Emergency management
Emergency management covers all organisational and technical arrangements for being prepared for emergencies and crises, managing them effectively, and keeping critical business processes running as far as possible or restoring them quickly.
Emergency management (often subsumed under Business Continuity & Emergency Management) refers to the holistic process by which an organisation prepares for serious disruptions that threaten normal operations. Unlike day-to-day incident management, it addresses high-impact events such as prolonged IT outages, cyberattacks, fire, power failures or the loss of key service providers. The goal is to limit the downtime of critical business processes and to minimise harm to operations, customers and reputation.
Effective emergency management follows a lifecycle of prevention, preparation, response and recovery. Based on a business impact analysis, an organisation identifies its critical processes, their maximum tolerable period of disruption (MTPD) and recovery targets (RTO/RPO). From these it derives emergency, recovery and crisis communication plans, clearly defined roles and escalation paths, as well as precautions such as data backups, redundancy and alternative workplaces. Regular tests, exercises and training ensure that the plans actually work when it matters.
Methodologically, the practice draws on standards such as BSI Standard 200-4 (Business Continuity Management) and ISO 22301. For important and essential entities, the NIS2 Directive and its national transposition laws explicitly require measures for business continuity, backup management and the handling of security incidents. Emergency management is therefore no longer just a matter of resilience but increasingly a regulatory obligation, the implementation of which is the responsibility of senior management.
Legal Basis
Art. 21(2)(c) NIS2 Directive (EU) 2022/2555 (business continuity, backup and crisis management); BSI Standard 200-4; ISO 22301
Practical Example
A mid-sized plant engineering company qualifies as an important entity under NIS2. The information security officer first carries out a business impact analysis and finds that the ERP and production control systems become business-critical after just four hours of downtime. He establishes geo-redundant backups with a two-hour RTO, documents emergency and recovery plans, appoints a crisis team with an on-call contact list, and runs a simulated ransomware exercise once a year. When an encryption attack hits six months later, operations are restored within a single working day thanks to the tried-and-tested plan.