What Is Cyber Crisis Management?

TL;DR

Cyber crisis management is the structured process by which organizations prepare for, respond to, and recover from cyber incidents that threaten operations, finances, or reputation. It spans three core phases: preparedness, response, and recovery. It requires coordinated action from technical, legal, communications, and executive teams. Organizations that exercise these teams together, not in isolation, are significantly better positioned to limit the damage when an incident occurs.

What Is a Cyber Crisis?

A cyber crisis has the trademarks of a regular crisis but unfurls digitally (though its repercussions may well permeate the physical world, something we’re now seeing more frequently). It is any cyber incident that might seriously impact an organization’s reputation, financial stability and business continuation; for example, a ransomware attack. The NCSC defines a cyber incident as a “breach of a system's security policy in order to affect its integrity or availability and/or the unauthorized access or attempted access to a system or systems; in line with the Computer Misuse Act (1990).”

A cyber incident becomes a cyber crisis when such a breach has the potential to cause knock-on negative impacts on the stakeholders described by PEARL. Garmin experienced a cyber crisis in July 2019 when it was crippled by WastedLocker ransomware. The smartwatch specialist had to pull the plug on various services after its internal network and production systems were encrypted, which meant customers couldn’t use its GPS-tracking devices. Garmin’s reputation was damaged after a poor PR campaign and a failure to communicate quickly and transparently with customers. It also paid a multi-million dollar ransom to decrypt its data. Thinking back to PEARL, the impacts of this cyber crisis spanned people, economy and reputation.

Types of Organizational Crisis

A crisis is a serious event that disrupts regular activity and impacts operations negatively. Three key elements must be present for a situation to be deemed a crisis:

‍

• The situation is stressful
• There is time for intervention
• There is a struggle (at some point) to manage the situation

Crises take many forms, both natural and man-made. They can arrive with little or no warning, like the SolarWinds hack, and thrust unsuspecting organizations into dangerous new territory. They can also emerge gradually like COVID-19, a classic slow-burn crisis. While some crises can be prevented, others cannot. However, the impacts of all crises can typically be lowered or managed. Consider this: the UK government earmarked pandemics on the National Risk Register in 2017, so why was the nation so ill-prepared?

Erika Hayes James, a business specialist at the University of Virginia, says there are two core types of organizational crisis:

• Sudden crisis – Circumstances that occur without warning and are beyond an institution's control. Organizations will not typically be blamed for the event, but they will be held accountable for their response. Take Malaysia Airlines for example; when flight MH370 went missing, it informed the passengers’ families via text message and was rightly ridiculed, which led to a plunge in share price. This doesn’t happen with all airline crashes.

• Smoldering crisis – Begins as a minor internal or external issue but gradually escalates to crisis level. Organizations are frequently blamed and held accountable for a lack of ability to anticipate, plan and prepare for the smoldering issue.

Two related frameworks have become widely used in crisis theory: 

• Black swan – An impactful event that comes as a complete surprise, is unforeseeable (to the extent something similar has never been witnessed, like a black swan), and is often inappropriately rationalized after the fact.

• Gray rhino – A highly likely yet ignored threat, like an approaching rhino. It is possibly staring you in the face but being overlooked due to cognitive bias, and its impacts are probably avoidable (or at least mitigatable).

Regardless of whether a crisis is preventable or caused by human/process error, it can have severe impacts spanning people, economy, assets, reputation and legal. Remember this using the acronym PEARL.

What is crisis management?

Crisis management is how an organization handles an event that threatens to harm the organization and/or its stakeholders. It was popularized as a concept in the 1980s when significant industrial and environmental disasters sparked the need for coherent response preparation. (In addition to a number of high profile crises on oil and gas platforms during this period, the Johnson and Johnson poisoned Tylenol crisis of 1982 was a defining moment, as the pharmaceuticals company enhanced its reputation thanks to its crisis response – something duly noted by other enterprises.)

Crisis management is not just about the response phase though; it seeks to minimize the damage a crisis can cause and is a comprehensive process actioned before an incident. There are three key stages of crisis management: preparedness, response and recovery.

An organization will typically have a crisis leader – the COO for example – and a crisis manager. The crisis leader is the primary decision-maker, the leader of the organizational crisis management team; the crisis manager mobilizes that unit, ensuring each stakeholder understands their role and responsibilities. In larger organizations and more tightly regulated sectors these roles may be full-time; in others, they may be filled by senior business leaders who have additional responsibility for continuity and crisis management.

Effective crisis management also means considering the recovery phase while the organization is in the midst of the crisis, thinking of it as a process of moving forward stronger rather than recovering to the pre-crisis status quo. There should be a post-mortem with members of the crisis management team and, if warranted, other internal and external stakeholders. At a minimum, post mortems should involve core crisis management team members, such as finance and legal. This is a crucial part of the recovery process and an opportunity to outline better ways of doing things in future. If an organization fails to learn anything from a crisis situation, or even a “near miss”, it has failed.

Crisis management teams

Effective pre-crisis planning is about uniting key stakeholders, experiences and skills from within (and sometimes outside) the business so that key areas are represented in the risk and crisis preparation, response and recovery processes. Core crisis management teams typically incorporate legal, PR, HR, security, finance and operations staff (IT, for example). The crisis leader should exhibit strong decision-making and situational awareness skills. It is a high-pressure role, but the dedicated crisis manager will delegate tasks to the key stakeholders operating below, particularly those in Silver (Tactical) and Bronze (Operational) response teams.

Today, the best systems are those that take a holistic approach, covering preparedness, response and recovery, viewing crises through the lens of organizational impact; however, prescriptive management systems are still commonplace, and this can lead to ineffective crisis response – especially in cyber terms.

Cyber crisis management

People are the crux of crisis management systems, especially in the remote-work environment that is fast becoming the norm. Organizational teamwork is therefore crucial. Typically, however, cyber crisis management is trained through tabletop exercises, where everyone must sacrifice time to gather around a table and discuss how they would approach a situation. Each individual represents a different part of the business or team and has their input, but not every part of the exercise is relevant. For example, legal representatives are often roped in, yet they are only required for a small part of the day.

"If I'm going through a post-incident investigation or litigation, I personally would need to make the case that I did everything in all reasonable steps to reduce the impact or prevent the risk of a cyber incident. Would I really want to stand behind a once-a-year tabletop exercise with a small subset of individuals? Absolutely not."

— Dan Potter, Senior Director of Cyber Drills & Resilience, Immersive 

The Immersive Cyber Crisis Simulator works differently, providing regular micro-drilling to build muscle memory. It has already helped organizations improve individuals' cyber crisis response skills, but it will soon unite strategic and operational teams too, with every decision impacting the next. This version will enable asynchronous participation in realistic crisis response; the relevant person for each task is simply notified when they need to make their contribution, with a full briefing on their colleagues’ decisions included. Their actions have a direct impact on the next person in the chain – a cross-organizational exercise that brings the following benefits:

• Saved time, by ensuring employees are only involved in relevant moments
• Reduced costs, by cutting logistical overheads of arranging in-person events
• Increased muscle memory, by allowing exercises to be organized and run more frequently

Ready to see how Immersive approaches cyber crisis readiness?

Immersive's Cyber Crisis Simulator enables organizations to run realistic, cross-functional crisis exercises — without the logistical overhead of traditional tabletop events. See how it works.

→ Book a demo

Cyber crisis management: FAQ

What is the difference between a cyber incident and a cyber crisis?

A cyber incident is any breach or unauthorized access to a system. It becomes a cyber crisis when the incident has the potential to cause serious harm across multiple dimensions of an organization — financial, reputational, legal, or operational — and requires a coordinated, cross-functional response.

What are the three phases of cyber crisis management?

Cyber crisis management spans preparedness (planning, exercising, and readiness before an incident), response (real-time decision-making and communication during an incident), and recovery (restoring operations, post-mortems, and continuous improvement after an incident).

Who is responsible for cyber crisis management in an organization?

Responsibility is shared across functions. The crisis leader — often the COO or CISO — makes primary decisions. The crisis manager coordinates the team. Supporting functions include legal, communications, HR, finance, security operations, and IT. In a cyber crisis, technical teams and executive leadership must work in conjunction, not in isolation.

What is a cyber crisis tabletop exercise?

A tabletop exercise is a discussion-based scenario in which crisis team members walk through a simulated cyber event to test plans, identify gaps, and clarify roles. While useful, annual tabletop exercises alone are insufficient — they do not build the hands-on muscle memory or cross-team coordination that real incidents demand.

How can organizations improve their cyber crisis management readiness?

Organizations should move from infrequent, isolated exercises to continuous, connected drills that bring technical and business teams together. Platforms like Immersive enable organizations to benchmark current capability, exercise realistic crisis scenarios across teams, and track readiness over time — giving CISOs the evidence they need to demonstrate preparedness to boards and regulators.