A crisis management plan is your organization's playbook for responding to unexpected, high-impact events. While business continuity planning prepares you for how to keep operations running, crisis management focuses on the immediate response — the critical first hours and days when decisions are made under pressure.
What Is Crisis Management?
Crisis management is the process of identifying, preparing for, and responding to events that threaten your organization's operations, reputation, or stakeholders. A crisis can be:
Operational — System failures, data breaches, supply chain collapse
Financial — Fraud, sudden loss of major client, market crash
Reputational — Negative press, social media incidents, product recalls
Natural — Earthquakes, floods, pandemics
Human-caused — Workplace violence, key person departure, strikes
Crisis Management Plan: Step by Step
1. Assemble Your Crisis Management Team
Define who leads during a crisis. Your team should include:
Crisis Manager / Incident Commander — The overall decision-maker
Communications Lead — Handles internal and external messaging
Operations Lead — Manages continuity of business functions
IT / Technical Lead — Handles system recovery and cybersecurity
Legal / Compliance — Advises on regulatory and legal obligations
HR Lead — Manages employee safety and wellbeing
Every team member should have a designated backup. Crises don't wait for convenient timing.
2. Identify and Classify Potential Crises
Not every incident is a crisis. Define clear severity levels to determine when to activate your plan:
Level | Description | Example | Response |
|---|---|---|---|
Level 1 | Minor incident | Brief system outage | Normal operations, IT resolves |
Level 2 | Significant incident | Extended outage, data loss | Department-level response |
Level 3 | Major crisis | Ransomware, facility damage | Crisis team activated |
Level 4 | Catastrophic event | Natural disaster, major breach | Full organizational response |
3. Develop Response Procedures
For each crisis scenario, document:
Immediate actions (first 30 minutes) — Assess the situation, activate the team, secure safety
Short-term response (first 24 hours) — Contain the impact, communicate with stakeholders, begin recovery
Ongoing management (days/weeks) — Sustain operations, provide updates, manage resources
Recovery and review — Return to normal operations, conduct post-incident review
4. Create a Communication Plan
Communication during a crisis is everything. Prepare templates and protocols for:
Internal communication — How do you notify employees? Through what channels?
Customer communication — Status updates, service impact, expected resolution
Media response — Who speaks to the press? What are the key messages?
Regulatory notification — Some incidents require mandatory reporting within specific timeframes
Pro tip: Draft template messages in advance. During a real crisis, you won't have time to wordsmith from scratch.
5. Establish a Command Center
Define where your crisis team will operate from. This could be:
A dedicated physical room (with backup location)
A virtual command center (video conferencing, shared documents)
A hybrid setup with both options available
Ensure the command center has independent access to communication tools, even if primary systems are down.
6. Test Your Plan Regularly
Conduct exercises at least twice a year:
Tabletop exercises — Walk through a scenario with your crisis team, discussing decisions and actions
Notification drills — Test whether you can reach all team members within your target timeframe
Simulation exercises — Practice the actual response procedures under controlled conditions
After each exercise, document lessons learned and update the plan.
Crisis Management vs Business Continuity: How They Connect
Crisis management handles the immediate response to a disruptive event. Business continuity handles the ongoing operations during and after the event. Together, they form a complete resilience strategy:
Crisis occurs → Crisis management plan activates (assess, contain, communicate)
Impact is contained → Business continuity plan kicks in (maintain critical operations)
Threat subsides → Recovery procedures restore full operations
Post-incident review → Both plans are updated based on lessons learned
Managing Crises with Sohvo
Sohvo's incident management feature helps you respond when disruptions happen. The platform connects your risk register to your processes and resources, so when an incident occurs, you can immediately see:
Which processes are affected
What resources are impacted
Who owns the response
What the expected recovery time should be
Combined with process documentation and resource dependency mapping, Sohvo gives your crisis team the information they need — fast, clear, and in one place.