Crisis Response Plan

Scope, Objectives, and Activation Criteria

[Crisis types, business impact threshold, objectives, assumptions, plan owner, and dependency plans.]

Severity Levels and Decision Rights

[Severity definitions, commander authority, executive escalation, safety stop, and declaration record.]

Crisis Team and Contact Tree

[Named primary and backup roles, phone or secure channel, location, availability, and external contacts.]

First 15 Minutes

[Life safety, isolate threat, open bridge, preserve evidence, assign scribe, and first decision deadline.]

First Hour and Stabilization

[Stabilization goals, situation report cadence, technical or operational workstreams, and decision log.]

Communications and Stakeholder Messages

[Audience matrix, holding statement, approval chain, spokesperson, update cadence, and rumor control.]

Legal, Regulatory, and Customer Notifications

[Counsel assessment, regulator deadlines, customer criteria, law-enforcement interface, and privilege handling.]

Business Continuity and Workarounds

[Manual process, alternate supplier, capacity, priority customers, recovery objective, and employee welfare.]

Recovery, Evidence, and Lessons Learned

[Exit criteria, data preservation, root-cause review, corrective actions, owner, and due dates.]

Exercises, Ownership, and Review

[Tabletop scenario, exercise cadence, contact test, version, and next review.]

Measurement and Ownership