Crisis Management Guide for Major Cyber Incidents

A major cyber incident stops being a technical problem the moment it threatens revenue, safety, customers or the organisation's licence to operate, and most organisations have no tested structure for leading it at that level. Incident response teams contain and eradicate; crisis management decides what the organisation does while that happens: which services to switch off, what to tell customers and regulators, whether to pay, when to restart. This guide covers the crisis layer that sits above incident response: command structures, executive decision-making, stakeholder communications, out-of-band channels for when email and collaboration tools are compromised, and exercising. It is written for CISOs, crisis and resilience leads, and executives who will sit in the room. Technical response is covered in the Incident Response Guide and is not repeated here.

Key takeaways

Crisis management is a separate layer from incident response. ISO 22361:2022 frames it as a strategic capability for top management, with its own leadership, decision-making and communication clauses.
Decide who decides before the incident. The NCSC tells boards to confirm who can take public-facing or operationally critical systems offline, including out of hours, and to name deputies.
Assume your normal channels are hostile. If the attacker holds domain admin, they can read email, Teams and the incident ticket. Pre-provision an out-of-band channel and identity that does not depend on the corporate tenant.
Communications is a workstream, not an afterthought. Customers, staff, regulators, suppliers, insurers and the media each need a named owner, an approved message and a cadence, and some notifications run on legal clocks measured in hours.
Only exercised plans work. Run at least one exercise a year with board members and key suppliers, as the NCSC recommends, and track the actions to closure.

Crisis management versus incident response and business continuity

ISO 22361:2022, Security and resilience, Crisis management, Guidelines, is the international reference for this discipline. It addresses top management with strategic responsibilities and is organised around building capability (clause 5), crisis leadership (clause 6), decision-making under the conditions a crisis team faces (clause 7), crisis communication (clause 8) and training, validation and learning (clause 9). The NCSC makes the same point from the cyber side: incident response should link to disaster recovery, business continuity and crisis management plans rather than stand alone.

Discipline	Question it answers	Typical owner	Main standard or guidance
Incident response	What is happening on our systems and how do we contain, eradicate and recover them?	CISO, SOC, IR retainer	NIST SP 800-61 Rev. 3, NCSC incident management collection
Business continuity	How do we keep prioritised services running at an acceptable level while systems are down?	Resilience or BC manager, service owners	ISO 22301:2019
Disaster recovery	How and in what order do we restore technology?	CIO, infrastructure leads	NIST SP 800-53 CP family
Crisis management	What does the organisation decide, say and accept while the incident threatens its objectives?	CEO or nominated executive, crisis team	ISO 22361:2022

The practical test for invoking crisis management is impact, not technical severity. A small intrusion with stolen customer data and a ransom demand may need the crisis team; a large malware outbreak contained in a lab may not. Write invocation criteria in business terms: a prioritised service down beyond its tolerance, regulated data exposure, safety risk, likely media coverage, a ransom or extortion demand, or a market-disclosure question. See the Business Continuity and Disaster Recovery Guide for setting those tolerances.

Command structure: gold, silver and bronze

Many UK organisations borrow the emergency services' three-tier model. In emergency doctrine these tiers are strategic, tactical and operational; JESIP doctrine defines a commander simply as someone with delegated authority to make decisions for their organisation. The British Library's own review of its 2023 Rhysida attack records that Gold and Silver crisis command ran from the attack in late October 2023 until mid-January 2024, which is a useful reminder that a cyber crisis can last months, not days.

Tier	Members (typical)	Decides	Cadence
Gold (strategic)	CEO or nominated executive, CFO, general counsel, communications director, CISO as adviser, chair of the board on call	Strategy and risk appetite, service shutdown and restart, ransom position, disclosure and regulatory stance, funding, external advisers	Twice daily early on, then daily
Silver (tactical)	Incident manager, IR lead, IT recovery lead, BC lead, legal, HR, communications lead, key service owners	How to deliver Gold's strategy: recovery order, workarounds, message drafting, supplier engagement	Every 4 to 6 hours early on
Bronze (operational)	Technical responders, service desk, site and store managers, contact centre	Execution: containment, rebuilds, manual processes, customer handling	Continuous, with shift handovers

Keep Gold small: five to seven decision-makers plus a loggist. Advisers attend for their items and leave.
Separate the CISO from the decision: the CISO briefs Gold on the technical picture and options, but the business owns the risk decision. CSF 2.0 GV.RR-01 places accountability for cybersecurity risk with organisational leadership.
Name deputies for every role: the NCSC advises at least two people and two contact methods per key contact, because people will be travelling, ill or exhausted.
Appoint a loggist: every Gold decision is recorded with time, options considered, information available and rationale. NCSC guidance stresses that recorded decisions matter for post-incident review and regulatory scrutiny.
Plan shifts from day two: a crisis lasting weeks needs rotas for Silver and Bronze, and Gold needs a designated alternate.

Executive decision-making under uncertainty

Gold will decide with incomplete and changing information. A simple, repeatable model stops meetings from becoming status updates. The JESIP Joint Decision Model runs in five stages: gather information and intelligence; assess threats and risks and develop a working strategy; consider powers, policies and procedures; identify options and contingencies; take action and review what happened. It maps well to a cyber crisis.

Decisions to pre-authorise

Decision	Pre-agree	Who can make it out of hours
Isolate the network or take a customer-facing service offline	Triggers (for example confirmed domain admin compromise, active encryption) and the services in scope	Named on-call executive plus CISO, with Gold ratification within hours
Engage IR retainer, legal counsel and insurer	Retainer numbers, insurer notification route, whether counsel directs the investigation	CISO or general counsel
Ransom or extortion position	Policy stance, sanctions screening, who may communicate with the actor	Gold only, never delegated
Regulatory and market notifications	Which regimes apply and who files	General counsel, with Gold sign-off
Restart a service	Clean-rebuild criteria, credential reset completed, monitoring in place	Gold, on Silver recommendation

Shutting down early is a valid decision: Jaguar Land Rover began shutting down its network on 31 August 2025 and paused production; a phased restart only began on 8 October 2025. See the Jaguar Land Rover cyberattack 2025. The cost of a defensive shutdown must be weighed by people who understand both the business and the threat, which is exactly the Gold role.
Ransom decisions: treat these as a structured Gold item with legal and sanctions input. See the Ransomware Payments and Sanctions Guide and the Ransomware Negotiation Guide.
Write down the working assumption: "we assume all on-premises identity is compromised until proven otherwise" changes every downstream decision, so state it explicitly and revisit it.

Out-of-band communications when email and Teams are compromised

If attackers hold privileged identity in the corporate tenant or Active Directory, they can read mailboxes, join Teams meetings and watch the incident channel. CISA's ransomware guide advises using out-of-band methods such as phone calls during containment to avoid tipping off the actor, and keeping a hard copy and an offline version of the plan. The NCSC tells organisations to consider secure or alternative communications for when the network, email or phones are unavailable, and to hold at least one conference number that is always available. In the Co-op incident, staff were reportedly told on 1 May 2025 to stop using VPNs and to be wary that communications might be monitored. See the Co-op cyber attack 2025.

Option	Strength	Weakness	Use for
Separate collaboration tenant (different identity provider, not federated to corporate)	Familiar tools, document sharing, access control you own	Must be pre-built, kept licensed and tested; accounts must not reuse corporate passwords	Gold and Silver working space
End-to-end encrypted messaging app on personal or dedicated devices	Fast, already on phones	Records retention, personal devices, membership drift; groups must be pre-created and verified	Alerts and quick coordination
Dial-in conference bridge from an external provider	Works when the network is down	Anyone with the PIN can listen; rotate PINs per incident	Gold calls, all-hands briefings
Mobile phone tree and SMS	Independent of IT	Slow, numbers go stale	Mobilising the crisis team
Printed crisis pack	No dependency at all	Goes out of date unless reissued	Contacts, roles, decision rights, first-hour checklist

The British Library used social media for public updates and email and WhatsApp for staff while core systems were down, according to its incident review. Whatever you choose, decide the rules in advance: what may be discussed on which channel, how new members are verified (a call back to a known number, not a message from an unknown account), and how decisions taken there are logged.

Where identity fits

The out-of-band channel is only as independent as the identities behind it. If the crisis tenant's administrator signs in through corporate single sign-on, or the recovery email for the messaging group is a corporate mailbox, an attacker with corporate control can reach it. Give crisis-team accounts their own identity provider or local accounts with phishing-resistant MFA, keep break-glass credentials for corporate systems offline, and include the crisis platform in the post-incident credential reset. See the Break-Glass Account Guide and the Identity Incident Response Playbook.

Stakeholder communications: customers, regulators, media and staff

The NCSC board toolkit asks boards to make sure a communications plan names who delivers the corporate message internally and externally, covers employees, customers, shareholders, suppliers and regulators, notifies customers where service impacts are expected and provides regular updates. The template for messages, owners and approvals belongs in the Incident Communication Plan Template; the crisis team's job is to run it.

Audience	Owner	First message	Clock to watch
Staff	HR and internal comms	What is affected, what to do and not do, which channel is trusted, welfare support	Before external statements, so staff do not learn from the news
Customers	Customer or commercial director	Service impact, workarounds, what data may be affected, how you will contact them (and how you will not, to blunt phishing)	Contractual notification clauses; data breach notification to individuals where required
Data protection regulator	DPO and general counsel	Initial notification with known facts, follow-ups as facts emerge	UK and EU GDPR Article 33: without undue delay and where feasible within 72 hours of becoming aware
Sector or NIS regulator, CSIRT	General counsel or compliance	Early warning, then fuller notification	NIS2 Article 23: early warning within 24 hours, notification within 72 hours, final report within one month (EU)
Investors and markets	CFO and company secretary	Disclosure once materiality is determined	US SEC Form 8-K Item 1.05: generally four business days after determining materiality
Media	Communications director, one spokesperson	Holding statement: what happened, what you are doing, where updates will appear	Within hours if the incident is visible to the public
Suppliers and partners	Procurement and IT	Whether to suspend connections, indicators to check	As soon as connections may be a path in or out
Insurer, police, national agencies	General counsel and CISO	Notification per policy, crime report, NCSC or CISA report	Policy notification windows

Say only what you know: early statements that rule out data theft are the ones most often corrected later. Use "our investigation is ongoing" and commit to an update time.
One source of truth: a single fact sheet maintained by Silver, approved by Gold, from which every message is drafted. Statements to regulators, customers and media must not contradict each other.
Prepare for impersonation: breach news triggers phishing that claims to come from you. Tell customers which channels you will use.

See the UK Cyber Security and Resilience Bill Guide for how UK reporting duties are expected to change.

The first 24 hours and the long tail

Hour 0 to 1, mobilise: the incident manager invokes the crisis plan against the written criteria, calls the crisis team over the out-of-band channel, starts the decision log and confirms who is Gold.
Hour 1 to 2, first Gold meeting: situation, working assumptions, immediate decisions (isolation, service shutdown, retainer and counsel engagement, insurer notification), first internal message.
Hour 2 to 6, structure: Silver sets workstreams (technical response, business continuity, communications, legal and regulatory, people), each with an owner and a reporting time. BC owners invoke manual workarounds; see the Degraded-Mode Operations and Manual Workarounds Guide.
Hour 6 to 24, external: holding statement, regulatory clocks assessed and started, customer messaging, supplier decisions, battle rhythm agreed for the next days.
Day 2 onward, sustain: rotas, welfare checks, weekly strategic review of recovery order and the ransom position, restart criteria agreed with Silver. The NCSC board guidance highlights staff morale and workload during prolonged incidents, and the British Library lists staff and user wellbeing among its lessons.
Stand-down: Gold formally hands back to business-as-usual governance, with recovery tracked as a programme and a post-incident review scheduled.

Exercising the crisis team

The NCSC recommends exercising regularly, from tabletop discussion to deeper simulation, with board members as players or observers, partners and suppliers involved, scenarios drawn from the risk register and a report on lessons learned. Its free Exercise in a Box offers micro exercises and tabletop exercises, 20 in total across 12 topics including ransomware, phishing and supply chain. CISA's Tabletop Exercise Packages provide more than 100 scenarios with facilitator templates and an after-action report template.

Exercise type	Who plays	Tests	Frequency (suggested)
Executive tabletop	Gold, board observer	Decision rights, ransom stance, disclosure, media handling	Annually at minimum
Silver functional exercise	Silver, IR retainer, comms	Workstream setup, fact sheet, notification drafting against real clocks	Twice a year
Out-of-band drill	Whole crisis team	Can everyone join the crisis channel within 30 minutes with corporate identity disabled?	Quarterly, unannounced
Full simulation with injects	Gold, Silver, Bronze, key suppliers	End-to-end coordination over hours, shift handover	Every one to two years

See the Tabletop Exercise Guide for design and facilitation, and the Tabletop Exercise Scenario Pack for ready-made scenarios. Include at least one inject that removes email and Teams, and one where a key executive is unreachable.

Detection, measurement and readiness metrics

Crisis management has no SIEM rule, but its triggers come from detection. Make sure the SOC's escalation criteria reach the incident manager quickly (CSF 2.0 RS.MA-04, incidents are escalated or elevated as needed), and that logs survive for the post-incident review: the NCSC asks boards to confirm system and network logs are collected even where monitoring is limited. Track readiness with:

Time to assemble: minutes from invocation to a quorate Gold call on the out-of-band channel (target under 60).
Contact accuracy: percentage of crisis pack contacts that answered in the last drill (target 95% or more).
Exercise coverage: share of Gold members and deputies who played in an exercise in the last 12 months (target 100%).
Action closure: percentage of exercise and post-incident actions closed by their due date.
Notification timeliness: in exercises and real incidents, time from awareness to draft regulator notification against the applicable clock.
Plan currency: days since the crisis pack and contact list were last reissued in print and offline form.

Framework mapping

Framework	Reference	Relevance
ISO 22361:2022	Clauses 5 to 9	Crisis capability, leadership, decision-making, communication, training and learning
NIST CSF 2.0	GV.RR-01, ID.IM-04, RS.MA-01, RS.MA-04, RS.CO-02, RS.CO-03, RC.CO-03, RC.CO-04	Leadership accountability, plans maintained, coordinated execution, escalation, stakeholder notification, recovery and public communication
NIST SP 800-53 Rev. 5	IR-3, IR-4, IR-6, IR-8, CP-2, CP-11	Testing, incident handling, reporting, IR plan, contingency plan, alternate communications protocols
ISO/IEC 27001:2022 Annex A	5.24, 5.26, 5.29	Incident management planning, response, information security during disruption
CIS Controls v8.1	Control 17	Incident response management, including contact information and exercises

Common failure patterns

Running the crisis on the compromised tenant: the crisis call is a Teams meeting the attacker can join. Build and drill the out-of-band channel before you need it.
Nobody authorised to switch things off: responders wait hours for an executive to approve isolation while encryption spreads. Pre-authorise shutdown triggers and out-of-hours decision makers.
Premature reassurance: a first statement rules out data theft, and a later one has to retract it. In the Co-op case, early reporting described attempted access, and the organisation later confirmed that data for all 6.5 million members had been taken.
Gold becomes a technical bridge: executives watch log analysis instead of deciding on services, customers and money. Keep technical detail in Silver.
No plan for duration: teams are exhausted by day five because nobody set rotas. The British Library ran Gold and Silver command for around eleven weeks.
Restart without identity cleanup: services come back on the same compromised credentials. Make credential and service-account reset a Gold restart criterion; see the Ransomware Response and Recovery Guide.

Lessons from incidents

Jaguar Land Rover, 2025: a network shutdown at the end of August led to a production pause of more than five weeks, a £1.5 billion UK government loan guarantee announced on 28 September, and a Cyber Monitoring Centre estimate of £1.9 billion cost to the UK economy. Crisis decisions extended to suppliers and government, not just IT. See the Jaguar Land Rover cyberattack 2025.
Change Healthcare, 2024: disconnecting systems to contain the attack disrupted claims, eligibility checks and pharmacy payments across the US for weeks, pushing cash-flow problems onto customers. A crisis team has to plan the downstream effects of its own containment decisions. See the Change Healthcare breach 2024.
British Library, 2023: its published review lists regular practice of business continuity for total system outage, board-level cyber expertise and staff wellbeing among its lessons, and is one of the most candid public accounts of a cyber crisis.

Practitioner checklist

Write crisis invocation criteria in business-impact terms and agree them with the executive team.
Name Gold, Silver and Bronze roles with at least one deputy each, two contact methods per person, and a loggist.
Pre-authorise isolation and service shutdown triggers, including who decides out of hours.
Build an out-of-band crisis channel on an identity independent of the corporate tenant, and drill it quarterly with corporate identity disabled.
Issue a printed and offline crisis pack: contacts, roles, decision rights, first-hour checklist, retainer, counsel and insurer numbers.
Map every notification regime that applies (GDPR, NIS2 or UK NIS, SEC, sector regulators, contracts) with owners and clocks.
Prepare holding statements and a fact-sheet template, and agree a single spokesperson.
Run an executive tabletop at least annually with a board member and a key supplier, and track actions to closure.
Make credential and non-human identity reset a formal restart criterion.
Plan rotas and welfare support for an incident lasting weeks.

Crisis Management Guide: Leading the Organisation Through a Major Cyber Incident