, or blame before investigation is complete
- Admission of legal liability (distinguish "responsibility" from "liability")
- Number of affected individuals before count is confirmed
- Specific dollar amounts of damages or losses
- Anything that contradicts or could contradict regulatory filings
- Details that could compromise an ongoing investigation
- Information protected by attorney-client privilege

**Legal Privilege Preservation**

| Action | Purpose |
|---|---|
| Label all crisis communications "Privileged and Confidential -- Attorney Work Product" | Preserve attorney-client privilege |
| Route all investigation communications through counsel | Maintain privilege |
| Conduct internal investigation under legal direction | Create privileged work product |
| Separate business remediation (not privileged) from legal investigation (privileged) | Avoid inadvertent waiver |
| Do NOT forward privileged communications to third parties without counsel approval | Prevent waiver |

## Output Template

```markdown
## Crisis Management Plan: [Organization]

### Document Control
| Field | Detail |
|---|---|
| Version | [#] |
| Approved By | [CEO / Board] |
| Last Updated | [Date] |
| Next Review | [Date -- annual minimum] |
| Distribution | [Confidential -- CMT members, General Counsel, Board] |

### Crisis Classification Framework
[Severity levels 1-5 with escalation triggers]

### Crisis Management Team
[Roles, contact info, backup assignments]

### Decision Trees
[Crisis-type-specific decision trees]

### Golden Hour Protocol
[First 24 hours playbook]

### Communication Templates
[Pre-approved templates for each stakeholder group]

### Business Continuity Activation Triggers
[Trigger-response matrix]

### Reputation Recovery Roadmap
[Post-crisis recovery phases]

### Legal Coordination Protocol
[What to say / not say; privilege preservation]

### Exercise Schedule
[Annual tabletop and simulation calendar]

### Appendices
- A: CMT contact list (wallet card format)
- B: External advisor contact list (counsel, PR firm, forensics, insurance broker)
- C: Regulatory notification requirements by jurisdiction
- D: Insurance policy summary (coverage, limits, deductibles, notification requirements)
- E: Pre-approved holding statements by crisis type
```

## Quality Checks

- [ ] Crisis classification framework has 5 distinct severity levels with specific, measurable escalation triggers between each level.
- [ ] CMT roles are defined with primary and backup assignments -- no single points of failure.
- [ ] Decision trees exist for all 6 crisis types (operational, reputational, cyber, financial, legal, natural disaster) and use branching logic, not linear checklists.
- [ ] Golden hour protocol covers the first 24 hours in specific time blocks with named owners and defined deliverables.
- [ ] Stakeholder communication templates exist for all key audiences (employees, customers, media, regulators, investors/board).
- [ ] Social media response protocol includes monitoring thresholds, response decision matrix, and explicit "do not" rules.
- [ ] Business continuity activation triggers link to specific BCP components with RTO targets.
- [ ] After-action review methodology includes root cause analysis (5 Whys or equivalent), not just "lessons learned."
- [ ] Tabletop exercise design includes injects, evaluation criteria, and scoring -- not just a discussion guide.
- [ ] Reputation recovery roadmap spans 3 phases (immediate, rebuild, sustain) over 18 months minimum.
- [ ] Legal coordination protocol explicitly defines what to say and what not to say, with privilege preservation procedures.
- [ ] All templates include attorney-client privilege markings where applicable.