# What is Crisis Management?

> Crisis management is the leadership process for handling a disruption severe enough to threaten the organization itself — coordinating decisions, communication, and stakeholders beyond any single team’s playbook.

- Canonical URL: https://yellowcube.eu/glossary/crisis-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A security incident becomes a crisis when it outgrows the incident team’s mandate: enterprise-wide outage, regulated disclosure, safety impact, or reputational threat. Crisis management convenes executives, legal, communications, and operations to make decisions — shutdown, disclosure, payment, public statements — that responders cannot make alone.

### Key points

- **Predefined decision authority:** Crisis roles, escalation thresholds, decision authority, and communication approval belong in the plan before the crisis, not negotiated during it.
- **Whole-structure exercise:** Tabletop the executive and communication path, not just the technical response — crises fail at interfaces between teams, not inside them.
- **Important limitation:** Plans choreograph response; they do not make the decisions. Under real pressure, authority gaps, legal exposure, and incomplete information still force judgment — the structure exists to make that judgment informed and accountable.

### Related terms

[Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>) · [Business continuity](<https://yellowcube.eu/glossary/business-continuity/>) · [Tabletop exercise](<https://yellowcube.eu/glossary/tabletop-exercise/>) · [Disaster recovery](<https://yellowcube.eu/glossary/disaster-recovery/>) · [Cyber resilience](<https://yellowcube.eu/glossary/cyber-resilience/>)

### Sources

[NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) · [ENISA, Cyber Crisis Management](https://www.enisa.europa.eu/topics/cyber-crisis-management)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.