Crisis management vs Incident response

Why they differ

Incident response is the technical work to stop and fix an attack; crisis management is leadership steering the business around it.

Crisis management

Incidents & continuity

How top management leads the whole organisation through a serious event - decisions, priorities, staff, customers and press.

Formal

The leadership level of the response to a severe disruption, in which a crisis team makes business decisions, sets priorities, handles communication with staff, customers, media and authorities and starts continuity plans, while technical teams handle the incident itself.

In plain English

Like parents after a house fire - the fire brigade fights the flames, but the parents decide where the family sleeps tonight, who calls the insurer and what to tell the children.

In practice

During a ransomware attack on a Danish dairy company, the crisis team meets every three hours, decides to take orders from shops by phone, approves a press statement and chooses not to pay the ransom.

Why it matters

A serious attack is a business crisis, not only an IT problem, and slow or muddled leadership can cost more in trust than the attack itself.

Incident response

Incidents & continuity

The organised way a company spots, stops and cleans up after a security attack or accident, then gets back to normal.

Formal

A prepared cycle of phases - preparation, detection and analysis, containment, removal of the cause, recovery, and review afterwards - carried out by named people with agreed authority when a security incident occurs.

In plain English

Like a fire drill that turns into the real thing - everyone knows who calls for help, who closes the doors and who counts heads.

In practice

At three in the morning the SIEM at a municipality flags a strange login; the on-call technician locks the account, cuts the laptop off the network and calls the incident lead.

Why it matters

Minutes count during an attack, and a team that improvises loses time, evidence and money that a prepared team keeps.

Shared connections

Communication plan