Security incidents become crises when they exceed the capacity of normal incident response procedures to contain them. The distinction matters because the response to a crisis is categorically different from the response to a routine incident. A crisis demands executive authority, organisation-wide coordination, strategic communication governance, and decision-making under conditions of incomplete information and intense pressure. Organisations that have not prepared for this transition, that assume their incident response capability will scale naturally to crisis severity, consistently find that it does not.
The objectives of crisis management are distinct from those of incident response. Where incident response focuses on technical containment and eradication, crisis management focuses on three broader outcomes: rapid stabilisation of the immediate situation to limit damage to data confidentiality, integrity, and availability; strategic oversight that ensures every action aligns with the organisation’s risk posture, compliance obligations, and stakeholder commitments; and communication control that maintains consistent, accurate messaging to every audience the crisis affects.
Organisational Structure #
A crisis requires a temporary governance structure that sits above the normal incident response function and provides the authority, the cross-functional reach, and the strategic orientation that the standard SOC hierarchy cannot supply on its own.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
