The incident is twenty minutes old and the crisis management team has still not met.
Nobody failed to try. The on-call engineer isolated the domain to stop the ransomware spreading, which was the right call and which also took email, Teams and the VPN with it. The bridge details are in a calendar invite nobody can open. The call tree is on an intranet page behind the same sign-in.
Out-of-band crisis communication is the ability to reach and direct your response team over a route that does not depend on the systems that have failed. For a financial firm it decides whether the response starts in minutes or when somebody finds a mobile number on a printed sheet. Most firms have thought about the channel. Fewer have written down who gets reached first, and who may decide once they answer.
Out-of-band crisis communication means convening and directing an incident response over a channel independent of the affected estate. For financial firms it carries two regulatory expectations: a communication route planned in advance, and a separation between the staff who run recovery and the staff who only need to be told.
What Is Out-Of-Band Crisis Communication?
Out-of-band crisis communication is any method of reaching and directing responders that runs outside the technology affected by the incident. It means a platform, a device and a contact record held away from the corporate network, the corporate directory and the corporate sign-in, so that losing those three does not also cost the firm its response.
Three things, not one:
- The channel. The route the message travels.
- The contact data. The numbers, groups and escalation order.
- The authority. Who may declare an incident and send.
Most firms solve the channel and assume the other two will hold.
Why Does A Firm’s Own Outage Break Its Crisis Response?
A firm’s own outage breaks its crisis response because the response runs on the same estate as the business. The bridge, the distribution lists, the response plan, the contact directory and the sign-in protecting all of them usually sit inside one network and identity boundary, so a single containment decision removes the response capability and the business capability together.
Containment is a deliberate act by a competent engineer, often the correct one, and it is also the act that cuts the firm off from its own responders. Isolating a domain takes out the identity provider, and with it the mailbox, the calendar and the intranet page holding the plan.
What Do DORA And The FCA Require Of Crisis Communication?
Both require a communication route planned before the disruption rather than improvised during it. DORA obliges financial entities to hold crisis communication plans and to run communication policies that separate recovery staff from staff who only need to be informed. The FCA requires an internal and external communication strategy, and expects planning for warnings where no direct line exists.
As at November 2026, two instruments carry most of the weight in Europe and the United Kingdom. This is orientation, not legal advice.
In the European Union, Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied since 17 January 2025. Article 14 sets three requirements. Financial entities must hold crisis communication plans allowing responsible disclosure of at least major information and communication technology incidents and vulnerabilities to clients, counterparts and the public as appropriate. Their staff communication policies must differentiate between people involved in managing technology risk, particularly those responsible for response and recovery, and people who need to be informed. And at least one person must be tasked with implementing the incident communication strategy and the public and media function.
In the United Kingdom, SYSC 15A.8 of the FCA Handbook points the same way in fewer words. A firm must maintain an internal and external communication strategy to act quickly and reduce the harm an operational disruption is expected to cause, and must give stakeholders clear, timely and relevant communications when one happens. The guidance beneath those rules expects a firm to work out, before any disruption, how it would get warnings out quickly, including, in the FCA’s own words, “where there is no direct line of communication”. Those provisions were last updated on 31 March 2022.
Neither instrument names a technology. Neither uses the phrase out-of-band. Both ask for a route and a policy that exist on paper before the morning they are needed.
Who Gets Reached First, And Who Only Needs To Be Informed?
The response and recovery group gets reached first, on the independent route, with acknowledgement required and escalation on silence. Everyone else is informed on a slower path. DORA turns that distinction into a policy requirement rather than a courtesy, so a firm that sends one identical message to its incident team and its two thousand staff has not met it.
Three groups, in the order they matter during the first hour:
- The people who act. Incident lead, technology recovery, the communications lead, whoever may declare a major incident, and their named deputies. Acknowledgement expected from each, with a defined escalation when it does not arrive.
- The people who are accountable. Executive sponsor, the board contact, whoever will speak to the regulator. They need a short, accurate picture that matches what the first group is working from.
- The people affected. Wider staff, clients, counterparts and, where it applies, the public. This is the audience DORA’s responsible disclosure language points at.
Authority is the item most often left loose. Name who may declare a major incident. List the deputies in order. Record their standing authority in writing, so nobody spends the first fifteen minutes chasing one person for permission.
How Do Out-Of-Band Crisis Communication Options Compare?
Each route survives a different kind of failure and gives something up in exchange, usually structure or evidence. The comparison below sets what each one withstands against where it stops being enough. For the channel question in more technical depth, what happens when email, Teams and Slack go offline covers the same ground from the infrastructure side.
| Route | Why it survives the firm’s outage | Where it stops being enough |
|---|---|---|
| SMS and voice calls to personal mobiles | Travels on the mobile network, with no dependency on the corporate network, identity provider or sign-in | No acknowledgement record, no assigned task, no shared view. Numbers go stale unless somebody owns them |
| Push notification through a separate app on a personal device | Sits outside corporate email and sign-in, and can carry an acknowledgement and a response option | Needs the app installed and permitted before the incident, and needs mobile data or wifi to arrive |
| A separate alerting and coordination platform hosted away from the firm’s estate | Holds the contact data, the groups, the response plans and the audit record outside the systems that failed | Only as current as the data loaded into it, and as usable as the last time people practised |
| A printed call tree or wallet card | Depends on no technology whatsoever, which is the whole point of it | Ages quickly, records nothing about who was reached, and does not scale past the first few calls |
| A consumer messaging group created in advance | Fast, familiar and already on nearly every phone | No defensible record, mixes personal and firm information, and sits on a service the firm does not control |
Most firms end up running two of these on purpose, usually a platform with a paper fallback behind it.
How Does Crises Control Support Out-Of-Band Crisis Communication?
Crises Control runs outside the firm’s own estate and reaches people through SMS, voice calls, email, push notification and Microsoft Teams, so a message can travel on channels an outage has not touched. Ping handles the alert and the acknowledgement. Incident Manager holds the structure once people have answered.
Crises Control’s mass notification software sends a single message across the configured channels, either simultaneously or cascading through them until recipients acknowledge. Acknowledgement is required from every recipient, non-responders escalate to the next channel automatically, and the result is a response and acknowledgement summary that can be exported for audit. For a regulated firm that record matters: it is created while the incident runs, not reconstructed afterwards.
One honest caveat. Microsoft Teams is on that channel list, and during a Microsoft or identity outage it is the channel least likely to help. The routes that earn their place are the ones that do not run through the estate under containment.
Once people have answered, the coordination problem replaces the contact problem. Crises Control’s incident management software gives the response a structured workspace, launches predefined response plans, notifies predefined recipient groups from message templates, and maintains a complete incident timeline from activation through to resolution. The company holds ISO 22301 for business continuity management alongside ISO/IEC 27001 and Cyber Essentials Plus, listed on its accreditation page.
What stays with the firm is everything the software cannot decide. Who belongs in the response and recovery group. Who may declare. Whether the deputies hold standing authority. Whether the contact data was refreshed this quarter. The decision to isolate the domain stays a judgement made by a person under pressure.
Your Out-Of-Band Crisis Communication Checklist
- Name the independent route, and name the paper fallback behind it.
- Hold the contact data for the response and recovery group outside the corporate directory, with one named owner refreshing it on a stated cycle.
- Separate the response and recovery group from the staff who only need to be informed, in a written policy, as DORA requires.
- Name who may declare a major incident, list the deputies in order, and record their standing authority in writing.
- Appoint the person responsible for the incident communication strategy and the media function, and name a relief for a long incident.
- Require acknowledgement on anything carrying an instruction, with a defined escalation interval.
- Test the route at least annually with the corporate network and sign-in treated as unavailable, and write down what the test found.
Agree It While Nothing Is Happening
Every item on that list is cheap to settle on an ordinary Thursday and close to impossible at the moment the domain goes dark. The firms that convene quickly are seldom the ones with the most technology. They are the ones that decided in advance, and in writing, which route carries the first message, which small group it goes to, who may send it, and who inherits that authority when the named person cannot be reached.
That is a governance exercise more than a procurement one, and it can be done this quarter with the plan a firm already has. The software question comes after it: whether the route can prove, afterwards, who was reached and who answered. If the honest answer today is a screenshot of a group chat, it is worth seeing what a purpose-built route looks like. Request a demo and walk a real scenario through it with the sign-in treated as unavailable, because that is the only version of the test that tells a resilience function anything.
Frequently Asked Questions
What is out-of-band crisis communication?
Out-of-band crisis communication is reaching and directing an incident response over a channel that does not depend on the systems affected by the incident. The channel, the contact data and the authority to send all have to sit outside the affected estate. The term comes from out-of-band management in engineering, where a device is administered over a path separate from the one carrying its traffic.
Does DORA require out-of-band crisis communication?
DORA does not use the phrase and does not mandate a particular technology. Article 14 of Regulation (EU) 2022/2554 requires financial entities to hold crisis communication plans and to run communication policies that differentiate staff responsible for response and recovery from staff who need to be informed, and to task at least one person with the incident communication strategy. A route that fails whenever the firm’s own systems fail makes those obligations hard to meet in practice.
Is a consumer messaging group enough for out-of-band crisis communication?
A consumer messaging group works as a fallback and poorly as a primary route. It is fast and already installed, so it beats having nothing. What it cannot give a regulated firm is a defensible record of who was contacted and who acknowledged, structured escalation when someone stays silent, or separation between personal and firm information.
How often should a firm test its crisis communication route?
At least annually, and again after any material change to the contact data, the response team or the platform. The test only tells a firm something if the corporate network, the identity provider and the sign-in are all treated as unavailable for its duration, because a test run with email working proves nothing about the scenario that matters. Record who could not be reached.
Who should be able to declare a major incident when systems are down?
A named individual, with named deputies in a stated order, all holding standing written authority to act without waiting for permission. A plan that depends on reaching one specific person before the first message goes out contains a single point of failure. Crises Control’s operational resilience software for financial services separates alerting, coordination and record.
This article was drafted with AI assistance and reviewed by the Crises Control team. Featured image: AI-generated.
