Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we declare a disaster and invoke the continuity plans?

5 decision pointsThe pack behind this answer: Business Continuity, Disaster Recovery & Cyber Resilience

Add to board memo

The short answer

Recommendation
Have the crisis lead declare and invoke when a critical service is down or at risk of passing its recovery time, and do not wait for certainty. If the crisis lead cannot be reached within 30 minutes, the deputy decides. Where an attack is suspected, P09 runs the incident alongside.
Reasoning
A plan nobody is sure they may start is started late, and the pack counts waiting for certainty as time spent from the recovery time. So the conditions are set in advance, each checkable without judgement, and one role decides with a named deputy. Site leads take their first steps at once. In a cyber incident the incident decisions stay with P09, and the plans start beside them.
Considerations
  • The 30 minutes is the pack's default and matches P09's time for reaching the executive incident lead in a Severity 1 incident. Your own plan may set another.
  • Thresholds such as a building unusable for 2 hours or half the recovery time are the pack's examples. Set your own and keep each one checkable.
  • If the plan was invoked and the trigger turns out not to hold, the crisis lead stands it down early and records why.
  • The first holder of a role takes over again from the deputy only after a handover recorded in the crisis log.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartSomething has disrupted a critical service or a siteDecisionHave the site's first steps already been taken?StepTake them now: people safe, call tree, call the crisis leadDecisionIs a critical service down, or at risk of passing its recovery time?OutcomeDo not declare yet; keep watching against the triggersDecisionIs a cyberattack suspected, or the site cut off from the network?StepHave the incident manager called; P09 decides on the incidentDecisionIs it a failed system that will be back within its recovery time?OutcomeRepair it where it is; the crisis lead decides if it slipsDecisionCan the crisis lead be reached within 30 minutes?OutcomeThe crisis lead declares the crisis and invokes the plansOutcomeThe deputy declares and invokes, and notes acting as deputy

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 12 steps.

  1. Start

    Something has disrupted a critical service or a site

    'Disaster' is the everyday word. The pack speaks of two acts, declaring a crisis and calling the crisis team, and invoking a service's continuity plan and starting its workaround. Both are the crisis lead's (RR-17). The site lead's first steps come before either.

    In the pack

  2. Decision

    Have the site's first steps already been taken?

    The site or unit lead takes these at once, without waiting for anyone: people safe, call tree started, crisis lead called, vital records kept at hand, the question whether it could be an attack, and the site log. They do not wait for a declaration. If you do not know, answer no.

    In the pack

  3. Step

    Take them now: people safe, call tree, call the crisis lead

    If the building or the situation is unsafe, get everyone out and account for them, visitors included, and call the emergency services first if anyone is hurt. Start the call tree so the next shift hears too. Tell the crisis lead which loss it is, what still works and what you need.

    In the pack

  4. Decision

    Is a critical service down, or at risk of passing its recovery time?

    The card sets invoking as soon as a critical service is down or at risk of passing its recovery time. A lost building, many people absent or a supplier that cannot deliver put a service at risk in the same way. Invoking early costs little; waiting for certainty spends part of the recovery time. If you cannot tell, answer yes.

    In the pack

  5. Outcome

    Do not declare yet; keep watching against the triggers

    Keep the triggers to hand and check them again at each update. A building unusable for longer than a set time, many people absent, a supplier that cannot deliver or a system down beyond its time each calls for invoking. Data found corrupted, encrypted or deleted is a trigger even while the service still runs.

    In the pack

  6. Decision

    Is a cyberattack suspected, or the site cut off from the network?

    Either is a trigger in the site plan, whether or not a service is yet down: the incident manager cuts the site or unit off, or an attack is suspected. A cyberattack changes what happens next, not whether the plans start. If you cannot tell, answer yes.

    In the pack

  7. Step

    Have the incident manager called; P09 decides on the incident

    P09 runs the incident and owns its decision rights, and whether there is an incident and at what severity is for P09's rules. The continuity plan still starts alongside it. The workaround, supplier warnings and messages start at once. Nothing is restored, failed over or reconnected until the incident manager agrees.

    In the pack

  8. Decision

    Is it a failed system that will be back within its recovery time?

    After a failure that is not an attack, the technical recovery lead estimates when each affected system can be repaired where it is. Compare that with the time left within the service's recovery time. A lost building, many people absent or a supplier that cannot deliver call for the plan whatever the repair time, so answer no for those. If the estimate is not known, answer no.

    In the pack

    See also

  9. Outcome

    Repair it where it is; the crisis lead decides if it slips

    Repair under the IT Disaster Recovery Procedure and keep the clock running. The card lets the crisis lead invoke as soon as a service is down, while the site plan's test is that the repair will not be back in time, so ask the crisis lead which applies. If the estimate moves beyond the time left within the recovery time, the crisis lead decides, on the technical recovery lead's advice, to fail over or recover elsewhere. Where neither would be back in time, the workaround starts as well.

    In the pack

    See also

  10. Decision

    Can the crisis lead be reached within 30 minutes?

    Thirty minutes is the pack's default, matching P09's time for reaching the executive incident lead in a Severity 1 incident. Every role has a named deputy who decides in the holder's place. If you do not know whether the crisis lead can be reached, answer no and call the deputy.

    In the pack

  11. Outcome

    The crisis lead declares the crisis and invokes the plans

    The crisis lead declares, calls the crisis team and invokes the plans, and the business owner starts each service's workaround. The communications lead then tells staff within 1 hour and affected customers within 2 hours of the declaration (the pack's defaults); in a cyber incident P09's templates apply. The crisis lead stands the plans down on their criteria.

    In the pack

    See also

  12. Outcome

    The deputy declares and invokes, and notes acting as deputy

    When the first holder cannot be reached within 30 minutes (the pack's default), the deputy decides and records in the crisis log that they acted as deputy. The first holder takes over again only after a handover recorded in the log. The deputy takes the same steps the crisis lead would, from declaring to starting the workarounds.

    In the pack

    See also

Practical checklist

  1. Check that the site lead has taken the first steps: people safe, call tree started, crisis lead called.
  2. Check whether a critical service is down or at risk of passing its recovery time.
  3. Ask whether a cyberattack is suspected, and call the incident manager through the crisis lead if so.
  4. For a failed system, ask the technical recovery lead whether it will be back within its recovery time.
  5. Call the crisis lead, and the deputy if there is no answer within 30 minutes.
  6. Have the crisis lead declare the crisis and invoke the plans, and the business owner start each workaround.

Evidence to have ready

  • The crisis log with the time of each trigger, declaration and decision, and who decided.
  • The named holder and deputy of the crisis lead, with numbers that work out of hours.
  • The list of conditions for invoking, each checkable, as written in the service's and the site's plans.

Assumptions

  • A crisis lead and a deputy are named roles, and no one is the first holder of two roles that must act in the same hour.
  • Each critical service has its recovery time agreed with its business owner, and a continuity plan or workaround exists to be invoked.
  • Your incident response plan already sets who decides what in a cyber incident. This flow points to it and does not restate it.
  • Figures quoted are the pack's defaults. Your own standard may set different ones.

Not covered here