Cybersecurity Advice, Continuity and Crisis Management: Different Tasks

An adjacent field still has its own task

Generative artificial intelligence (AI) can produce drafts for policies, risk registers and security-awareness concepts, making generic cybersecurity documents easier to obtain. A consulting firm may therefore seek to extend its offer into neighboring fields. Business continuity and crisis management share interfaces with information security, but their objects of work are not interchangeable. That matters when an organization selects advice for a disruption that extends beyond its IT systems.

Certification of information security management under ISO 27001 or a result from TISAX (Trusted Information Security Assessment Exchange) can meet a client’s requirements. The additional contribution of a consulting offer must nevertheless be demonstrated in relation to the actual assignment.

Information security addresses the protection of information and the conditions under which it is processed. Business continuity addresses the continuation and recovery of prioritized activities. Crisis management addresses decisions and coordination when ordinary arrangements no longer suffice. A cyber incident may require all three perspectives without making one a substitute for the others.

Establish the competence required by the assignment

Knowledge of an information security framework is relevant to a cyber-related continuity problem. It does not, on its own, demonstrate the ability to resolve competing recovery priorities or organize executive decision work under uncertainty. A short course can add knowledge; the assignment still needs experience and methods appropriate to its task.

I recommend examining how a proposed adviser connects technical facts to operating consequences. If an important system is unavailable, which services are affected, which alternatives exist and who can authorize the associated compromises? Advice becomes useful when these connections are explicit.

Generic document drafts can support preparation. Their availability does not remove the need to establish actual dependencies, negotiate workable responsibilities or test an alternative operating procedure.

Set security objectives that support operations

Absolute security is not a realistic end state. Concrete security objectives remain necessary: protecting specified information, reducing a defined exposure or maintaining a critical activity under stated conditions. These objectives provide a basis for selecting controls and assessing their contribution.

Compliance is one requirement within this work. It should not conceal the operational question of what the organization must protect and what it must remain able to do when protection is exceeded.

Internal management capability is therefore central. Leaders need enough understanding to interpret advice, assign responsibility and make decisions about residual exposure. External specialists contribute where the organization needs depth, independent challenge or support with a particular problem. The boundary follows the task rather than the label on the consulting offer.

→ Security, continuity and crisis management: Services