Crisis management
Crisis management gives the organization a practised way to take command, decide and communicate when the normal structure is overloaded, which is the leadership and change capability described in 5.4 and 5.10.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names crisis management as a supporting discipline; it does not prescribe a structure. For clause 5.8 the contribution is the decision system that operates when the usual approvals are too slow. That means a defined crisis team, a delegated authority, a common picture of the situation, and a communication route to staff, customers and authorities. The discipline connects directly to the leadership attribute: a crisis team that cannot decide is a symptom of unclear roles, not a failure of the crisis plan.
Why it matters
Crises expose the difference between a plan and a capability. The plan says who is on the team. The capability shows whether those people can form a shared picture, make a trade-off and communicate it while the situation is still moving. The standard's principles put a shared purpose and a current understanding of context at the centre. A crisis team that has never practised those two things under pressure will default to escalation and delay. The discipline earns its place by rehearsing the decisions, not the documents.
What good looks like
Define the crisis team, the deputies, the decision limits and the trigger for convening. Build a common operating picture with the few facts the team needs. Practise a scenario that removes the usual leader and forces a trade-off between two core services. Record the decisions and the time taken. Change one role or one information flow after each exercise. Keep the team's contact and authority details current.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask who can commit the organization during a crisis and how that person was prepared. A team list without delegated authority will not survive the first hour.
- Crisis team charter Members, deputies, decision limits and the convening trigger
- Delegation record The authority delegated for the crisis, with the limits and the expiry
- Exercise record Scenario, decisions, time taken and the changes made
- Communication log What was said to staff, customers and authorities, and when
Where it commonly fails
- The crisis team is the executive team with no deputies and no delegated authority.
- Exercises test the plan's wording rather than a live decision.
- Communications are handled after the decisions, so staff and customers hear late.
What to do before the second edition
Run a no-notice decision exercise with the deputies in charge. Give the team two competing priorities and watch how they resolve them. The gap you see is the training plan.
Read across
← A.2 Business continuity managementA.4 Cyber security management →