What Is Crisis Management? Stages, Planning and a Plan Template

Crisis management is the process an organization uses to prepare for, respond to and recover from a sudden event that threatens its people, operations, assets or reputation. It covers the plan you write before anything happens, the decisions and actions you take during the event, and the review and recovery that follow.

This guide explains what crisis management means, the stages of a crisis, the types of crisis employers plan for, and how to build a crisis management plan, with a template you can adapt, the roles your crisis team needs and the skills that make the difference on the day.

Book a call with our team

Crisis management definition

ISO 22361, the international guideline on crisis management, describes it as the coordinated activities used to lead, direct and control an organization during a crisis. In practice, that means three things:

• Being ready: knowing your biggest risks, having a plan, and having a trained team who knows what to do.

• Responding well: recognizing a crisis early, taking control, protecting people first and communicating clearly.

• Recovering and learning: getting operations back to normal, supporting employees and improving the plan.

Crisis management is a leadership discipline, not one department's job, and it works best when teams have practiced together.

What counts as a crisis?

A crisis is an event that is unexpected, threatens something important to the organization and needs urgent decisions, often with incomplete information. A burst pipe in one office is an incident. A hurricane that closes several sites, cuts power and leaves you unsure where all your employees are is a crisis. The difference is scale, uncertainty and the need for senior decisions.

How crisis management differs from related disciplines

The terms overlap, and most organizations need all of them working together.

Discipline	Main question	Typical owner
Risk management	What could go wrong, and how do we reduce the chance or impact?	Risk, finance or compliance
Emergency management	How do we protect life and property in the first minutes and hours?	Facilities, security, health and safety
Crisis management	How do leaders make decisions and coordinate the whole organization through a serious event?	Executive crisis team
Business continuity	How do we keep critical services running, or restore them, during and after disruption?	Operations or continuity lead
Crisis communication	What do we tell employees, customers, media and others, and when?	Communications

Why crisis management matters

The purpose of crisis management is to limit harm. A crisis puts pressure on every part of an organization at once, and without a plan people improvise, decisions stall and important steps get missed. Good crisis management helps you:

• Protect people: employees, contractors, visitors and customers come first in every crisis.

• Make faster decisions: pre-agreed roles and decision rights stop the response from waiting on meetings.

• Keep operating: linking the response to business continuity keeps critical services running.

• Protect trust and reputation: a calm, honest and visible response is often remembered longer than the event itself.

• Meet your duty of care: employers have legal and moral responsibilities to their people, which our guide to duty of care explains.

• Learn and improve: every crisis and every exercise makes the next response better.

Types of crisis

Organizations face many kinds of crisis, and most plans group them so the response can be prepared in advance. The table below shows common types and what usually needs to happen first.

Type of crisis	Examples	First priorities
Natural disasters and severe weather	Hurricanes, tornadoes, wildfires, floods, winter storms, earthquakes	Warn people in the affected area, confirm they are safe, decide on closures or shelter-in-place
Technological	Cyberattacks, ransomware, data breaches, major IT or phone outages	Contain the problem, switch to backup communication channels, involve IT and legal
Security and violence	Active threats, civil unrest, terrorism, threats against staff	Alert people nearby, lock down or evacuate, coordinate with law enforcement
Health	Disease outbreaks, contamination, serious workplace injuries	Protect and support affected people, follow public health guidance
Operational	Fires, explosions, utility failures, supply chain disruption	Evacuate if needed, activate continuity plans, update customers
Financial	Sudden losses, fraud, loss of a major customer	Assess exposure, brief leadership and investors, control messaging
Reputational	Product failure, misconduct allegations, viral social media backlash	Establish facts quickly, prepare statements, brief employees before the public
Personnel and leadership	Loss of a key leader, serious misconduct, labor disputes	Confirm deputies and decision rights, communicate internally
Travel and international	Staff caught up in unrest, disasters or border closures abroad	Locate travelers, provide guidance, arrange support or evacuation

Severe weather is one of the most common triggers for employers, and our inclement weather policy guide covers how to plan for closures, remote work and staff safety.

The stages of crisis management

Different organizations describe the stages of crisis management in different ways. Some use three stages, some four and some five, but they all describe the same cycle: get ready, respond, recover and improve. This table shows how the common models line up.

Three stage model	Four stage model	Five stage model	What happens
Pre-crisis	Pre-crisis (mitigation)	Prevent	Identify risks and reduce them where you can
Pre-crisis	Pre-crisis (mitigation)	Prepare	Write the plan, form the team, train and exercise
Crisis response	Crisis (the event)	Identify	Spot the event early, assess it and activate the plan
Crisis response	Response	Respond	Protect people, coordinate actions and communicate
Post-crisis	Post-crisis (recovery)	Recover	Restore operations, support people and review lessons

1. Prevention and mitigation

Start with a risk assessment. List the events most likely to affect your people, sites, operations and reputation, and estimate their impact. Then reduce what you can: better building security, backup systems, travel approval processes, or clear lone working procedures. Keep watching for early warning signs, such as severe weather forecasts, local unrest or threats reported near your locations.

2. Preparedness

Preparation turns your risk assessment into a usable response. Write the crisis management plan, appoint the crisis team and deputies, agree how you will contact employees, and prepare message templates. Then train people and test the plan through exercises, because a plan nobody has practiced rarely works as written.

3. Identification and activation

Many crises are made worse by a slow start. Define clear activation triggers, such as a threat to life, closure of a site, loss of critical systems or an event likely to attract media attention. When a trigger is met, the first person to know should be able to escalate quickly, and the crisis lead decides whether to activate the plan.

4. Response

The response stage is about control. Establish the facts, protect people first, assign actions with owners and deadlines, and set a regular rhythm of briefings. Communication runs through everything: employees need clear instructions, leaders need a shared picture, and customers, partners and the media need accurate, timely updates.

5. Recovery and learning

Once the immediate threat has passed, restore normal operations, support affected employees and stakeholders, and hold a post-incident review, often called an after-action review. Record what worked, what did not and who owns each improvement, then update the plan. The end of one crisis is the start of preparing for the next.

Key principles of crisis management

Whatever the event, the best responses tend to share the same principles:

• People first: life safety comes before property, systems or reputation.

• Act early: it is better to activate the plan and stand down than to activate too late.

• Clear command: one crisis lead, clear decision rights and named deputies.

• One version of the facts: a shared, regularly updated picture for everyone on the team.

• Communicate often: say what you know, what you do not know yet and when you will update next.

• Keep a record: log decisions, actions and messages with times, for review and accountability.

• Flex the plan: the plan is a framework, not a script, so adapt it to the situation in front of you.

How to build a crisis management plan

A crisis management plan is a documented playbook that sets out how your organization will respond to a serious event: who is in charge, how decisions are made, how people are contacted and what happens in the first hours. These steps work for most employers.

1. Get leadership backing: agree the plan's scope and who has authority to activate it.

2. Assess your risks: list likely crisis scenarios and rank them by likelihood and impact.

3. Analyze business impact: identify critical services, how long you can do without them and what they depend on.

4. Form your crisis team: appoint a lead, core members and deputies for every role.

5. Set activation triggers and escalation: define what makes an event a crisis and how it reaches the crisis lead.

6. Write response procedures: create short, scenario-based checklists for your highest risks.

7. Plan communication: set up contact lists, channels, message templates and approval steps.

8. Link to other plans: connect to your OSHA emergency action plan, business continuity plan and IT recovery plans so they do not contradict each other.

9. Train and exercise: run tabletop exercises and drills so the team has practiced before a real event.

10. Review and update: update the plan at least once a year and after every crisis, exercise or major change.

Crisis management plan template

Use this template as a starting point and adapt each section to your organization. Keep the final plan short enough to use under pressure, with detail in appendices.

Plan section	What to include	Example entry
Purpose and scope	What the plan covers and which sites, teams and countries	All US offices, field teams and traveling employees
Activation triggers	Events that activate the plan and who can activate it	Threat to life, site closure over 4 hours, major data breach
Crisis team	Names, roles, deputies and 24/7 contact details	Crisis lead: COO. Deputy: Head of Operations
Escalation process	How an incident reaches the crisis lead and how fast	Site manager calls security desk, security calls crisis lead
Command center	Where the team meets, physically and virtually	Boardroom at HQ, backup video bridge
Risk scenarios	Short response checklists for your top risks	Severe weather, cyberattack, active threat, travel incident
People and accountability	How you locate, warn and account for every employee	Alert all staff in the affected area and track safety replies
Communication plan	Audiences, channels, spokespeople, templates and sign-off	Holding statement approved by CEO and legal
Stakeholder contacts	Emergency services, insurers, suppliers, landlords, key customers	List held by the crisis coordinator, checked quarterly
Business continuity links	Critical services, recovery times and workarounds	Customer support moves to the backup site within 24 hours
Decision and action log	How decisions and actions are recorded	Timestamped log kept by the crisis coordinator
Recovery and stand-down	How you return to normal and support staff	Employee assistance program offered to all affected staff
Review and testing	Exercise schedule and plan owner	Annual tabletop, plan reviewed every 12 months

The first hour: a crisis response checklist

The first hour often decides how the rest of the crisis goes. A simple timeline helps the team move fast.

Time	Action
First 15 minutes	Confirm the basic facts, alert people at immediate risk and notify the crisis lead
By 30 minutes	Activate the plan if a trigger is met, assemble the crisis team and start the decision log
By 45 minutes	Send clear instructions to affected employees and start tracking who has confirmed they are safe
By 60 minutes	Brief leadership, issue a holding statement if needed and agree the time of the next update

The crisis management team and roles

Your crisis management team is the small group of senior people who lead the response. It usually includes representatives from leadership, operations, security, HR, communications, IT and legal. Every role needs a named deputy, because crises do not wait for people to be available.

Role	Responsibilities
Crisis lead	Activates the plan, sets priorities and makes final decisions
Deputy crisis lead	Steps in if the lead is unavailable and runs the team on long events
Crisis coordinator	Runs the command center, keeps the decision and action log and tracks tasks
Security or safety lead	Assesses threats, coordinates with emergency services and protects people and sites
HR lead	Accounts for employees, supports families and arranges wellbeing support
Communications lead	Prepares internal and external messages and briefs the spokesperson
Operations and continuity lead	Keeps critical services running and manages recovery
IT lead	Protects systems and data and keeps communication channels working
Legal and compliance lead	Advises on legal duties, regulators, liability and disclosure
Spokesperson	Speaks for the organization to the media and the public

What does a crisis manager do?

A crisis manager leads the crisis team and makes sure the plan is ready before anything happens. During a crisis, the crisis manager assesses the situation, activates the plan, coordinates internal teams and outside agencies, and keeps the response focused on agreed priorities. Afterwards, they run the review and own the plan updates. In smaller organizations this is often the CEO or COO.

Crisis management skills

Crisis management skills can be learned and practiced. The people who handle crises well tend to share these abilities:

• Calm decision-making: making sound, timely decisions with incomplete information.

• Clear communication: giving short, plain instructions and updates that people can act on.

• Situational awareness: building and maintaining a clear picture of what is happening and where.

• Prioritization: focusing the team on what matters most, starting with people.

• Delegation and teamwork: assigning tasks with clear owners and trusting people to deliver.

• Empathy: recognizing the stress and fear that employees, families and customers feel.

• Adaptability: changing course when the situation or the facts change.

• Learning: reviewing honestly afterwards and turning lessons into improvements.

Communicating during a crisis

Communication is part of every stage of crisis management. Employees need to know what to do, leaders need accurate information and external audiences need honest, timely updates. Prepare message templates for your main scenarios, use several channels so messages get through, give people a way to reply, and brief employees before or alongside any public statement. Our full guide to crisis communication covers how to write and send crisis messages in more detail. Many organizations use a crisis management platform so that alerts, replies and updates all run from one place.

How to test your crisis management plan

FEMA's Homeland Security Exercise and Evaluation Program (HSEEP) groups exercises into discussion-based and operations-based types, and both have a place in crisis management.

• Tabletop exercise: the crisis team talks through a realistic scenario and the decisions it would make. Low cost and a good place to start.

• Drill: tests one specific function, such as sending an alert to all staff and tracking replies.

• Functional exercise: the team runs the response from its command center in real time, without deploying people in the field.

• Full-scale exercise: a realistic, multi-team response, often with emergency services involved.

After every exercise, ask a few honest questions. Were roles clear? How long did it take to activate the plan? Did every employee receive the alert, and how quickly could you account for them? Were decisions and actions recorded? What needs to change in the plan?

Crisis management examples

These scenarios show how crisis management works in practice for an employer.

• Hurricane approaching a regional office: the crisis team monitors the forecast, activates the plan when a warning is issued, closes the office, tells staff in the affected area to work from home or move to safety, and checks in with everyone after the storm passes.

• Ransomware attack: email and phones go down, so the team switches to backup channels it set up in advance, contains the attack with IT, informs legal and insurers, and keeps employees and customers updated on what they should do.

• Active threat near a site: security alerts everyone in the building and nearby, gives lockdown instructions, coordinates with police and tracks who has confirmed they are safe until the all-clear.

• Employee caught up in unrest abroad: the travel team locates the employee, shares guidance on staying safe, arranges a safe place to stay and organizes travel home when it is possible.

How Vismo helps you manage a crisis

Vismo helps employers reach their people fast, know where they are and confirm they are safe, then keep a record of every step.

• Alerts that get through: mass notification sends the same message by text, voice call, email, app push, Microsoft Teams and Slack at once, with two-way replies so employees confirm they are safe in one tap and you can see who has not responded.

• Target the right people: geofencing sends alerts to everyone in an affected area and flags when people enter or leave a zone.

• Early warning: threat intelligence flags incidents near your people and sites so you can act before a situation escalates.

• Traveling employees: travel security shows where your travelers are and helps you support them when something happens abroad.

• Remote and lone workers: lone worker safety gives field employees SOS alarms, timed check-ins and escalation when a check-in is missed, with their location on a live map.

• One shared picture: critical event management brings alerts, employee location and response together in one view for your crisis team.

• Your plan, followed every time: Vismo Workflows turns your crisis plan into guided, timestamped steps that an administrator starts when an event happens, so whoever is on duty follows the same process and you keep a record for the review.

If you are putting your plan into practice, Vismo's crisis management software helps your team alert, locate and account for employees from one place. For a deeper look at reaching staff in an emergency, read why email alone isn't enough, and if you are comparing providers, see our guide to Everbridge alternatives.

Crisis management FAQ

What are the 5 steps of crisis management?

A common five step model is prevent, prepare, identify, respond and recover. You reduce risks where you can, build and practice a plan, spot a crisis early and activate the plan, protect people and coordinate the response, then restore operations and learn from the event.

What are the three stages of crisis management?

The three stages are pre-crisis, crisis response and post-crisis. Pre-crisis covers risk assessment, planning and training. Crisis response covers taking control, protecting people and communicating. Post-crisis covers recovery, support for employees and updating the plan.

What are the 5 C's of crisis management?

There is no single standard list, but a commonly used version is concern, clarity, control, confidence and competence. Show genuine concern for the people affected, communicate with clarity, take visible control, act with confidence and demonstrate the competence to resolve the situation.

What are the 5 P's of crisis management?

The 5 P's are usually given as prevent, prepare, practice, perform and post-crisis review. Some frameworks use the 5 P's differently, to map the stakeholders you need to manage: personnel, powers (authorities), public, press and partners.

Can you give me an example of crisis management?

A company with an office in a hurricane zone activates its crisis plan when a warning is issued. It closes the office, alerts every employee in the area with instructions, tracks who has confirmed they are safe, keeps customers informed, and reviews what worked once the storm has passed.

What is the difference between a crisis management plan and a business continuity plan?

A crisis management plan sets out how leaders make decisions and coordinate the whole response, including people safety and communication. A business continuity plan focuses on keeping or restoring critical services. Most organizations need both, linked together.

Be ready before the next crisis

Crisis management works when the plan, the team and the tools are ready before anything happens. Vismo helps you alert your people, know where they are, confirm they are safe and record every step of the response.

Request a demo