Crisis & Recovery Responsibility Matrix
Assigns crisis management, technical recovery and communication roles with deputies.
Available soon
- Format
- Excel
- Size
- 78 KB
- Length
- 12 sheets
- Version
- 1.2
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Responsibilities sheet. Each row is one activity with its source. R does it; A answers for it, exactly one per row; A/R answers for it and does it; C is consulted before; I is told after. The Check column says OK when a row has one A and at least one R. |
| 2 | Keep the rows that quote P09 (RA-05, RA-06, RA-07) as they are. Those decision rights belong to your incident response plan: change them there first, never here alone (RR-17). Only the board or its equivalent decides on a ransom. |
| 3 | Tailor the other letters to how you work. Add your own activities on the yellow rows at the foot, with an ID in the same form and the rule they serve. |
| 4 | On Role Holders, name the first holder and the deputy of every role, and how to reach each outside office hours. Use names or posts, never a team. Mark the roles that must act in the first hour of a crisis: the sheet refuses one person as first holder of two of them (RR-19). |
| 5 | Record when each holder and deputy last took part in an exercise. P10 EX-07 sets how often. The next date due calculates. |
| 6 | Below the roles, name each critical service's business owner and deputy, and each site's or business unit's continuity lead and deputy (RR-22), then fill in where printed and offline copies of this list are kept (RR-16). A cell still in [[double brackets]] counts as not named. |
| 7 | Read First Hours: the decisions of the first hours, who takes each, and who stands in. Print it and keep it with the plans. |
| 8 | Read Crisis Team: how this crisis team works with the incident response plan's crisis team in a cyber incident, and who leads each recovery stage. |
| 9 | Clear every check that does not say OK. The Checks sheet counts what is left: counts with names, never a score (RR-20). |
| 10 | Approve the matrix with the Business Continuity & ICT Resilience Policy. Review it when a role holder changes, after every test, exercise and real recovery, and at least with each recovery plan (RR-16). |
| 11 | To clear the EXAMPLE, delete the contents of the Example column on Role Holders and replace the holders, deputies and business owners. The Responsibilities rows are the content itself: tailor them, do not delete them. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you plan and test business continuity and recovery from a disruption, including a destructive cyberattack. It is not legal advice, and following it is not a statement that you comply with NIS2, DORA, the GDPR, HIPAA, ISO 22301 or any other law, standard or set of criteria. Which continuity and recovery duties apply to you depends on your sector and the law that applies to you: confirm them with counsel, your auditor or your supervisor.
Why this matters in a cyber incident. Classic disaster recovery assumes the systems you recover with can be trusted: fail over to the second site, restore last night's backup, and carry on. A destructive cyberattack breaks that assumption. Replication copies the damage to the second site, the attacker may have been inside for weeks before the encryption, and the sign-in directory and administrator accounts you would recover with may be the attacker's. Recovery then starts with the foundations, rebuilt from sources you can trust, and every system is checked before it goes back. The people who decide must be reachable without the systems the attacker may hold, and their deputies must be ready to decide in their place.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders; an important entity under NIS2 in its Member State, and not a financial entity, so DORA's reporting duties do not apply. Its role holders are those of its resilience review after INC-2026-014, as at 30 Sep 2026. Its Communications lead has no deputy: the Role Holders sheet flags it, and the Checks sheet counts it (RRM-07). Of its site and unit leads, only Warehouse 2's plan names a deputy; the others are yours to name.
Adapting this template
Small organisation: one person may hold several roles, but not two of the first-hour roles. Where that cannot be avoided, name a different deputy for each, and test in an exercise that the deputy can act while the holder does the other role.
IT run by a service provider: the provider's engineers usually do the R work of the technical recovery lead. Keep the A inside your organisation, name the provider's contact and the notice it must give, and agree in the contract that it takes part in your exercises (P06 TP-10).
Regulated entity: the NIS2 Implementing Regulation's Annex section 4 binds only the providers its Article 1 names; others may use it as good practice. DORA binds financial entities only; Articles 11 and 14 do not apply to the entities of Article 16(1), which follow Article 16(1)(f). Approve this matrix as your rules require and keep each approved version.
Group of companies: name a crisis lead and a deputy for each company. Record which group roles act for every company, and who decides when two companies are affected at once.
Delegation: a deputy acts with the holder's rights while the holder cannot act, and is bound by the same rules. A holder may hand R work to a named person; the A moves only to the named deputy. A ransom decision never moves below the board or its equivalent.
This workbook is your own record. Keep a copy where it can be reached when the main systems are down (RR-16).
Responsibilities
R does it · A answers for it, exactly one per row · A/R answers for it and does it · C is consulted before · I is told after. Yellow cells are yours to tailor; a blank means the role takes no part.
| Activity ID | Activity | Source | Approver | Policy owner | Crisis lead | Incident manager | Technical recovery lead | Business owner | Resilience coordinator | Communications lead | Supplier liaison | Head of Information Security | Site or unit continuity lead | A (calc) | R (calc) | Accountable (calc) | Check (calc) | What the source says |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RA-01 | Approve the policy, the critical services and their objectives | RR-01 | A | R | C | I | 1 | 1 | Approver | OK | RR-01: A critical service is one whose disruption beyond its maximum tolerable downtime would cause Severe harm on the risk register's impact scale. The list of critical services is approved by [[the approver]] with the policy, and reviewed with the objectives. | |||||||
| RA-02 | Agree a service's objectives and its workaround | RR-02, RR-06 | I | C | A | R | 1 | 1 | Business owner | OK | RR-02: Every critical service has a named business owner, who sets and agrees its objectives. IT proposes what is achievable; the business owner decides what is needed. Objectives set by IT alone are not agreed. RR-06: Where a service cannot be back within its recovery time, its business owner records a workaround that keeps the harm below Severe until the service returns, and who starts it. A workaround that has never been tried is recorded as untried. | |||||||
| RA-03 | Declare a crisis and call the crisis team | RR-17 | I | A/R | C | 1 | 1 | Crisis lead | OK | RR-17: The crisis lead invokes a service's continuity plan, sets the recovery order, and declares the end of recovery on the plan's criteria. Every other decision right during an incident is P09's: the incident manager isolates and decides restore or rebuild; the executive incident lead stops customer-facing services; only the board or its equivalent decides on a ransom. | ||||||||
| RA-04 | Invoke a service's continuity plan and start its workaround | RR-17 | A | C | R | I | 1 | 1 | Crisis lead | OK | RR-17: The crisis lead invokes a service's continuity plan, sets the recovery order, and declares the end of recovery on the plan's criteria. Every other decision right during an incident is P09's: the incident manager isolates and decides restore or rebuild; the executive incident lead stops customer-facing services; only the board or its equivalent decides on a ransom. | |||||||
| RA-05 | Isolate a system, site or account | P09 | I | A | R | C | 1 | 1 | Incident manager | OK | P09's decision right, quoted: "Isolate a system, site or account": Incident manager. Use the least disruptive containment that stops the harm, and bring in the service owner and specialists before any action that would stop a service people depend on for safety or essential operations. Tell the executive incident lead at the next update. | |||||||
| RA-06 | Stop a customer-facing service | P09 | A | R | C | I | 1 | 1 | Crisis lead | OK | P09's decision right, quoted: "Stop a customer-facing service": Executive incident lead. The incident manager may do it first where waiting would let the harm spread, and reports it at once. Where people depend on the service for safety or essential operations, its service owner and specialists are brought in first. | |||||||
| RA-07 | Pay a ransom or extortion demand | P09 | A | R | C | 1 | 1 | Approver | OK | P09's decision right, quoted: "Pay a ransom or extortion demand": Only the board or its equivalent. Never before legal advice (including sanctions checks), the insurer's view and a report to law enforcement. The plan assumes we do not pay. | ||||||||
| RA-08 | Set the recovery order and target times | RR-08; P09 V1 | A | C | C | R | I | 1 | 1 | Crisis lead | OK | RR-08: Recovery restores the foundations first, then critical services in order of recovery time, shortest first, unless the crisis lead sets another order and records why. The order and the target times are set in advance and confirmed when recovery starts (P09 V1). P09 V1: a step of P09's Ransomware Response Playbook | ||||||
| RA-09 | Decide restore or rebuild for each system | RR-12; P09 D4 | I | A | R | C | 1 | 1 | Incident manager | OK | RR-12: After an attack, each system is restored from the newest copy taken before the earliest sign of the attacker that passes its integrity check and a scan, never from a copy the attacker could have reached without checking it (P09 D3). Whether a system is restored or rebuilt is decided under P09 D4. P09 D4: a step of P09's Ransomware Response Playbook | |||||||
| RA-10 | Choose each system's recovery point | RR-12; P09 D3 | A | R | I | C | 1 | 1 | Incident manager | OK | RR-12: After an attack, each system is restored from the newest copy taken before the earliest sign of the attacker that passes its integrity check and a scan, never from a copy the attacker could have reached without checking it (P09 D3). Whether a system is restored or rebuilt is decided under P09 D4. P09 D3: a step of P09's Ransomware Response Playbook | |||||||
| RA-11 | Run the clean room and the rebuilds | RR-13 | I | A/R | C | 1 | 1 | Technical recovery lead | OK | RR-13: After a destructive attack, systems are rebuilt and restored in an isolated recovery environment, from trusted build sources, with new administrator credentials, and pass every mandatory gate of the clean-room checklist before they reconnect to production. | ||||||||
| RA-12 | Confirm a service works before it returns to users | RR-18; P09 V4 | I | C | A/R | 1 | 1 | Business owner | OK | RR-18: A system returns to production only when the clean-room checklist's mandatory gates and P09's recovery criteria are met, and its business owner has tested the service and confirmed it works (P09 IM-10, V4). The checks continue through P09's monitoring period. P09 V4: a step of P09's Ransomware Response Playbook | ||||||||
| RA-13 | Approve a system's return to production | RR-18; P09 IM-10 | I | A | R | C | C | 1 | 1 | Incident manager | OK | RR-18: A system returns to production only when the clean-room checklist's mandatory gates and P09's recovery criteria are met, and its business owner has tested the service and confirmed it works (P09 IM-10, V4). The checks continue through P09's monitoring period. P09 IM-10: A system must not return to normal service until the recovery criteria are met, and backups must be checked for integrity before they are restored. | ||||||
| RA-14 | Call on a supplier's continuity commitments | RR-10; P06 TP-10 | I | A | C | R | 1 | 1 | Technical recovery lead | OK | RR-10: A supplier that runs a system a critical service needs has a recovery time in its contract no longer than that service's recovery time, and is named in the service's plan with a contact and the notice it must give (P06 TP-10). Where the contract gives no time, or a longer one, the gap is recorded (MX-04). P06 TP-10: Critical suppliers must be part of incident response and continuity plans, with named contacts and notification duties. | |||||||
| RA-15 | Tell staff, customers and the public | RR-27; P09 IM-09 | A | C | I | R | 1 | 1 | Crisis lead | OK | RR-27: During a disruption of a critical service, the communications lead tells staff within [[1]] hour and affected customers within [[2]] hours of the crisis lead declaring it: what has happened, what still works, what to do, and when the next update will come. Updates follow at least every [[4]] hours, and at each change, until the end of recovery, all from the approved outage templates. In a cyber incident P09's templates and its rule IM-09 apply instead, and notices to authorities stay with P09 and P18. P09 IM-09: Only the communications lead may speak for the organisation about an incident outside it, using the approved templates; nobody else may talk to the media or post about an incident. | |||||||
| RA-16 | Keep the crisis log | RR-20 | A | I | R | 1 | 1 | Crisis lead | OK | RR-20: Readiness is reported to [[executive management]] each quarter and to [[the approver]] each year, as counts with every gap named: no score and no share of readiness. Test records and crisis logs are kept for [[3]] years, or longer where law or a contract asks. | ||||||||
| RA-17 | Declare the end of recovery | RR-17 | I | A | C | C | R | I | 1 | 1 | Crisis lead | OK | RR-17: The crisis lead invokes a service's continuity plan, sets the recovery order, and declares the end of recovery on the plan's criteria. Every other decision right during an incident is P09's: the incident manager isolates and decides restore or rebuild; the executive incident lead stops customer-facing services; only the board or its equivalent decides on a ransom. | |||||
| RA-18 | Test a service's recovery | RR-14 | I | R | C | A | 1 | 1 | Resilience coordinator | OK | RR-14: The recovery of every critical service is tested at least every [[12]] months, and after a significant change to it. A service never tested is tested within [[6]] months of its objectives first being agreed under this policy; agreeing them again does not move that date. A test recovers the service or its systems, restores its data, and records the time achieved and the data lost against the objectives. Where a supplier runs the systems, the test is the supplier's own recovery test, with its results shared and checked against the objectives. Only a timed recovery of the service proves its recovery time. An exercise under P10, a tabletop or a drill, is not a recovery test under this rule. It tests decisions and communication. | |||||||
| RA-19 | Close an objective gap | RR-15 | I | R | A | C | 1 | 1 | Business owner | OK | RR-15: Every failed check in the objectives matrix, and every objective a test or a real recovery missed, is an objective gap. Its owner agrees the change that closes it within [[10]] working days, with a due date; the service's risk owner is told and the risk is reassessed (P05 RM-10). | |||||||
| RA-20 | Gather a service's business impact analysis, process by process | RR-21 | I | C | A | R | C | 1 | 1 | Business owner | OK | RR-21: Each critical service's business impact analysis (RR-03) is gathered with its business owner process by process: what each process does, when it is busiest, the least it needs to run (people, sites, equipment, systems, suppliers and records), and its harm on the impact areas at each time point. The service's rating at each time point is the worst of its processes' ratings. The answers are kept with the objectives matrix and reviewed with them (RR-05). | ||||||
| RA-21 | Approve a site's or unit's continuity plan | RR-22 | A | I | C | C | R | 1 | 1 | Policy owner | OK | RR-22: Every site or business unit that a critical service needs has a continuity plan for four losses: its building, a large part of its people at once, a supplier it relies on, and its systems, for which it uses the service's workaround (RR-06). The plan gives the least the site or unit needs to keep the service running at its agreed reduced level, its vital records, and how its people are told. Its lead takes the first steps at once (people safe, the call tree started, the crisis lead called); the crisis lead invokes the rest (RR-17). The plan is reviewed at least every [[12]] months, after it is used or tried, and after a significant change, and a copy can be reached without the main systems (RR-16). | ||||||
| RA-22 | Decide to fail over or recover elsewhere | RR-23 | A | C | R | C | I | 1 | 1 | Crisis lead | OK | RR-23: After a failure that is not an attack, the technical recovery lead estimates when each affected system can be repaired where it is. Where that is later than the time left within the service's recovery time objective, the crisis lead decides, on the technical recovery lead's advice, to fail over or recover elsewhere; where neither would be back in time, the service's workaround starts as well (RR-06). Where an attack is suspected, nothing fails over or is restored until the incident manager confirms that the copy or site to be used can be trusted (RR-07; P09 D3). | ||||||
| RA-23 | Approve the failback to the normal set-up | RR-25 | A | R | C | I | 1 | 1 | Crisis lead | OK | RR-25: Failing back to the normal set-up is planned like a change: the data written while failed over is copied back and reconciled, the business owner agrees the time, it avoids the service's busiest periods, and the crisis lead approves it. Recovery ends (RR-17) when the service runs on its normal set-up, or on an alternate set-up the business owner and the crisis lead have accepted for a set time. | |||||||
| RA-24 | Approve a test's or trial's plan before it runs | RR-26 | I | C | A | R | C | 1 | 1 | Business owner | OK | RR-26: Every recovery test (RR-14), failover test and workaround trial has a written plan, approved by the service's business owner before it runs: what it tests, how success is judged against the objectives, how it is kept from causing the outage it rehearses (a copy or a quiet period, a point at which it stops, and a way back), and who may stop it. Its report, written within [[10]] working days, records the time achieved, the data lost and every finding; a finding that misses an objective is an objective gap (RR-15). A workaround tried in a trial is no longer untried (RR-06). |
Role Holders
Each role, who holds it first and who deputises, and how to reach them. First hour: the role must act within the hour a crisis is declared. Yellow cells are yours; the (calc) columns calculate.
| Example | Role | Acts in the first hour | What the role does | First holder | Deputy | First holder's contact, out of hours | Deputy's contact, out of hours | First holder last in an exercise | Deputy last in an exercise | Deputy named (calc) | First-hour roles this holder holds (calc) | Next exercise due (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | Approver | No | Approves the policy and the critical services' objectives, and receives the readiness dashboard. | The board | The board's chair calls an extraordinary meeting | [[Phone]] | [[Phone]] | Yes | Record both dates | OK | |||
| EXAMPLE | Policy owner | No | Owns the policy and the resilience programme, and is the crisis lead unless the plan names another. | Chief Operating Officer | Chief Financial Officer | [[Phone]] | [[Phone]] | Yes | Record both dates | OK | |||
| EXAMPLE | Crisis lead | Yes | Declares a crisis, invokes continuity plans, sets the recovery order and target times, and declares the end of recovery. | Chief Operating Officer | Chief Financial Officer | [[Phone]] | [[Phone]] | Yes | 1 | Record both dates | OK | ||
| EXAMPLE | Incident manager | Yes | Runs the incident under P09: isolates, preserves evidence, decides restore or rebuild for each system, and confirms the recovery criteria are met. | Information Security Manager | Head of Information Security | [[Phone]] | [[Phone]] | Yes | 1 | Record both dates | OK | ||
| EXAMPLE | Technical recovery lead | Yes | Rebuilds the foundations, runs the clean room and the rebuilds and restores, and recommends restore or rebuild and the recovery point. | Head of IT | IT Operations Manager | [[Phone]] | [[Phone]] | Yes | 1 | Record both dates | OK | ||
| EXAMPLE | Resilience coordinator | No | Keeps the objectives matrix, the dependency register, the plans and the test schedule current; keeps the crisis log during a disruption; reports readiness. | Head of Risk | Quality and Compliance Manager | [[Phone]] | [[Phone]] | Yes | Record both dates | OK | |||
| EXAMPLE | Communications lead | Yes | Sends staff, customer and public messages from approved templates (P09 IM-09). | Head of Marketing and Communications | [[Phone]] | [[Phone]] | No | 1 | Record both dates | No deputy (RR-19) | |||
| EXAMPLE | Supplier liaison | No | Calls on suppliers' continuity commitments and keeps their contacts current (P06 TP-10). | Procurement Manager | Finance Manager | [[Phone]] | [[Phone]] | Yes | Record both dates | OK | |||
| EXAMPLE | Head of Information Security | No | Owns the cyber scenarios in the plans and the security checks in the clean-room checklist. | Head of Information Security | Information Security Manager | [[Phone]] | [[Phone]] | Yes | Record both dates | OK |
Business owners, by critical service
Each critical service's business owner acts for that service only, so the role has one holder and one deputy per service. Name each deputy in the service's recovery plan (PS-3) and here. Where the owner also holds a first-hour role, name who starts the service's workaround in the first hour instead (RR-19). The EXAMPLE gives the owners its business owners agreed; their deputies are yours to name.
| Critical service | Business owner | Acts for the service in the first hour | Deputy | Owner's contact, out of hours | Deputy's contact, out of hours | Deputy named (calc) | Owner holds a first-hour role (calc) | Check (calc) | |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE CS-01 Online ordering | Chief Operating Officer | [[a manager the Chief Operating Officer names]] starts the workaround, because the Chief Operating Officer leads the crisis (RR-19) | [[Deputy]] | [[Phone]] | [[Phone]] | No | Yes | No deputy (RR-19) | |
| EXAMPLE CS-02 Warehouse dispatch | Head of Logistics | Head of Logistics | [[Deputy]] | [[Phone]] | [[Phone]] | No | No | No deputy (RR-19) | |
| EXAMPLE CS-03 Payments | Chief Financial Officer | Chief Financial Officer | [[Deputy]] | [[Phone]] | [[Phone]] | No | No | No deputy (RR-19) | |
| EXAMPLE CS-04 Finance and payroll | Chief Financial Officer | Chief Financial Officer | [[Deputy]] | [[Phone]] | [[Phone]] | No | No | No deputy (RR-19) | |
| EXAMPLE CS-05 Customer contact | Sales Director | Sales Director | [[Deputy]] | [[Phone]] | [[Phone]] | No | No | No deputy (RR-19) | |
Site or unit continuity leads, by site or business unit
Each site or business unit a critical service needs has a continuity plan and a lead who takes its first steps at once (RR-22). Name the lead and a deputy for each, here and in the site's or unit's plan. The EXAMPLE gives the leads of the distributor's sites and units, and the deputy Warehouse 2's plan names; the other deputies are yours to name.
| Site or business unit | Continuity lead | Deputy | Lead's contact, out of hours | Deputy's contact, out of hours | Critical services it carries | Deputy named (calc) | Check (calc) | |
|---|---|---|---|---|---|---|---|---|
| EXAMPLE SU-01 Warehouse 1 | Warehouse 1 Manager | [[Deputy]] | [[Phone]] | [[Phone]] | CS-02 | No | No deputy (RR-19) | |
| EXAMPLE SU-02 Warehouse 2 | Warehouse 2 Manager | Warehouse 2 Shift Supervisor | [[Phone]] | [[Phone]] | CS-02 | Yes | OK | |
| EXAMPLE SU-03 Warehouse 3 | Warehouse 3 Manager | [[Deputy]] | [[Phone]] | [[Phone]] | CS-02 | No | No deputy (RR-19) | |
| EXAMPLE SU-04 Finance team | Finance Manager | [[Deputy]] | [[Phone]] | [[Phone]] | CS-03, CS-04 | No | No deputy (RR-19) | |
| EXAMPLE SU-05 Customer contact team | Customer Contact Manager | [[Deputy]] | [[Phone]] | [[Phone]] | CS-01, CS-05 | No | No deputy (RR-19) | |
Where this list is kept when the main systems are down
RR-16: Each critical service has a recovery plan, reviewed at least every [[12]] months, after every test and real recovery, and after a significant incident or change. Lessons from tests are written into the plan. A copy of every plan and of the contact lists can be reached when the main systems are down.
| What | Where, or who | ||||||
|---|---|---|---|---|---|---|---|
| Printed copy of this sheet and of each recovery plan | [[Where: e.g. a sealed folder at each site and at the crisis lead's and deputy's homes]] | ||||||
| Copy off the main systems | [[e.g. an encrypted copy on a service that does not use the company sign-in directory or its administrator accounts]] | ||||||
| Who carries a copy | [[e.g. every first holder and deputy on this sheet]] | ||||||
| How the crisis team meets if email, chat and desk phones are down | [[e.g. a conference bridge and a messaging group set up outside the company's systems, with personal mobile numbers]] | ||||||
| Last checked that every copy matches this sheet | [[YYYY-MM-DD]] | ||||||
First Hours
Who decides in the first hours
The decisions of the first hours of a crisis, who takes each, and who stands in. P09's decision rights are quoted as P09 states them. The first holder and deputy come from the Role Holders sheet; the last column checks the card against the Responsibilities sheet.
The card: 10 decisions
| Activity | Decision | When | Who decides, as the source states it | Held in this matrix by | First holder (calc) | Deputy (calc) | Source | Note | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|
| RA-03 | Declare a crisis and call the crisis team | On a Severity 1 incident or a disruption that threatens a critical service. P09 convenes the crisis team within 1 hour | The crisis lead (RR-17) | Crisis lead | Chief Operating Officer | Chief Financial Officer | RR-17 | Calls the crisis team below, the same people as P09's crisis team in a cyber incident. | Agrees with the matrix |
| RA-05 | Isolate a system, site or account | Containment, under P09, at once | Incident manager | Incident manager | Information Security Manager | Head of Information Security | P09 decision right | Use the least disruptive containment that stops the harm, and bring in the service owner and specialists before any action that would stop a service people depend on for safety or essential operations. Tell the executive incident lead at the next update. | Agrees with the matrix |
| RA-06 | Stop a customer-facing service | Containment, under P09 | Executive incident lead | Crisis lead | Chief Operating Officer | Chief Financial Officer | P09 decision right | The incident manager may do it first where waiting would let the harm spread, and reports it at once. Where people depend on the service for safety or essential operations, its service owner and specialists are brought in first. | Agrees with the matrix |
| RA-07 | Pay a ransom or extortion demand | Whenever a demand arrives (P09 Ransomware Response Playbook D5) | Only the board or its equivalent | Approver | The board | The board's chair calls an extraordinary meeting | P09 decision right | Never before legal advice (including sanctions checks), the insurer's view and a report to law enforcement. The plan assumes we do not pay. | Agrees with the matrix |
| RA-04 | Invoke a service's continuity plan and start its workaround | As soon as a critical service is down or at risk of passing its recovery time objective | The crisis lead (RR-17) | Crisis lead | Chief Operating Officer | Chief Financial Officer | RR-17 | The business owner starts the service's workaround (RR-06). | Agrees with the matrix |
| RA-22 | Decide to fail over or recover elsewhere | After a failure that is not an attack, once the technical recovery lead has estimated the repair in place | The crisis lead, on the technical recovery lead's advice (RR-23) | Crisis lead | Chief Operating Officer | Chief Financial Officer | RR-23 | Where an attack is suspected, nothing fails over or is restored until the incident manager confirms the copy or site can be trusted (RR-23; P09 D3). | Agrees with the matrix |
| RA-08 | Set the recovery order and target times | When recovery starts: the end of stage R1 (Assess). P09 Ransomware Response Playbook V1 | The crisis lead (RR-17) | Crisis lead | Chief Operating Officer | Chief Financial Officer | RR-08, RR-17 | Foundations first, then services by recovery time, shortest first, unless the crisis lead records another order and why (RR-08). | Agrees with the matrix |
| RA-09 | Decide restore or rebuild for each system | Stages R1 to R3, for each system, after P09's backup check (D3) | The incident manager, under P09 D4 (RR-12, RR-17) | Incident manager | Information Security Manager | Head of Information Security | RR-12, RR-17; P09 D4 | The technical recovery lead recommends; the incident manager decides; the business owner tests. | Agrees with the matrix |
| RA-13 | Approve a system's return to production | Stage R6, for each system, once the clean-room checklist's mandatory gates pass | The incident manager confirms P09's recovery criteria are met (P09 IM-10; RR-18) | Incident manager | Information Security Manager | Head of Information Security | RR-18; P09 IM-10, V4 | Only after the business owner has tested the service and confirmed it works (RA-12, P09 V4). | Agrees with the matrix |
| RA-17 | Declare the end of recovery | Stage R7, when every affected critical service has returned | The crisis lead, on the plan's criteria (RR-17) | Crisis lead | Chief Operating Officer | Chief Financial Officer | RR-17 | The records are complete and P09's monitoring period has started for each system (CG-22). | Agrees with the matrix |
P09 IM-08: The incident manager must act at once to stop harm spreading, with the least disruptive containment that does it, and must bring in the service owner and specialists before any action that would stop a service people depend on for safety or essential operations; waiting for an executive is never a reason to let harm spread. A decision to stop a customer-facing service must be taken by the executive incident lead, or by the incident manager where waiting would let the harm spread; a ransom may only be paid on the decision of the board or its equivalent.
When the first holder cannot be reached within the time P09 gives for reaching the executive incident lead (Severity 1: 30 minutes), the deputy decides and records that they acted as deputy. The first holder takes over again only after a handover recorded in the crisis log (RA-16).
The card names who decides. It does not stop anyone taking the urgent steps P09 lets them take before a decision is recorded.
Crisis Team
One crisis team, with the incident response plan
In a cyber incident, this crisis team and the crisis team of P09's incident response plan are the same people. P09 runs the incident: every decision right during it is P09's. This matrix adds the continuity decisions: invoking plans, the recovery order and the end of recovery (RR-17).
Who is in the crisis team
This pack: the group that leads the organisation through a disruption: the crisis lead, the incident manager for a cyber incident, the technical recovery lead, the business owners of affected services, communications, legal and the data protection officer (P09 crisis team). P09: executive incident lead, incident manager, Head of IT, Legal, DPO, communications lead, and the owners of affected services.
| Role in this matrix | Role in P09's plan | First holder (calc) | Deputy (calc) | In a cyber incident |
|---|---|---|---|---|
| Crisis lead | Executive incident lead | Chief Operating Officer | Chief Financial Officer | The same person. Takes P09's decisions as executive incident lead and the continuity decisions of RR-17: invoking plans, the recovery order, the end of recovery. |
| Incident manager | Incident manager | Information Security Manager | Head of Information Security | The same person. Runs the incident under P09: isolation, evidence, restore or rebuild, and the recovery criteria. |
| Technical recovery lead | Technical responders (the Head of IT in P09's crisis team) | Head of IT | IT Operations Manager | Leads the technical responders' recovery work: the clean room, rebuilds and restores, under the incident manager's decisions. |
| Communications lead | Communications lead | Head of Marketing and Communications | None named | The same person. Speaks for the organisation only from P09's approved templates (P09 IM-09). |
| Business owner | The owners of affected services | Each service's owner (Role Holders sheet) | Each service's deputy (Role Holders sheet) | Runs the service's workaround and confirms it works before it returns to users (P09 V4). |
| Site or unit continuity lead | No P09 role | Each site's or unit's lead (Role Holders sheet) | Each site's or unit's deputy (Role Holders sheet) | Takes the site's or unit's first steps at once and runs its plan when the crisis lead invokes it (RR-22). The site's systems are cut off and reconnected only as the incident manager directs. |
| Head of Information Security | Head of Information Security | Head of Information Security | Information Security Manager | Owns the cyber scenarios and the clean-room security checks; advises on the recovery point and on any demand. |
| Resilience coordinator | No P09 role | Head of Risk | Quality and Compliance Manager | Joins the crisis team for continuity. Keeps the crisis log (RA-16) beside P09's case log. |
| Supplier liaison | No P09 role | Procurement Manager | Finance Manager | Calls on suppliers' continuity commitments (RA-14) when the crisis lead invokes a plan. |
| Approver | Board | The board | The board's chair calls an extraordinary meeting | The only body that may decide on a ransom. Told of a Severity 1 incident within P09's time. |
| Policy owner | No P09 role | Chief Operating Officer | Chief Financial Officer | Owns the programme between crises. Is the crisis lead unless the plan names another. |
| Legal | P09 Legal | [[Name]] | [[Deputy]] | Sanctions check, crime report, privilege and contracts; advice to the board on any demand. Decisions are P09's. |
| Data Protection Officer | P09 Data Protection Officer | [[Name]] | [[Deputy]] | Decides with the incident manager whether personal data was taken; advises on GDPR reports. Decisions are P09's. |
Who leads each stage of a recovery (Cyber Recovery Operating Procedure)
P09 contains and eradicates. Recovery starts when P09's eradication is confirmed (P09 E5) for the systems concerned, and a system returns only when P09's recovery criteria are met (P09 IM-10).
| Stage | Led by | First holder (calc) | Deputy (calc) | Starts when | Ends when |
|---|---|---|---|---|---|
| R1 Assess | Technical recovery lead | Head of IT | IT Operations Manager | P09 has contained the incident; the crisis lead has invoked the continuity plans of the services affected. | A damage list per system, the foundations' state, and the recovery order and target times confirmed by the crisis lead (RR-08). |
| R2 Isolate and prepare | Technical recovery lead | Head of IT | IT Operations Manager | R1 complete. | The clean room passes gates CG-01 to CG-05. |
| R3 Rebuild clean | Technical recovery lead | Head of IT | IT Operations Manager | R2 complete; P09 eradication confirmed (E5). | Each system rebuilt passes gates CG-06 to CG-11. |
| R4 Restore data | Technical recovery lead | Head of IT | IT Operations Manager | R3 complete for the system's dependencies. | Each restore passes gates CG-12 to CG-15, with the data lost recorded against the RPO. |
| R5 Validate | Business owner | The affected service's owner | That owner's deputy | R4 complete for the service. | Gates CG-16 to CG-19 pass, and the business owner confirms the service works (P09 V4). |
| R6 Return to service | Crisis lead | Chief Operating Officer | Chief Financial Officer | R5 complete; P09's recovery criteria met (IM-10). | Gates CG-20 to CG-22 pass; the service runs normally; P09's monitoring period has started. |
| R7 Stand down | Crisis lead | Chief Operating Officer | Chief Financial Officer | Every affected critical service has returned. | End of recovery declared (RR-17); crisis log closed; gaps raised (RR-15); plans reviewed (RR-16). |
Deputies take part in exercises
RR-19: Every crisis and recovery role has a named deputy, and no one is the first holder of two roles that must act in the same hour. Role holders and deputies take part in an exercise at least as often as P10 EX-07 sets.
P10 EX-07: Every role holder in the incident response plan, and every deputy, must take part in an exercise at least every [[24]] months.
A deputy who has never seen the plan is not a deputy. Put each holder and each deputy into an exercise, and record the date beside their name.
An exercise under P10, a tabletop or a drill, is not a recovery test (RR-14): it practises people and decisions, restores nothing and measures no recovery time.
Run at least one exercise in which the first holders of the first-hour roles are declared unavailable, so that their deputies decide.
Checks
Checks
The matrix and the role holders against RR-17 and RR-19. Counts with names, never a score or a share (RR-20). Every line should say 'Meets the check' before the matrix is approved.
| As at (EXAMPLE: the distributor's quarter end) | 30 Sep 2026 |
The checks
| Check | Result | Status | What it means | ||
|---|---|---|---|---|---|
| Activities in the matrix | 24 | Meets the check | The pack's 24 activities, RA-01 to RA-24, and any you add. | ||
| Activities with exactly one accountable role | 24 of 24 | Meets the check | One A (or A/R) per row. An activity with two owners has none. | ||
| Activities with at least one role doing it | 24 of 24 | Meets the check | At least one R (or A/R) per row. | ||
| Activities with a check to resolve | 0 | Meets the check | Rows on the Responsibilities sheet whose Check is not OK. | ||
| Roles on the Role Holders sheet | 9 | Meets the check | The organisation-wide roles. Business owners are counted by service below, and site or unit continuity leads by site or unit. | ||
| First-hour roles | 4 | Meets the check | Roles that must act in the hour a crisis is declared. P09 convenes the crisis team within 1 hour of a Severity 1 incident. | ||
| First-hour roles whose first holder holds another first-hour role | 0 | Meets the check | RR-19: no one is the first holder of two roles that must act in the same hour. | ||
| Roles without a deputy (RRM-07) | 1 | Action needed | Crisis and recovery roles with no named deputy, by name. Target: None. The roles are named on the next line. | ||
| Which roles have no named deputy | Communications lead | Action needed | From the Role Holders sheet. A deputy still in [[double brackets]] is not named. | ||
| Business owners with no named deputy | 5 of 5 | Action needed | Each critical service's owner needs a deputy too (RR-19). The EXAMPLE leaves these for you to name. | ||
| Business owners holding a first-hour role with nobody else named to act for the service in the first hour | 0 of 1 | Meets the check | RR-19: an owner who must also act in the crisis's first hour names who starts the service's workaround. Counted out of the owners who hold a first-hour role. | ||
| Roles with both exercise dates recorded | 0 of 9 | Action needed | P10 EX-07: every role holder and deputy takes part in an exercise at least every [[24]] months. The EXAMPLE gives no dates: enter yours. | ||
| Roles whose next exercise is past due | 0 | Meets the check | Counted against the As at date above. | ||
| Site or unit continuity leads with no named deputy | 4 of 5 | Action needed | RR-19: each site's or unit's lead needs a deputy too. The EXAMPLE names the deputy in Warehouse 2's plan; the others are yours to name. | ||
| Checks needing action | 5 of 14 | A count, not a score. Each check needing action is named above. | |||
Letters per role
How many activities each role answers for (A), does (R), is consulted on (C) and is told of (I). A/R counts as both A and R.
| Role | A | R | C | I |
|---|---|---|---|---|
| Approver | 2 | 0 | 0 | 2 |
| Policy owner | 1 | 1 | 0 | 4 |
| Crisis lead | 9 | 2 | 0 | 7 |
| Incident manager | 4 | 1 | 4 | 2 |
| Technical recovery lead | 2 | 9 | 6 | 0 |
| Business owner | 5 | 2 | 12 | 2 |
| Resilience coordinator | 1 | 6 | 2 | 1 |
| Communications lead | 0 | 1 | 0 | 6 |
| Supplier liaison | 0 | 1 | 0 | 0 |
| Head of Information Security | 0 | 0 | 4 | 0 |
| Site or unit continuity lead | 0 | 1 | 2 | 0 |
Lists
| RACI | YesNo |
|---|---|
| R | Yes |
| A | No |
A/R
C
I
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| R: responsible | Does the work. Several roles may share it. |
| A: accountable | Answers for the outcome and decides. Exactly one per activity. |
| A/R | Answers for the activity and does it. |
| C: consulted | Asked for advice before the activity is done or decided. |
| I: informed | Told after the activity is done or decided. |
| Approver | Approves the policy and the critical services' objectives, and receives the readiness dashboard. |
| Policy owner | Owns the policy and the resilience programme, and is the crisis lead unless the plan names another. |
| Crisis lead | Declares a crisis, invokes continuity plans, sets the recovery order and target times, and declares the end of recovery. |
| Incident manager | Runs the incident under P09: isolates, preserves evidence, decides restore or rebuild for each system, and confirms the recovery criteria are met. |
| Technical recovery lead | Rebuilds the foundations, runs the clean room and the rebuilds and restores, and recommends restore or rebuild and the recovery point. |
| Business owner | Agrees the service's objectives, runs its workaround, and confirms it works before it returns to users. |
| Resilience coordinator | Keeps the objectives matrix, the dependency register, the plans and the test schedule current; keeps the crisis log during a disruption; reports readiness. |
| Communications lead | Sends staff, customer and public messages from approved templates (P09 IM-09). |
| Supplier liaison | Calls on suppliers' continuity commitments and keeps their contacts current (P06 TP-10). |
| Head of Information Security | Owns the cyber scenarios in the plans and the security checks in the clean-room checklist. |
| Site or unit continuity lead | Owns the site's or unit's continuity plan, takes its first steps at once, runs it when the crisis lead invokes it, and accounts for its people. |
| First holder | The person who holds a role when everyone is available. |
| Deputy | The named person who acts for a role while its first holder cannot, with the same rights and bound by the same rules. A deputy still in [[double brackets]] is not named. |
| First-hour role | A role that must act within the hour a crisis is declared. In this workbook: Crisis lead, Incident manager, Technical recovery lead, Communications lead. No one is first holder of two of them (RR-19). |
| Crisis team | The group that leads the organisation through a disruption: the crisis lead, the incident manager for a cyber incident, the technical recovery lead, the business owners of affected services, communications, legal and the data protection officer (P09 crisis team). |
| Business impact analysis | Business impact analysis: for each critical service, how the harm grows over time on the risk register's impact areas, and the point at which it becomes Severe (RR-03). |
| Continuity plan | A site's or business unit's plan for keeping its part of the critical services running when it loses its building, a large part of its people, a supplier it relies on, or its systems (RR-22). |
| Failover | Switching a system to a second site, region or copy that runs it while the first is down (RR-23, RR-24). |
| Failback | Returning a system from its failover set-up to its normal one, with the data written meanwhile copied back and reconciled (RR-25). |
| Workaround trial | Running a service's workaround for real, for a set time and with a way back, to show it works. It tries the workaround; it does not test recovery (RR-14, RR-26). |
| End of recovery | The point at which the crisis lead declares every affected critical service back in normal operation, on the criteria the plan sets, and the records are complete (RR-17). |
| Critical service | A service the organisation delivers whose disruption beyond its maximum tolerable downtime would cause Severe harm on the risk register's impact scale (RR-01). It is a business service, such as online ordering, not a system. |
| Business owner | The manager accountable for a critical service. Sets and agrees its objectives, accepts its workaround, and confirms it works before it returns to users (RR-02). |
| Workaround | A way of running the service, or its most important part, without its systems for a set time, such as dispatch from printed pick lists. Owned and accepted by the business owner (RR-06). |
| Recovery point | The backup copy a system is restored from: the newest copy taken before the earliest sign of the attacker, checked for integrity and scanned before use (RR-12; P09 D3). |
| Restore | Put data or a system back from a backup copy that has been checked for integrity (P09 IM-10). |
| Rebuild | Wipe a system and install it again from a trusted build source, then restore only its data (P09 D4). |
| Isolated recovery environment (clean room) | An isolated recovery environment: a network with no connection to production, its own administrator accounts and no trust to the production directory, where systems are rebuilt and checked before they return (RR-13). |
| Foundations | What every other recovery needs first: the sign-in directory, the core network and firewalls, the backup platform, endpoint protection and monitoring, and the emergency administrator accounts. |
| Recovery test | A technical test that recovers a critical service, or the systems behind it, and measures the time achieved and the data lost against its objectives; for a service a supplier runs, the supplier's own recovery test with its results shared. A tabletop or a drill under P10 tests decisions and communication. Only a timed recovery proves a recovery time, so under this rule it is not a recovery test (RR-14). |
| Exercise | A tabletop or a drill under P10 that practises people and decisions. An exercise under P10, a tabletop or a drill, is not a recovery test (RR-14): it restores nothing. |
| Objective gap | A check in the objectives matrix that fails: an objective the service cannot meet as things stand. Recorded with an owner, a due date and the change that closes it (RR-15). |
| RA-nn, RR-nn | The activities of this matrix, and the rules of the Business Continuity & ICT Resilience Policy they serve. A rule quoted with a pack, such as P09 IM-10 or P10 EX-07, is that pack's. |
| (calc) | A cell or column the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Replace the holders and clear the EXAMPLE before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.29 — Information security during disruption | The workbook as a whole: who decides and acts to keep information secure during a disruption, with deputies |
| ISO/IEC 27001:2022 | Clause 5.3 — Organizational roles, responsibilities and authorities | Responsibilities and Role Holders sheets: roles, responsibilities and authorities assigned, with holders and deputies |
| NIST CSF 2.0 | RC.RP-02 — “Recovery actions are selected, scoped, prioritized, and performed” | Responsibilities and First Hours sheets: who selects, scopes, prioritises and performs recovery actions (RA-08 to RA-13) |
| NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Responsibilities, Role Holders and Checks sheets: roles, responsibilities and authorities established, communicated and checked |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management” | The workbook as a whole: who decides and acts in crisis management and recovery, with deputies |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Applies to the providers its Article 1 names. For them, the Annex points below; for others, good practice only |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.3.1 — “The relevant entities shall put in place a process for crisis management.” | Crisis Team sheet, for those providers: who takes part in the crisis management process |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.3.2 — the crisis management process addresses at least “roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow”; appropriate communication means between the entity and the relevant competent authorities, covering both obligatory and non-obligatory communications; and measures to maintain network and information system security in crisis situations | Responsibilities, First Hours and Crisis Team sheets, for those providers: roles and responsibilities in a crisis, including suppliers (RA-14), and the steps each takes |
| DORA — Regulation (EU) 2022/2554 | Article 11(7) — “Financial entities, other than microenterprises, shall have a crisis management function”, which, when the ICT business continuity plans or ICT response and recovery plans are activated, sets out clear procedures to manage internal and external crisis communications (Article 14) | Crisis Team sheet, for financial entities other than microenterprises and the entities of Article 16(1): who forms the crisis management function |
| DORA — Regulation (EU) 2022/2554 | Article 14(1) — “financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate” | Responsibilities sheet, RA-15, for financial entities: who discloses incidents to clients, counterparts and the public |
| GDPR — Regulation (EU) 2016/679 | Article 32(1)(c) — the security measures include, as appropriate, “the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident” | Responsibilities sheet, RA-08 to RA-13: who decides and does each step that restores availability of and access to personal data |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.1.2 — “The relevant entities’ operations shall be restored according to the business continuity and disaster recovery plan.” The plan is based on the risk assessment (point 2.1) and includes, where appropriate: purpose, scope and audience; roles and responsibilities; key contacts and communication channels; conditions for plan activation and deactivation; order of recovery for operations; recovery plans for specific operations, including recovery objectives; required resources, including backups and redundancies; restoring and resuming activities from temporary measures | Role Holders sheet, for the providers NIS2 IR Article 1 names: the plan's roles and responsibilities, key contacts and communication channels |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.3.4 — “The relevant entities shall test, review and, where appropriate, update the crisis management plan on a regular basis or following significant incidents or significant changes to operations or risks.” | Role Holders and Checks sheets, for the providers NIS2 IR Article 1 names: exercise dates for holders and deputies, and the matrix reviewed after tests and significant incidents |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; ISO 22301:2019 incl. Amd 1:2024 (clause numbers and titles only); NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR); 45 CFR Part 164 (HIPAA Security Rule, eCFR current to 6 October 2026); AICPA Trust Services Criteria (number and series title only)
ISO/IEC 27001 references name the clause or control this document relates to; ISO 22301 is named by clause number and title only, and its text is not reproduced. Neither says that meeting one meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
No reference here says that this workbook, or any practice in it, meets another framework's requirement.