What is the difference between incident response and crisis management?

Incident response deals with the attack technically: contain, investigate, eradicate, restore. Crisis management steers its consequences for the business: continuity decisions, communications, legal duties, and relations with customers and authorities. The first is led by technical specialists, the second by senior management. A serious attack needs both at the same time.

This article is part of our incident response series. For the full picture, see What is incident response?.

Two disciplines, two time horizons

	Incident response	Crisis management
Core question	What is the attacker doing, and how do we stop it?	How does the business keep running?
Who	Analysts, CERT, MSP, IT team	Senior management, legal, communications, business units, HR
Typical decisions	Isolate a server, reset accounts, block a connection	Halt production, inform customers, report to an authority, contact the police
Pace	Continuous, hour by hour	Regular situation briefings, formal decisions
Outputs	Timeline, indicators of compromise, technical report	Continuity plan in action, communications, regulatory notifications
End point	Attacker removed, systems clean	Business back to normal operations

The guide “Crisis of cyber origin”, published by ANSSI with the CDSE, the French club of corporate security directors, describes this split clearly: an operational cell that handles the incident and a strategic cell that takes decisions.

When an incident becomes a crisis

An incident turns into a crisis when it goes beyond what the organisation can handle in its normal way of working. Typical signs:

• a critical activity is halted or at risk (production, invoicing, customer service);
• customer or employee data is affected;
• the incident has to be reported to an authority;
• third parties are exposed (customers, partners, suppliers);
• the press or social media may pick it up;
• the decisions needed go beyond the IT team’s remit.

For what counts as an incident in the first place, see What is a cybersecurity incident?.

How the two fit together

Both run in parallel and feed each other:

1. The technical team briefs the crisis team: what is affected, what is known to be safe, what is not yet, how long before a partial restart.
2. The crisis team makes the calls: accept a longer outage to preserve evidence, prioritise restarting a given activity, approve cutting off a supplier’s access.
3. The technical team acts and reports back at the next briefing.

The classic trap is letting the technical team make decisions that commit the whole business, or letting management meddle in hands-on technical work. A single named liaison between the two avoids both.

NIST’s SP 800-61 (Revision 3, April 2025) makes the same point from another angle: incident response is part of the organisation’s overall risk management, not an IT matter alone.

What the regulatory framework says

NIS2 also separates the two in Article 21(2): incident handling in point (b), and business continuity and crisis management in point (c). The reporting duties in Article 23 (early warning within 24 hours, notification within 72 hours, final report within one month) typically sit with the crisis team, which relies on facts supplied by the technical team. As of 14 September 2026, France had not yet adopted its NIS2 transposition law. See Is incident response mandatory?.

On the provider side, ANSSI added cyber crisis management as a full activity in its framework for qualified incident response providers in October 2025. See What is a PRIS-qualified incident response provider?.

Preparing both before an attack

• For incident response: a contract or partner you can call on, retained logs, tested backups, documented emergency access. See What is an incident response retainer?.
• For crisis management: who sits on the crisis team and their deputies, an offline contact list, message templates, and a way to communicate that does not depend on the compromised systems.
• For both: a yearly exercise, which almost always uncovers an outdated contact or an unclear role.

Where a SOC and its CERT come in

A managed SOC detects and triages the incident; its CERT leads the technical response and can support the crisis team with reliable facts and options. At Cyna, the CERT, a member of InterCERT France, works with the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page. Crisis decisions remain with the affected organisation, working with its MSP.

Talk to an expert

Want to check that your clients, or your own organisation, can run both at once? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Does every incident trigger a crisis team?

No. Most incidents are handled without a crisis: a compromised account quickly locked, a laptop isolated and cleaned. A crisis begins when the incident threatens operations, reputation or compliance and needs decisions from senior management.

Who leads the crisis team?

A senior manager with the authority to make trade-offs, usually the chief executive or a director named in advance. The technical lead reports to the crisis team but does not run it.

Is the MSP part of the crisis team?

Often, at least as a contributor: the MSP knows the estate, holds admin access and usually drives the return to service. It helps to set out its role in the contract. See Managed SOC and MSP: who does what?.

How can you rehearse cyber crisis management?

Through tabletop exercises based on a realistic scenario, at least once a year. ANSSI, the French national cybersecurity agency, publishes a dedicated guide on organising cyber crisis exercises.