A crisis is not simply a larger incident.
Many incidents can be managed through established procedures, operational teams, and clearly defined objectives. A crisis emerges when the situation begins to exceed normal management arrangements—facts are incomplete, events move quickly, consequences become more significant, and leadership decisions cannot wait for certainty.
At that point, the organization needs more than operational response. It needs direction, coordinated decision-making, clear authority, credible communication, and the ability to adapt as the situation develops.
ISO 22361 provides a principles-based approach for developing this organizational crisis management capability.
What Is ISO 22361?
ISO 22361 provides guidance for organizations seeking to establish and improve a structured crisis management capability.
It is not a universal crisis playbook and does not prescribe one fixed response model for every organization or scenario. Instead, it provides principles and a framework that organizations can adapt to their size, sector, risks, and operating environment.
Its focus is primarily the strategic crisis-management layer: recognizing potential crises, establishing leadership and authority, maintaining situational awareness, making decisions under uncertainty, coordinating stakeholders, communicating effectively, supporting recovery, and learning from experience.
It therefore complements rather than replaces disciplines such as incident response, business continuity, emergency management, and IT disaster recovery.
When Does an Incident Become a Crisis?
One of the most important practical challenges is recognizing when normal incident management is no longer sufficient.
Four signals are particularly useful:
Abnormality: The situation no longer fits established procedures or familiar patterns.
Uncertainty: Important facts are missing, but decisions cannot wait.
Pace: Events are developing faster than normal coordination and approval processes.
Visibility: Employees, customers, regulators, media, communities, or other stakeholders are paying increasing attention.
An organization should therefore be able to ask quickly:
- Does this situation still fit our established procedures?
- Must we make significant decisions despite incomplete information?
- Is the pace outrunning normal coordination?
- Is stakeholder visibility increasing?
The stronger these conditions become, the greater the need to shift from routine incident management toward crisis leadership.
Seven Principles of Crisis Management
ISO 22361 organizes crisis management around seven principles that provide leadership guardrails when conditions are unstable.
Governance
Roles, responsibilities, decision authority, alternates, and escalation paths should be established before a crisis. People need to know who leads, who participates, and who has authority to make significant decisions.
Strategy
Crisis leadership should remain focused on organizational outcomes. Leaders need clear objectives and priorities so that operational activity supports what the organization is actually trying to protect and achieve.
Risk Management
Organizations should monitor changing threats, warning signals, impacts, assumptions, and potential consequences throughout the crisis. Assessment is continuous rather than a one-time activity.
Decision-Making
Crisis decisions frequently have to be made with incomplete information. Leaders should distinguish facts from assumptions, consider options and consequences, confirm authority, document significant decisions, and revisit them when material information changes.
Communication
Communication is part of crisis control. Organizations need coordinated messages, clear ownership and approval routes, and a reliable rhythm for communicating what is known, what remains uncertain, what is being done, and when further information will be provided.
Ethics
Crisis decisions should consider human impact, safety, fairness, privacy, transparency, and accountability. How an organization behaves under pressure can affect trust long after the immediate event has ended.
Learning
Lessons need to result in change. Reviews should identify improvements, assign ownership, establish deadlines, and verify that corrective actions have actually strengthened capability.
From Principles to a Working Framework
Principles alone are not enough. They must be converted into an operating framework that people can use during a crisis.
A practical crisis management framework should connect five fundamental capabilities:
- Governance and authority
- Situational awareness
- Decision-making
- Communication
- Coordination and learning
Together, these capabilities help an organization establish control under uncertainty.
The framework should answer practical questions such as: Who can activate crisis arrangements? Who leads? How are priorities established? How is information validated? How are decisions recorded? Who approves communications? How do operational teams interact with crisis leadership? And how does the organization transition from response to recovery?
The Crisis Management Lifecycle
Crisis management should operate across a lifecycle rather than begin only after a major event has already been declared.
Anticipate — Monitor threats, trends, weak signals, recurring issues, and changing conditions.
Assess — Evaluate impact, urgency, uncertainty, exposure, and possible consequences.
Prevent or Mitigate — Take early action where possible to reduce the likelihood or consequences of escalation.
Prepare — Establish roles, authority, processes, training, resources, and exercises before they are needed.
Respond — Activate the appropriate structure, establish objectives, make decisions, coordinate activities, and communicate.
Recover — Restore essential functions and confidence while deliberately transitioning toward normal governance or a new operating state.
Improve — Review performance, implement improvements, and verify that changes actually work.
This creates a repeatable cycle rather than a crisis plan that remains unused until an emergency occurs.
How Crisis Management Fits with BCM, Incident Response, and Disaster Recovery
Crisis management does not replace specialized operational disciplines.
Incident response focuses on controlling and containing the immediate event.
Disaster recovery focuses on restoring IT services.
Business continuity focuses on maintaining critical activities and implementing continuity arrangements.
These activities can all be functioning effectively while senior leadership still faces enterprise-wide questions involving priorities, trade-offs, stakeholders, reputation, regulatory concerns, uncertainty, and strategic direction.
Crisis management provides the leadership layer that connects these efforts.
Turning Guidance into Real Capability.
Having a crisis policy or plan does not by itself demonstrate that an organization can manage a crisis.
A practical capability requires governance, processes, competent people, usable tools, leadership behavior, training, exercises, and continual improvement.
Organizations should therefore review their existing arrangements, identify gaps and conflicting responsibilities, establish clear escalation and activation criteria, confirm decision authority, develop effective information and communication processes, and exercise the resulting operating model.
Exercises are particularly important because they reveal whether documented arrangements actually work when people face uncertainty, time pressure, competing priorities, and incomplete information.
The objective is not simply to demonstrate that a plan exists. It is to build confidence that the organization can use it.
Practical First Steps
Organizations do not need to redesign everything at once. A practical starting point is to:
- Establish a concise crisis management policy and clear objectives.
- Confirm decision rights, alternates, activation authority, and escalation paths.
- Conduct a tabletop exercise that tests uncertainty, communication, coordination, and strategic decision-making.
- Select specific improvements from the exercise, assign owners, implement them, and re-test.
Crisis readiness develops through repeated preparation, practice, learning, and improvement.
Calm structure is more valuable than loud activity.
For professionals seeking a structured learning path, the online crisis management course Mastering Crisis Management with ISO 22361 develops these concepts in greater depth.
The Professional Crisis Management Toolkit provides editable resources for translating crisis management principles into practical governance, preparedness, response, recovery, exercises, validation, and continual improvement.
Independent Resource Notice: Crisis Readiness Pro resources are independently developed by Shalom David and aligned with ISO 22361 principles where applicable. They are not ISO publications and are not affiliated with, endorsed by, approved by, or certified by the International Organization for Standardization (ISO).