- Meaning
- Steering the company in an emergency
- Elements
- Crisis team, communication, decision paths
- Related
- BCMS, incident response
- Relation to NIS2
- Required measure
- Updated
- June 2026
- Editorial team
- Compliance Compass
What is crisis management?
Crisis management is the steering of a company at leadership level when an event goes beyond normal day-to-day business and calls for fast, far-reaching decisions. It keeps the organisation able to act in a serious situation: through clear decision paths, a named crisis team and regulated communication inwards and outwards. Unlike purely operational incident handling, crisis management looks at the whole picture – reputation, legal duties, customers, staff and continuity of business – and takes the overarching decisions the technical teams need in order to work effectively.
Where technology meets leadership
While Incident response handles the technical side of an incident, crisis management coordinates at leadership level: it decides on priorities, resources and approvals, for instance whether systems are shut down, external service providers are called in or sites are evacuated. It is embedded in the BCMS, which defines and rehearses the crisis organisation in advance.
Communication is decisive
In a crisis, good communication is often just as important as the technology: towards staff, authorities, customers, partners and – particularly relevant under NIS2 – the competent authority. Prepared notification templates and clear spokesperson roles prevent contradictions and delays when you have to communicate outwards under time pressure.
A typical case: at a logistics company central systems are encrypted overnight. The crisis team convenes according to the alerting plan, decides on shutting further systems down, commissions an IT forensics specialist and approves the agreed communication. In parallel it makes sure that the early warning reaches the competent authority within 24 hours, the incident notification within 72 hours and the final report within one month.
Crisis management and NIS2
NIS2 names crisis management explicitly as a required measure among the risk management measures of Article 21. It takes effect where Business continuity and incident handling come together at leadership level, and it is closely tied to meeting the statutory reporting deadlines.
Further reading: ISO 22301 – business continuity management and crisis organisation
Frequently asked questions
What is crisis management?
Crisis management is the organisation and steering of a company at leadership level in an emergency, so that decisions, communication and measures work. Through clear decision paths, a named crisis team and regulated communication it keeps the organisation able to act in a serious situation. Unlike purely operational incident handling it looks at the whole picture: reputation, legal duties, customers, staff and continuity of business.
Is crisis management part of NIS2?
Yes. NIS2 names crisis management explicitly among the risk management measures required under Article 21. Entities in scope have to prepare crisis roles as well as escalation and communication paths, and then keep to them. That includes the reporting chain of an early warning within 24 hours, an incident notification within 72 hours and a final report within one month to the national CSIRT or the competent authority.
How does it differ from incident response?
Incident response is the technical handling of a concrete incident at operational level, such as analysing, containing and fixing an attack. Crisis management is the overarching steering at leadership level: it decides on priorities, resources, approvals and external communication, while the technical teams work the acute situation. The two interlock, because the technical side needs those overarching decisions in order to work effectively.