Incident and Crisis Management Consulting

Our incident and crisis management consulting helps organisations build the capability to lead through the worst day: a crisis team that knows its role, escalation criteria agreed before they are needed, a board that receives business impact rather than technical noise, and regulator notifications that are made on time. Security Solution Consultants (SSC) designs crisis management frameworks to ISO 22361, incident command structures to ISO 22320 and incident handling to ISO/IEC 27035 and NIST SP 800-61r3, then tests them with realistic exercises, from our base in Melbourne and for clients across Australia, New Zealand, the Gulf and Africa.

Incident, major incident or crisis?

Most organisations have an incident response plan for their IT and security teams, and many have a business continuity plan. Far fewer have a tested way of moving from one to the other when an incident starts to threaten the organisation itself. Three international standards describe that escalation, and each one has a different audience.

The gap between those levels is where most crises go wrong: escalation happens late, the crisis team receives forwarded technical updates, and nobody owns the regulator clock. Our work closes that gap. For hands-on technical response to a live cyber incident, see our incident response and recovery services.

Our incident and crisis management services

• Crisis management framework. A crisis management policy and plan aligned to ISO 22361, with clear activation and stand-down criteria, decision rights and the link to your business continuity and incident response plans.
• Escalation criteria and triggers. Agreed in advance and written down: severity, records affected, customer outage duration, safety, media interest, concurrent incidents. Triggers suggest escalation; a named person declares it.
• Crisis team design. Roles, alternates, contact trees and a crisis room, physical or virtual, with the tools and templates the team will need in the first hour.
• Incident command structure. An ISO 22320 command structure for major incidents: incident commander, operations, planning, logistics and liaison roles, incident action plans and hand-over rules.
• Board and executive briefings. A one-page board brief format built on business impact: operations, customers, finances, legal and regulatory position, people and safety, and reputation, with the decisions the board is asked to make.
• Regulator and stakeholder communications. Notification playbooks for each regulator and agency that applies to you, holding statements by audience, and an approval step so nothing external goes out unchecked.
• Exercises and post-incident reviews. Tabletop and simulation exercises scored against objectives, and independent post-incident and post-crisis reviews that turn lessons into owned actions.

Building the crisis team

A crisis team is small, senior and deliberately separate from the people doing the technical work. We help you define it around decisions rather than job titles:

1. A crisis leader and deputy with the authority to commit the organisation.
2. A decision log keeper, because ISO 22361 expects decisions to be recorded with the options considered and the information available at the time.
3. Communications, legal, people and finance leads, each with a named alternate.
4. Liaison roles that connect the crisis team to the incident commander, the regulators and the board.

Each role gets a one-page card: what it decides, what it needs, who it informs and when it hands over.

Board reporting in plain English

Directors need three things in a crisis: what has happened, what it means for the business, and what they are being asked to decide. They do not need indicators of compromise or log extracts. We design the situation report and board brief so that a non-technical reader can take them in within a few minutes, with every statement traceable to a recorded fact.

Regulators, government agencies and notification clocks

In a serious incident, the regulator clock often starts before the crisis team has met. We map every notification obligation that applies to you and build it into the playbook, with an owner and a deadline for each.

We also prepare the relationships: who you call at the regulator, law enforcement and your insurer, what reference numbers to record, and which statements must be approved before release. See our SOCI Act compliance services and APRA CPS 230 and CPS 234 advisory for the wider obligations behind these clocks.

Exercises that measure, not just rehearse

An exercise is only useful if it shows what would actually happen. We design scenarios around the risks your board worries about, such as ransomware in finance systems, a regulator-notifiable data breach or the outage of a critical supplier, and release timed injects to the team. Each exercise is scored against objectives agreed in advance, for example:

• Crisis declared within 30 minutes of the scenario starting.
• First situation report issued within 90 minutes of declaration.
• Every decision recorded with the options considered and a rationale.
• Every external statement approved before release.
• The regulator notified within the applicable deadline.

The after-action report lists strengths, improvements and owned actions, and becomes evidence of the exercise and validation requirements in ISO 22361. APRA’s CPS 234 also expects information security response plans to be tested annually.

How an engagement runs

1. Discovery. Review existing incident response, business continuity and crisis plans, past incidents and regulatory obligations.
2. Design. Escalation criteria, crisis team, incident command structure, board brief and notification playbooks.
3. Build. Plans, role cards, templates and contact trees, configured in GRCLens if you use it.
4. Exercise. A tabletop or simulation with your executive team, scored against agreed objectives.
5. Improve. After-action report, action plan and a recommended exercise cycle.

Why work with SSC

• We work across cyber security, privacy, operational and third-party incidents, so the crisis framework covers more than IT outages.
• We know the regulators: SOCI and the CIRMP rules, APRA CPS 230 and CPS 234, the Notifiable Data Breaches scheme, and Gulf and African regimes.
• SSC is certified to ISO/IEC 27001 and follows a Secure by Design approach.
• Our GRCLens platform turns the plan into a working system: one record from the first alert to the board brief, with exercises that produce evidence.

Related services: incident response and recovery, business continuity management, enterprise risk management and cyber security and compliance training.