A disruption is not yet an emergency

Tuesday, 9:15 am. The business application for applications is not responding. The IT hotline opens a ticket. At 10:30 it is still down, and in the corridor the word "emergency" comes up for the first time. Management asks whether the crisis team now needs to meet. Nobody is sure.

This is not a lack of commitment. What is missing is a shared language. In everyday use, disruption, emergency and crisis are just escalating versions of "bad". In business continuity management they mean more: each of the three words determines which organisation is in charge and what means it works with.

Disruption: normal operations take care of it

BSI Standard 200-4 defines in chapter 2.1 that a disruption is a situation in which processes or resources are not available as intended. In German:

„Eine Störung ist eine Situation, in der Prozesse oder Ressourcen nicht wie vorgesehen zur Verfügung stehen.“

Disruptions are usually resolved in normal operations, by the general organisational structure with its usual responsibilities, using the existing processes for fault resolution or incident management. But the standard also stresses that a disruption can escalate into an emergency if it cannot be resolved within a reasonable time.

Emergency: time decides, and there is a plan

Under 200-4, an emergency is an interruption of business operations affecting at least one time-critical business process that cannot be restored in normal operations within the maximum tolerable downtime. Handling it requires the special organisational structure, i.e. a team with its own responsibilities and decision paths. And unlike a crisis, there are plans for it, or existing plans can be adapted.

One sentence is often overlooked: an emergency may be declared before business operations are actually interrupted. The risk that the incident will interrupt business operations is sufficient. Anyone who only calls it once the downtime has been exceeded is calling it too late.

The qualifier "within the meaning of this standard" also matters. In fire safety or the protection of life and limb, emergency means something else. Anyone responsible for both in the same organisation should keep them apart in the emergency manual.

Crisis: no matching plan

A crisis is an incident that has a significant negative impact on the organisation and cannot be handled in normal operations. The difference from an emergency lies not in size but in preparation: unlike an emergency, there are no specific emergency plans for handling a crisis. In German:

„Im Gegensatz zu einem Notfall liegen zur Bewältigung einer Krise jedoch keine spezifischen Notfallpläne vor.“

The team therefore has to decide without relying on prepared steps. The standard illustrates this with a power cut: in a workshop it is a disruption, in a large part of the building with time-critical processes it is an emergency, and across a region with alternative sites also affected it is a crisis.

Two questions for the first minutes

200-4 deliberately bases the distinction on time so that it can be made quickly during an incident. Only two things need to be established:

• Is a time-critical business process affected that cannot be restored in normal operations within its maximum tolerable downtime? If not, it is a disruption.
• Are there matching emergency plans, or can they be adapted? If yes, it is an emergency. If not, it is a crisis.

Both questions can only be answered in a real incident if the work has been done beforehand: which processes are time-critical and how long they may be down is recorded in the business impact analysis, not in management's memory. In isidaten, the BIA records exactly these values per process.

Sources

BSI Standard 200-4, Business Continuity Management (German), version 1.0 (May 2023), chapter 2.1 Terms.

Next Sunday in Basic terms: RTO, RPO, MTPD and WRT, four times that are constantly confused.