Most crisis plans describe a structure. This one settles the things that cost you time when it is real: who may decide what without asking, what threshold moves you up a level, how you come back down, and what goes in the log so the decision is still defensible six months later.
Crisis management and incident reporting are different products solving different problems, and being sold one when you needed the other is a bad afternoon. Here is the split, plainly.
| The question | Answered by | Which product |
|---|---|---|
| Is this an incident or a crisis? Who do we convene? | Activation and severity matrix | This pack |
| Who may decide what, without waking someone up? | Pre-authorised decision rights | This pack |
| How do we tell clients, staff and the public? | Stakeholder matrix + 14 statement sets | This pack |
| Is this incident major under Article 18? | The seven classification criteria | Free incident analyzer |
| What goes in the 4h / 72h / 1-month report? | The reporting technical standards | Incident Report Generator |
| How do we prove the plan works? | Exercise programme and after-action review | Crisis Exercise Programme |
| How mature are our arrangements? | 30-question assessment | Assessment toolkits |
The activation workbook tells you when to start the Article 18 assessment and deliberately refuses to perform it. One manual input starts the regulatory clock. That refusal is the boundary, made mechanical rather than merely promised.
Delay in a crisis is almost never ignorance. It is uncertainty about who may decide. The framework carries a table of pre-authorised decisions with monetary and duration limits, so the response does not queue behind an approver who is asleep.
Four levels with propositions rather than adjectives, and — the part almost every template omits — written de-escalation and stand-down criteria. Without them incidents stay nominally open for weeks and nobody ever learns anything.
Options considered. Information known to be missing. What was not chosen, and why. Those three columns are what turn a diary into evidence of reasonable judgement, and they are the three always left out.
| What is in the pack | |
|---|---|
| 01 | Crisis management framework, with pre-authorised decision rights |
| 02 | Crisis management team terms of reference, seats, deputies and quorum |
| 03 | Activation, escalation and stand-down procedure |
| 04 | Battle rhythm and meeting pack |
| 05 | Decision log and situation report, with a worked example |
| 06 | Stakeholder and communication matrix |
| 07 | Holding statements and message library — 14 scenarios |
| 08 | Spokesperson brief and hostile Q&A |
| 09 | Incident command and coordination structure |
| 10 | Third-party, group and joint coordination |
| 11 | Crisis playbooks — six scenarios |
| 12 | Stand-down and after-action review |
| 13 | Readiness checklist and maintenance calendar |
| 14 | Board and senior management escalation pack |
| 15 | Crisis role wallet cards, printable |
| 16 | Activation and notification matrix (Excel) |
Secure payment by Stripe. VAT invoice issued automatically.
A plan nobody has exercised is an untested assumption, and DORA Article 11(6) requires the continuity plans and the crisis communication plans to be tested at least yearly. Take both packs together for €249 instead of €298.
We do not ship the same file under two products, and we would rather tell you before you buy than after.
It contains a crisis communication procedure. This pack does not replace it: it is the operating annex that procedure assumes — the stakeholder register, the statement library, the spokesperson Q&A and the decision log.
See the premium library →Its last five questions told you your crisis arrangements have gaps. This is what closes them. The assessment measures; this builds.
See the assessment toolkits →The BIA tells you which services matter and how fast they must come back. This pack tells you what happens when one of them stops.
See the BIA Toolkit →No, and nothing can be. Both are guidelines documents, not requirements standards. Neither contains a conformity clause, so there is nothing for a certification body to audit against. Some non-accredited providers advertise "ISO 22320 certification in seven days"; that certificate is not recognised by any accreditation body and would not survive a supervisory conversation. What a practitioner can do is follow the process the standards set out. That is what this pack does, and "structured on" is meant literally.
Because the most valuable artefact in the whole line is the escalation ladder: the threshold at which the operational incident commander hands up to the strategic crisis cell, what the cell may decide that the commander may not, and how it hands back at stand-down. That artefact only exists if both altitudes are in the same set. Split them and you have two halves of a broken chain, and the break is exactly where real organisations fail.
Yes, for entities other than microenterprises. Article 11(7) requires one which, when the ICT continuity or the response and recovery plans are activated, sets out clear procedures to manage internal and external crisis communications in accordance with Article 14. What it does not do is say how that function is staffed or separated — the segregation duty in DORA is Article 6(4), and it concerns ICT risk management, control and internal audit, not crisis management. The framework document therefore presents its separation of roles as your own control choice rather than as a requirement, which is the distinction a supervisor will care about.
No, deliberately. See the boundary table above. This pack decides whether you are in a crisis, who commands and who must be told. The content of the initial, intermediate and final reports is governed by the reporting technical standards and is a different product.
No. That engages sanctions screening, law enforcement and legal counsel, and it is explicitly out of scope. What the pack does is stop your spokesperson answering the question badly.
Neither. No macros, and the formulas avoid dynamic arrays, so the workbook behaves identically in LibreOffice Calc and older versions of Excel.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.