CRIS cheat sheet

Crisis = low-probability, high-impact event that threatens strategic objectives or viability and demands rapid decisions under high uncertainty.

Three defining attributes: a threat to high-priority goals, an element of surprise, and a short decision time window.

Incident vs. crisis: an incident is absorbed by routine resources and procedures; a crisis exceeds normal capacity and requires extraordinary mobilization and senior-level authority.

Common crisis typology: natural hazards, technological/industrial failures, malevolent acts (security, cyber, insider), and organizational/management-induced crises.

Incident command principle: one Incident Commander holds overall authority; span of control is kept to roughly 3–7 subordinates (5 is the working target).

Crisis lifecycle: pre-crisis (signal detection, prevention, preparation) → crisis (containment, response, communication) → post-crisis (recovery, learning, change).

Decision latency rule: as decision windows compress, pre-authorized decisions, checklists, and delegated authority thresholds substitute for deliberation.

High reliability organizing rests on five principles: preoccupation with failure, reluctance to simplify, sensitivity to operations, commitment to resilience, deference to expertise.

Escalation bias: commitment to a prior course of action, normalization of deviance, and ambiguous weak signals are the dominant precursors to organizational crisis.

Risk score = likelihood × consequence; the product is used to rank hazards and allocate planning, mitigation, and exercise resources.

Business impact analysis identifies time-critical activities, their internal and external dependencies, and the maximum tolerable period of disruption (MTPD) for each.

Recovery objective rule: RTO ≤ MTPD for every critical activity; RPO defines acceptable data loss and therefore backup/replication frequency.

Plan hierarchy: policy and governance → crisis management/emergency plan → functional plans (business continuity, IT disaster recovery, communications, HR) → unit procedures.

Exercise fidelity ladder: orientation/workshop → tabletop → drill → functional → full-scale; each step adds realism, participants, and logistics burden.

Exercise design sequence: objectives → scope and scenario → injects and timeline → evaluation criteria → after-action report and improvement plan.

Crisis management team baseline roles: crisis leader, operations, communications, liaison, legal, HR, finance/administration, and a scribe who logs decisions and timestamps.

Activation criteria (triggers, thresholds, who may declare a crisis) must be written in advance because escalation is slowest when it is most needed.

Plan maintenance triggers: scheduled annual review plus review after organizational change, restructuring, new third-party dependency, exercise, or actual incident.

First-hour priority order: life safety and security → scene stabilization and containment → fact-finding → activation and notification → external communication.

Holding statement content: acknowledges the event, expresses concern for those affected, states that facts are still being confirmed, and commits to a next update time.

Message discipline: one approved message map and one designated spokesperson per topic; conflicting statements from multiple voices are the principal credibility risk.

Situational Crisis Communication Theory (Coombs): match response strategy to crisis cluster - victim (deny/diminish), accidental (diminish/rebuild), preventable (rebuild, full apology).

Stakeholder prioritization: rank audiences by degree of impact and capacity to influence outcomes; that ranking sets sequence, channel, and frequency of updates.

Cadence rule: publish at fixed intervals even when no new facts exist, because prolonged silence is filled by rumor and speculation.

Empathy precedes information: audiences assess care before competence, so acknowledgment of harm comes before technical explanation.

Channel redundancy: mass notification, email, intranet, hotline, SMS, and social media must be independent so a single failure cannot isolate any stakeholder group.

Pre-approved templates (holding statement, employee FAQ, family notification, regulator notice) cut first-message latency from hours to minutes.

Recovery horizons: immediate (safety, containment, critical services, days) → short-term (business resumption, weeks) → long-term (restoration, reputation, learning; months to years).

Restoration sequencing is driven by business impact and dependency order, not by ease of repair or organizational convenience.

Demobilization rule: transition from crisis team to normal governance only when written de-escalation criteria are met and accountability is formally handed over.

Post-incident review timeline: hot wash within 24–72 hours while recall is fresh; formal after-action report with findings, root causes, and corrective actions.

Corrective actions require a named owner, due date, and tracked closure; unclosed actions are the most common failure found in later audits.

Employee support during recovery includes psychological first aid, employee assistance access, adjusted work schedules, and absenteeism contingency cover.

Financial recovery: losses, extra costs, and disruption hours are documented from the first hour to support insurance claims and business interruption recovery.

Build-back-better principle: recovery should reduce future vulnerability rather than merely reproduce the pre-event state.

Reputation recovery runs on a longer horizon than operational recovery and requires sustained evidence of corrective action, not a single statement.

Continuity management cycle: policy and program management → analysis (risk assessment, BIA) → strategy design → implementation → validation/testing → embedding and review.

ISO 22301 is the international standard for business continuity management systems and follows the plan–do–check–act continual improvement loop.

Metric relationships: MTD/MTPD is the tolerable outage ceiling; RTO is the restoration target beneath it; RPO is the tolerable data-loss window.

Continuity strategy families: redundancy (duplicate capacity), diversification (alternate suppliers/sites), relocation, absorption (buffers, inventory, workarounds), and risk transfer (insurance).

Resilience capacities: absorptive (withstand and maintain function), adaptive (adjust operations during disruption), transformative (reconfigure for the post-event environment).

Third-party dependencies need contractual recovery commitments, right-to-audit clauses, and pre-identified alternates for every single point of failure.

Validation must test dependencies and manual workarounds, not just technology recovery; plans untested end-to-end are assumptions, not capabilities.

Maturity progression runs ad hoc → repeatable → defined → managed → optimized, and is measured by evidence such as exercise results and corrective-action closure rates.