Objective: A crisis situation occurs If exceptional situations (e.g. natural disasters, physical attacks, pandemics, exceptional social situations, cyber-attacks causing major infrastructure failures) are severely disrupting key business operations. In such cases, the main priority of the organization is to handle the situation as gracefully as possible and recover as quickly as possible. To achieve that and since time is of the essence, switching to a crisis management mode executing pre-planned procedures having specific distribution of responsibilities and structures enables an organization to deal with such a situation is the usual approach.
Requirements (must): An appropriate planning to react to and recover from crisis situations exists.
- The required resources are available.
Responsibilities and authority for crisis management within the organization are defined, documented, and assigned.
The responsible employees are defined and qualified for their task.
Requirements (should): Methods to detect crisis situations are established.
- General indications for the existence or imminence of a crisis situation and specific predictable crisis are identified
A procedure to invoke and/or escalate crisis management is in place.
Strategic goals and their priority in crisis situations are defined and known to relevant personnel. The following aspects are considered:
- Ethical priorities (e.g., protection of life and health)
- Core business processes (e.g., processes that ensure the survival of the organization)
- Appropriate information security
A crisis management team is defined and approved. The following aspects are considered:
- Management commitment
- Composition (e.g., participation of all major functions of the organization including organization leadership (management board), business operations (production), HR, information security, corporate security, corporate emergency services, IT/cyber security, communication, finance)
- Structure and roles
- Competences of members
- Expectation and authority
- Decision making procedures
Crisis policies and procedures are defined and approved. The following aspects are considered:
- Exceptional authorities and decision-making processes beyond the crisis management team
- Primary and backup means of communication
- Emergency operating procedures
- Exceptional organizational structures (e.g., reporting, information gathering, decision making)
- Exceptional functions, responsibilities, and authority (including reporting)
- Exceptional tools
Crisis planning is reviewed and updated regularly.
Sometimes an unexpected event, such as a fire, flood, or equipment failure, can cause downtime. In order to be able to continue operations as quickly and smoothly as possible, continuity planning is carried out, i.e. planning the operations in advance for these exceptional situations.
Each continuity plan shall contain at least the following information:
The organization has a clear process, according to which it identifies the most critical functions in terms of its operations (e.g. services offered to customers), which are subject to the highest continuity requirements.
Items in the IT environment that are necessary for these activities (such as information systems, data reserves, operating processes, partners, units, hardware) are classified as critical.
Critical functions are considered with the highest priority, e.g. in continuity planning, and stricter safety requirements can be applied to them than to other objects in the environment.
The organisation has identified the tasks that are critical for the continuity of its operations. Alternative courses of action for specific exceptional situations and staff availability and contingency arrangements have been planned and prepared for the continuation of critical tasks.
To implement the continuation plans, the plan owners, their alternates and other persons required to implement the plan have been identified. In addition, their ability to carry out their tasks under normal circumstances has been ensured.
The organization has to include disaster recovery in their continuity planning. Relevant disasters for the planning are natural disasters (e.g floods, earthquake, hurricanes) and human caused disasters (e.g terror attack, chemical attack/incident, insider attack).
In disaster planning there is greater emphasis on the returning operations to normal levels safely than in continuity planning. After this focus moves to resuming normal operations.
The continuity plans must be updated at least annually or after significant changes.
Relevantit henkilöt tuntevat omaan toimintaan liittyvät jatkuvuussuunnitelmat sekä niiden tarkemmat sisällöt riittävän tarkasti ja osaavat toimia niiden mukaisesti.
The organisation should establish and maintain a comprehensive crisis management framework. This involves implementing methods to detect potential crisis situations by identifying general indicators and specific predictable crises, along with clear procedures for invoking and escalating crisis management when necessary. Strategic goals and priorities must be defined, focusing on ethical considerations for example:
A dedicated crisis management team should be formed, including representatives from all major organizational functions, with defined structures, roles, competencies, expectations, authority, and decision-making procedures.
Crisis management policies and procedures need to be developed and approved, encompassing exceptional authorities and decision-making processes, communication methods, emergency operating procedures, and organizational structures for reporting, information gathering, and decision-making.
The entire crisis management plan should be reviewed and updated regularly to ensure its ongoing effectiveness and relevance.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
