{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/crisis-management","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/crisis-management/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/crisis-management/"},"term":{"en":"Crisis management","da":"Krisestyring"},"aka":{"en":["crisis response"],"da":["krisehåndtering","kriseledelse"]},"domain":["security"],"cluster":"incident-response","layer":"governance","status":"current","summary":{"en":"How top management leads the whole organisation through a serious event - decisions, priorities, staff, customers and press.","da":"Hvordan topledelsen leder hele organisationen gennem en alvorlig begivenhed - beslutninger, prioriteter, medarbejdere, kunder og presse."},"body":{"formal":{"en":"The leadership level of the response to a severe disruption, in which a crisis team makes business decisions, sets priorities, handles communication with staff, customers, media and authorities and starts continuity plans, while technical teams handle the incident itself.","da":"Ledelsesniveauet i reaktionen på en alvorlig forstyrrelse, hvor en krisestab træffer forretningsbeslutninger, sætter prioriteter, håndterer kommunikation med medarbejdere, kunder, medier og myndigheder og sætter kontinuitetsplaner i gang, mens de tekniske teams tager sig af selve hændelsen."},"plain":{"en":"Like parents after a house fire - the fire brigade fights the flames, but the parents decide where the family sleeps tonight, who calls the insurer and what to tell the children.","da":"Som forældrene efter en husbrand - brandvæsenet slukker ilden, men forældrene beslutter, hvor familien skal sove i nat, hvem der ringer til forsikringen, og hvad børnene skal have at vide."},"inPractice":{"en":"During a ransomware attack on a Danish dairy company, the crisis team meets every three hours, decides to take orders from shops by phone, approves a press statement and chooses not to pay the ransom.","da":"Under et ransomware-angreb på et dansk mejeri mødes krisestaben hver tredje time, beslutter at tage imod butikkernes ordrer pr. telefon, godkender en pressemeddelelse og vælger ikke at betale løsesummen."},"whyItMatters":{"en":"A serious attack is a business crisis, not only an IT problem, and slow or muddled leadership can cost more in trust than the attack itself.","da":"Et alvorligt angreb er en forretningskrise og ikke kun et IT-problem, og langsom eller rodet ledelse kan koste mere i tillid end selve angrebet."}},"deepDive":{"en":"ISO 22361:2022 treats a crisis as an abnormal and unstable situation that threatens an organisation's strategic objectives, reputation or viability, and distinguishes crisis management from incident management by the nature of the problem rather than its size. Incidents are handled with prepared procedures; a crisis is characterised by high uncertainty, novelty, time pressure and conflicting interests, so it has to be managed with judgement and decision-making rather than by following a plan step by step. Many cyber incidents never become crises, while a modest data leak can become one if it involves vulnerable people, public outrage or regulatory scrutiny.\n\nThe typical structure is layered. A strategic crisis management team of senior executives decides on priorities, trade-offs and external positions; a tactical level coordinates resources across functions; and operational teams, including the incident response team, carry out the work. The UK emergency services' gold, silver and bronze command model is a common reference for these tiers. The crisis team works in a fixed rhythm of meetings, each opening with a common situation picture, reviewing actions from the previous cycle and ending with decisions recorded in a decision log with rationale, so that choices made under uncertainty can be explained afterwards to boards, auditors and regulators.\n\nCyber crises bring specific decisions to the table: whether to disconnect from the internet or shut down production, whether to pay or negotiate a ransom (with sanctions, legal and insurance constraints), when to involve the police and the national CSIRT, what to tell customers before the facts are known, and how to keep delivering critical services. Norsk Hydro's response to the LockerGoga ransomware in 2019, with manual production and daily open press briefings, and Maersk's recovery from NotPetya in 2017 are frequently cited cases of crisis management that preserved trust despite severe operational damage.\n\nNIS2 Article 21(2)(c) names crisis management alongside business continuity as a required measure, and Article 20 makes the management body responsible for approving and overseeing cybersecurity risk-management measures and requires its members to undergo training. At EU level, Article 16 establishes EU-CyCLONe to coordinate large-scale cybersecurity incidents and crises between member states. Crisis management differs from incident response in that incident response contains and eradicates the technical cause, while crisis management steers the organisation through the business, legal and reputational consequences; the two run in parallel and need a clear interface, usually an incident lead who briefs the crisis team.","da":"ISO 22361:2022 beskriver en krise som en unormal og ustabil situation, der truer en organisations strategiske mål, omdømme eller levedygtighed, og skelner mellem krisestyring og hændelseshåndtering ud fra problemets karakter frem for dets størrelse. Hændelser håndteres med forberedte procedurer; en krise er kendetegnet ved stor usikkerhed, noget nyt, tidspres og modstridende interesser, så den skal styres med dømmekraft og beslutninger frem for ved at følge en plan trin for trin. Mange cyberhændelser bliver aldrig til kriser, mens et beskedent datalæk kan blive det, hvis det rammer sårbare personer, skaber offentlig harme eller trækker tilsynsmyndigheder til.\n\nDen typiske struktur er lagdelt. En strategisk krisestab af topledere beslutter prioriteter, afvejninger og eksterne holdninger; et taktisk niveau koordinerer ressourcer på tværs af funktioner; og operative teams, herunder teamet for hændelseshåndtering, udfører arbejdet. De britiske beredskabers gold-, silver- og bronze-kommandomodel er en udbredt reference for de tre niveauer. Krisestaben arbejder i en fast mødekadence, hvor hvert møde åbner med et fælles situationsbillede, gennemgår handlingerne fra sidste runde og slutter med beslutninger, der skrives i en beslutningslog med begrundelse, så valg truffet under usikkerhed senere kan forklares for bestyrelse, revisorer og tilsynsmyndigheder.\n\nCyberkriser bringer særlige beslutninger på bordet: om organisationen skal kobles fra internettet eller produktionen standses, om der skal betales eller forhandles om en løsesum (med begrænsninger fra sanktioner, lovgivning og forsikring), hvornår politiet og det nationale CSIRT skal inddrages, hvad kunderne skal have at vide, før fakta kendes, og hvordan kritiske ydelser fortsat leveres. Norsk Hydros håndtering af ransomwaren LockerGoga i 2019 med manuel produktion og daglige åbne pressebriefinger og Maersks genopretning efter NotPetya i 2017 nævnes ofte som eksempler på krisestyring, der bevarede tilliden trods alvorlig driftsskade.\n\nNIS2 artikel 21, stk. 2, litra c, nævner krisestyring sammen med driftskontinuitet som en påkrævet foranstaltning, og artikel 20 gør ledelsesorganet ansvarligt for at godkende og føre tilsyn med foranstaltningerne til styring af cybersikkerhedsrisici og kræver, at dets medlemmer deltager i uddannelse. På EU-niveau opretter artikel 16 EU-CyCLONe til at koordinere cybersikkerhedshændelser og -kriser i stor skala mellem medlemslandene. Krisestyring adskiller sig fra hændelseshåndtering ved, at hændelseshåndteringen inddæmmer og fjerner den tekniske årsag, mens krisestyringen styrer organisationen gennem de forretningsmæssige, juridiske og omdømmemæssige konsekvenser; de to kører parallelt og kræver en klar snitflade, typisk en hændelsesleder, der orienterer krisestaben."},"edges":[{"type":"requires","to":"security/business-continuity-plan","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/incident-response","why":{"en":"Incident response is the technical work to stop and fix an attack; crisis management is leadership steering the business around it.","da":"Hændelseshåndtering er det tekniske arbejde med at stoppe og udbedre et angreb; krisestyring er ledelsens styring af forretningen omkring det."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/management-responsibility","confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 7 og Ordliste (BCP, Kommunikationsplan)","tier":"course-material"},{"title":"ISO 22361:2022 - Security and resilience - Crisis management","tier":"standard"}],"draft":true}