DORA Crisis Management Pack: Activation and Command

The plan you will actually use at 03:00.

What this is, and where it stops

Crisis management and incident reporting are different products solving different problems, and being sold one when you needed the other is a bad afternoon. Here is the split, plainly.

The question	Answered by	Which product
Is this an incident or a crisis? Who do we convene?	Activation and severity matrix	This pack
Who may decide what, without waking someone up?	Pre-authorised decision rights	This pack
How do we tell clients, staff and the public?	Stakeholder matrix + 56 drafted messages	This pack
Is this incident major under Article 18?	The seven classification criteria	Free incident analyzer
What goes in the 4h / 72h / 1-month report?	The reporting technical standards	Incident Report Generator
How do we prove the plan works?	Exercise programme and after-action review	Crisis Exercise Programme
How mature are our arrangements?	30-question assessment	Assessment toolkits

The activation workbook tells you when to start the Article 18 assessment and deliberately refuses to perform it. One manual input starts the regulatory clock. That refusal is the boundary, made mechanical rather than merely promised.

Three things that separate a plan from a document

Decision rights, agreed cold

Delay in a crisis is almost never ignorance. It is uncertainty about who may decide. The framework carries a table of pre-authorised decisions with monetary and duration limits, so the response does not queue behind an approver who is asleep.

Criteria you can test, including for coming down

Four levels with propositions rather than adjectives, and: the part almost every template omits: written de-escalation and stand-down criteria. Without them incidents stay nominally open for weeks and nobody ever learns anything.

A log that survives the review

Options considered. Information known to be missing. What was not chosen, and why. Those three columns are what turn a diary into evidence of reasonable judgement, and they are the three always left out.

What is in the pack
01	Crisis management framework, with pre-authorised decision rights
02	Crisis management team terms of reference, seats, deputies and quorum
03	Activation, escalation and stand-down procedure
04	Battle rhythm and meeting pack
05	Decision log and situation report, with a worked example
06	Stakeholder and communication matrix
07	Holding statements and message library: 56 drafted messages
08	Spokesperson brief and hostile Q&A
09	Incident command and coordination structure
10	Third-party, group and joint coordination
11	Crisis playbooks: six scenarios
12	Stand-down and after-action review
13	Readiness checklist and maintenance calendar
14	Board and senior management escalation pack
15	Crisis role wallet cards, printable
16	Activation and notification matrix (Excel)

€149 excl. VAT

15 Word documents, editable, with placeholders
Activation and notification matrix (Excel)
56 drafted messages: 14 scenarios × 4 audiences
Printable wallet cards for every crisis seat
Reusable on client engagements

Get the crisis pack

Secure payment by Stripe. VAT invoice issued automatically.

The capability, and the evidence that it works

A plan nobody has exercised is an untested assumption, and DORA Article 11(6) requires the continuity plans and the crisis communication plans to be tested at least yearly. Take both packs together for €249 instead of €298.

€249

both packs, excl. VAT

Get both

You may already own part of this

We do not ship the same file under two products, and we would rather tell you before you buy than after.

Policy & Procedures Pack (€69)

It contains a crisis communication procedure. This pack does not replace it: it is the operating annex that procedure assumes: the stakeholder register, the statement library, the spokesperson Q&A and the decision log.

See the premium library →

Operational Resilience Assessment (€79)

Its last five questions told you your crisis arrangements have gaps. This is what closes them. The assessment measures; this builds.

See the assessment toolkits →

Business Impact Analysis Toolkit (€149)

The BIA tells you which services matter and how fast they must come back. This pack tells you what happens when one of them stops.

See the BIA Toolkit →

Questions

Is this certified against ISO 22361 or ISO 22320?

No, and nothing can be. Both are guidelines documents, not requirements standards. Neither contains a conformity clause, so there is nothing for a certification body to audit against. Some non-accredited providers advertise "ISO 22320 certification in seven days"; that certificate is not recognised by any accreditation body and would not survive a supervisory conversation. What a practitioner can do is follow the process the standards set out. That is what this pack does, and "structured on" is meant literally.

Why one pack rather than one per standard?

Because the most valuable artefact in the whole line is the escalation ladder: the threshold at which the operational incident commander hands up to the strategic crisis cell, what the cell may decide that the commander may not, and how it hands back at stand-down. That artefact only exists if both altitudes are in the same set. Split them and you have two halves of a broken chain, and the break is exactly where real organisations fail.

Does DORA require a crisis management function?

Yes, for entities other than microenterprises. Article 11(7) requires one which, when the ICT continuity or the response and recovery plans are activated, sets out clear procedures to manage internal and external crisis communications in accordance with Article 14. What it does not do is say how that function is staffed or separated: the segregation duty in DORA is Article 6(4), and it concerns ICT risk management, control and internal audit, not crisis management. The framework document therefore presents its separation of roles as your own control choice rather than as a requirement, which is the distinction a supervisor will care about.

Will this write our supervisory incident report?

No, deliberately. See the boundary table above. This pack decides whether you are in a crisis, who commands and who must be told. The content of the initial, intermediate and final reports is governed by the reporting technical standards and is a different product.

Does it tell us whether to pay a ransom?

No. That engages sanctions screening, law enforcement and legal counsel, and it is explicitly out of scope. What the pack does is stop your spokesperson answering the question badly.

Do we need macros or a recent Excel?

Neither. No macros, and the formulas avoid dynamic arrays, so the workbook behaves identically in LibreOffice Calc and older versions of Excel.

Practitioner tools for DORA compliance teams

Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.

academy-bundle

DORA Certifications Bundle

399 € excl. VAT

academy

DORA for IT & Security Teams

199 € excl. VAT