2 cissp ® Official Study Guide Eighth Edition

Crisis Management
If a disaster strikes your organization, panic is likely to set in. The best way to combat this 
is with an organized disaster recovery plan. The individuals in your business who are most 
likely to first notice an emergency situation (that is, security guards, technical personnel, 
and so on) should be fully trained in disaster recovery procedures and know the proper 
notification procedures and immediate response mechanisms.
Many things that normally seem like common sense (such as calling 911 in the event of 
a fire) may slip the minds of panicked employees seeking to flee an emergency. The best way 
to combat this is with continuous training on disaster recovery responsibilities. Returning 
to the fire example, all employees should be trained to activate the fire alarm or contact 

---

820
Chapter 18 
■
Disaster Recovery Planning
emergency officials when they spot a fire (after, of course, taking appropriate measures to 
protect themselves). After all, it’s better that the fire department receives 10 different phone 
calls reporting a fire at your organization than it is for everyone to assume that someone 
else already took care of it.
Crisis management is a science and an art form. If your training budget permits, invest-
ing in crisis training for your key employees is a good idea. This ensures that at least some 
of your employees know how to handle emergency situations properly and can provide all-
important “on-the-scene” leadership to panic-stricken co-workers.
Emergency Communications
When a disaster strikes, it is important that the organization be able to communicate inter-
nally as well as with the outside world. A disaster of any significance is easily noticed, but 
if an organization is unable to keep the outside world informed of its recovery status, the 
public is apt to fear the worst and assume that the organization is unable to recover. It is 
also essential that the organization be able to communicate internally during a disaster 
so that employees know what is expected of them—whether they are to return to work or 
report to another location, for instance.
In some cases, the circumstances that brought about the disaster to begin with may
have also damaged some or all normal means of communications. A violent storm or an 
earthquake may have also knocked out telecommunications systems; at that point, it’s too 
late to try to figure out other means of communicating both internally and externally.