ESRM Program · Operations Cluster
Crisis Management
Decide who is in charge and who speaks for you before the worst day arrives.
$2,500 fixed-fee assessment 3–4 weeks Credited toward the vCSO program
Measured against ISO 22361. Led by Don Oxman, CPP, CISSP, CISM. Licensed by Texas DPS. In business since 2013.
The first few hours of a crisis shape the story.
Crisis management is one of thirteen domains in our Enterprise Security Risk Management (ESRM) program, and part of the Operations cluster with Organizational Resilience, Business Continuity, and Supply Chain Security. It covers how leadership handles a serious event: a resident injury at a Tarrant County assisted living community, or a data breach on the local news.
In a crisis, most companies rely on the CEO, the company attorney, and whoever handles marketing. They work out roles and wording in real time while employees, customers, and reporters wait. A continuity plan keeps operations running, but it rarely says who decides or who speaks. We build your crisis team and playbook ahead of time, and help you run it.
What can go wrong in a crisis
Slow activation
Nobody is sure what counts as a crisis or who can call one, so the team assembles hours late and loses the chance to get ahead of events.
Unclear authority
Several executives make conflicting calls, or everyone waits on one person who is traveling or can't be reached.
Mixed messages
Employees, customers, and reporters hear different versions from different people, and the inconsistency becomes its own story.
Missed audiences
Families, regulators, insurers, or lenders hear about the incident from someone else first, or a required notification deadline passes.
Social media speed
A post or video from an employee or bystander can spread across DFW within an hour, well before the company has confirmed the facts.
Legal exposure
Statements made under pressure, poor records of what was decided and when, and late notifications can create liability that outlasts the crisis.
Five questions for leadership
- Is it written down who can declare a crisis and who sits on the crisis team?
- Do you have holding statements ready for the incidents you are most likely to face?
- If customer data or people's safety were involved, do you know who must be told, and by when?
- Have you agreed in advance how you will work with outside counsel and a PR firm in a crisis?
- Has your leadership team run a crisis exercise together in the last year?
If you answered “no” or “not sure” to any of these, that is where we would start. Most of these gaps cost little to fix before an incident and a great deal to fix after one.
How an Engagement Works
Every ESRM domain starts with the same fixed-fee assessment. If you decide to continue, we credit the fee toward the program, and crisis management becomes part of your vCSO engagement alongside whichever other domains you need.
Crisis Management Assessment
- Interviews with the CEO, legal counsel, HR, operations, and whoever handles communications.
- Structured review: a 15-question risk profile, a 25-point practices checklist, and a maturity score from 1 (Initial) to 5 (Optimized).
- Scenario and audience profile: your most likely crises and everyone you would need to reach.
- Gap analysis against ISO 22361, the international standard for crisis management.
- Written report and prioritized roadmap, walked through with your leadership team. The report is yours whether or not you continue.
The fee is credited in full toward the program if you start within 90 days.
The vCSO / ESRM Program
- Assess (Q1): we start from your assessment findings.
- Build (Q2): a crisis management plan with team roles, decision authority, an activation protocol, notification lists, and holding statements.
- Communications partners: we work alongside your PR firm or counsel. They shape the message, and we make sure the facts behind it hold up.
- Crisis exercise with your leadership team, so the plan is not used for the first time during a real event.
- Operate (Q3+): we stay on as the named owner, with post-incident reviews, annual plan updates, and readiness reporting to leadership.
Month to month. Cancel with 30 days’ notice. About the vCSO program →
Crisis Advisory Services
- On-call advisory for your leadership team during a live incident.
- Crisis team support: activation, decision logging, and next steps.
- Spokesperson readiness, coordinated with your PR firm or counsel.
- Post-incident review and plan updates once the event is over.
Why Total 360
Prevention and response
A strong statement can't undo a preventable failure. We reduce the risks that lead to a crisis and help leadership respond well when one happens anyway.
Works with your advisors
We don’t replace your attorney or PR firm. We give them a prepared crisis team, verified facts, and a clear decision process, so their advice can be acted on quickly.
Experienced leadership
Led by Don Oxman: M.S. in Security Management, CPP, CISSP, CISM. U.S. Army and AT&T background. In business since 2013 and licensed by Texas DPS.
Common questions
What does a crisis management assessment cost?
$2,500, as a fixed fee. It usually takes three to four weeks from kickoff to the readout. If you start the vCSO program within 90 days, the full fee is credited toward it.
What do we get at the end of the assessment?
A written report with your maturity score from 1 (Initial) to 5 (Optimized), the gaps we found against ISO 22361, the international standard for crisis management, and a prioritized roadmap. We walk your leadership team through it, and the report is yours whether or not you continue.
Do we have to sign up for the full program?
No. The assessment stands on its own. If you continue, crisis management runs inside the vCSO program at $2,500 to $7,500 a month depending on scope. It is month to month, and you can cancel with 30 days’ notice.
Can we buy crisis advisory services without the program?
Yes. They are available to any client. Billed per engagement, quoted in advance.
Will you replace the people and providers we already use?
No. We work alongside your IT provider, attorney, insurer, and other advisors. We set the standard, help them meet it, and check that the work gets done.
Start with a 30-minute Risk Discussion
No deck and no sales pitch. Tell us the incident you worry about most and who would handle it today. We’ll give you an honest read on your readiness and send a scoped proposal within five business days.
Schedule a Risk Discussion Or call 817-677-0515 · info@total360security.com