SmartSuite for the Crisis Management Lead

Crisis plans and playbooks in Crisis Management carry owners, review cycles and version history, with reminders when a review is due, so the version the team opens on the night is the one you approved.

Plan tabletop exercises on a calendar, send tasks to participants automatically, track who engaged and record outcomes with traceability, so the exercise schedule is evidence as well as practice.

During an event the incident log, open tasks, decisions and communications sit on one dashboard, so you direct the response from a current picture rather than from the last call.

Declaring a crisis fires the notifications and escalation paths defined in the playbook, so the Security Operations Manager, Communications Director and Chief Operating Officer are engaged by the workflow, not a phone tree.

The Business Continuity Manager's plans, critical service maps and dependencies are linked to the incident record, so the team sees which services and vendors are affected without leaving the workspace.

Stakeholder and regulator communications are logged with timestamps against the incident, so where SEC, NIS2 or GDPR deadlines apply you can show when materiality was determined and when notice went out.

Post-incident actions in Issues Management carry owners, dates and verification steps, with automated follow-up, so the Head of Operational Resilience can see which lessons became changed plans and which are still open.

The AI Assistant in a SmartDoc field drafts the incident report or regulatory response narrative from the recorded timeline, decisions and communications, so leadership gets an account grounded in the log rather than in recollection.

Role-based permissions, activity logs and audit trails keep the incident record defensible, supporting DORA, ISO 22301 and sector resilience requirements when a regulator asks how the event was run.

Head of Operational Resilience

The Crisis Management Lead, or Incident Commander, directs the organization's response to disruptive events: maintaining the crisis management plan and playbooks, declaring and activating the response, directing the crisis team and cross-functional action, directing stakeholder and regulatory communications with the Communications Director and legal counsel during the event, keeping the incident log and situational awareness current and overseeing recovery. After the event they run the post-incident review, own the corrective actions and exercise the crisis team on a schedule so the next activation is faster.

When a crisis is declared, Crisis Management triggers the coordinated response workflows from your playbooks, so the team's tasks are assigned at activation rather than dictated under pressure. Tasks, updates and communications are tracked on one dashboard, which gives the Crisis Management Lead situational awareness without chasing each workstream for a status. The Crisis Response Coordinator works the same board, routing tasks and keeping the communications log current, so the lead directs rather than administers.

Issues Management captures lessons learned, corrective actions and improvement recommendations from the post-incident review and tracks each one to closure with an owner. That keeps the review from becoming a document nobody acts on: the Business Continuity Manager, the Security Operations Manager or the Physical Security Director each own their actions, and the Crisis Management Lead can see which are closed before the next exercise. Recurring findings across events also become visible, which is the signal that a playbook needs changing.

The incident timeline is logged as the event unfolds, with decisions, updates and communications recorded in sequence, and SmartSuite produces the after-action report for leadership and regulators from that log. The timeline matters because disclosure clocks run from specific moments: SEC registrants must disclose material cyber incidents within four business days of determining materiality, NIS2 requires an early warning within 24 hours, and GDPR requires breach notification within 72 hours. An accurate timeline is what shows those obligations were met.

The Head of Operational Resilience and the Chief Operating Officer see the same dashboard the crisis team is working from, so leadership updates come from the live record rather than a separate briefing cycle. The Communications Director drafts stakeholder communications against the logged facts, the Chief Information Security Officer and the Security Operations Manager run the technical workstream in Incident Management, and the Business Continuity Manager invokes continuity plans in Operational Resilience, all linked to the same event.

The playbooks, the crisis team roster and the notification lists need to be loaded before an event, because the activation workflows run from them. Most teams set these up from the existing crisis management plan and then use a scheduled exercise as the first live run, which tests the playbooks and trains the team on the dashboard at the same time. ISO 22361 and the BCI Good Practice Guidelines both expect exercising, so the exercise record doubles as evidence for the program.