Why Cyber Crisis Decisions Stall
Executive decision rights define who has final authority to approve consequential business actions during a cyber crisis, including accepting risk, suspending operations, and authorizing external disclosure.
Yet executive decision rights rarely seem urgent while everything is working. There is time to consult another executive, ask Legal for an opinion, move an uncomfortable question into the next committee meeting, or let an ambiguous responsibility survive because nobody is paying a visible price for it.
Then the incident begins.
Security believes an attacker may still have access to a critical environment and recommends isolating several systems. Operations warns that doing so could interrupt a major service. Legal cannot yet confirm whether the incident crosses a disclosure threshold. Communications wants to know what can be said publicly, and leadership is waiting for more certainty before approving anything irreversible.
The organization has people responsible for every part of the problem, yet the decision itself seems to belong to no one.
Recent research on cyber crisis readiness identifies this kind of responsibility ambiguity as a real weakness. Björck and colleagues found that undefined responsibilities can increase inefficiency during cyber crises, while stronger readiness depends on clear roles, cross-functional coordination, leadership involvement, and the ability to internalize responsibilities before pressure arrives.
That still leaves a harder question than who participates in the crisis.
Who actually decides?
When Cybersecurity Decisions Become Business Decisions
Many technical actions already have clear owners. Security teams can isolate endpoints, block malicious activity, revoke credentials, or activate incident-response procedures within established authority.
The difficult decisions appear when the security action creates consequences somewhere else in the business.
A shutdown may contain an attacker while stopping revenue. A delayed shutdown may preserve availability while expanding compromise. Early disclosure may protect trust while exposing incomplete information. Waiting may avoid unnecessary alarm while giving someone outside the company control over when the incident becomes public.
Harel and Carmeli’s 2025 cybersecurity oversight framework describes this separation between operational management and strategic decision control. Their research argues that boards should focus on matters such as organizational criticality, risk tolerance, strategic consequences, resource allocation, and accountability, while operational execution remains with management and technical teams.
That distinction becomes particularly important during a crisis because several legitimate authorities suddenly meet around the same decision.
The CISO understands the security risk, the COO understands operational consequences, Legal sees regulatory exposure, Communications sees stakeholder reaction, and senior management sees the broader business.
All of them should influence the decision.
They do not all need to own it.
Three Cyber Crisis Decisions That Need Clear Authority
Risk Acceptance: Who Gets to Say, “We’ll Live With It”?
The CISO can determine that a system is unsafe, explain the uncertainty, estimate potential exposure, and recommend containment, but that does not automatically mean the CISO should accept the resulting business risk on behalf of the organization.
Risk acceptance becomes a business decision precisely because its consequences reach beyond cybersecurity.
Harel and Carmeli argue that organizations should establish their tolerance for functional disruption and define the relative importance of critical assets before a breach occurs. Those discussions belong in routine governance because they create the boundaries within which crisis decisions can later be made quickly.
If the CISO is recommending continued operation despite known exposure, the organization should already know who has authority to accept that exposure.
Operational Shutdowns: Who Gets to Pull the Plug?
Shutdown decisions create the opposite problem. Security may believe isolation is necessary while Operations sees the shutdown itself as the larger immediate threat.
Harel and Carmeli use Colonial Pipeline as an example of this trade-off. The company shut down its pipeline network as a precaution even though the operational technology itself had not been infected, accepting major operational consequences to reduce further uncertainty and potential harm. Their framework explicitly treats shutdowns and service prioritization as strategic questions during an attack.
The point is not that shutdown is always the right decision. The point is that deciding who can authorize one should not begin after the recommendation has already been made.
Incident Disclosure: Who Approves What Goes Public?
Disclosure creates another collision of expertise. Security understands the evidence, Legal interprets regulatory obligations, Communications considers public impact, executives understand commercial consequences, and the board may need visibility where the incident becomes strategically significant.
Harel and Carmeli specifically identify questions around whether to disclose proactively, what information should be shared with customers, investors, and regulators, and how quickly that communication should happen.
Those perspectives need to meet, but collaboration cannot leave the final authority undefined.
A crisis committee where everyone can advise and nobody can close the decision is still a slow crisis committee.
When a RACI Leaves Decision Authority Unclear
Organizations often respond to governance ambiguity by documenting more roles.
That helps, but it is not enough.
Björck and colleagues distinguish between preparedness and readiness. Preparedness includes plans, procedures, simulations, and escalation protocols, while readiness includes the leadership, behavior, trust, communication, and adaptive capacity required when a situation no longer fits the script. Their findings show that an organization can be well documented without being genuinely ready to act.
A RACI can tell everyone why they are in the room and still fail to answer who has the final authority when those people disagree. A more useful approach starts with the decisions themselves.
Who can accept residual risk above normal tolerance? Who can suspend a business-critical service? Who can authorize emergency expenditure? Who approves external disclosure? Which decisions reach the CEO, and which require board involvement?
Once those decisions are named, the organization can attach authority to them instead of hoping authority will emerge naturally from job titles.
CISO Authority: Where Delegation Starts and Stops
Giving the CISO stronger authority is often part of the answer.
A security leader who needs executive approval for every containment action does not have a workable incident-response mandate. The CISO and security function need enough delegated authority to investigate, contain, escalate, activate specialist support, and enforce approved emergency controls without waiting for permission at every step.
The danger appears when that authority quietly turns into ownership of every business consequence associated with cybersecurity.
If shutting down a system will stop production, interrupt a critical service, create major financial losses, or affect customers at scale, the CISO’s recommendation remains essential, but the final business-risk decision may belong elsewhere.
This is where Executive Decision Rights create a healthier boundary. The CISO can act decisively within predefined limits while knowing exactly when authority moves to another executive because the consequence has crossed an operational, financial, legal, or strategic threshold.
The organization avoids two equally weak models: one where security cannot move without executive permission, and another where the CISO becomes the default owner of risks the business itself has chosen to take.
Five Rules for Executive Decision Rights Under Pressure
Drawing on the two studies, the following five rules translate their governance and readiness insights into practical recommendations for defining decision authority.
1. Tie authority to consequences
Incident severity alone is often too technical to determine who should decide. Escalation thresholds should also consider operational downtime, customer impact, financial exposure, sensitive-data compromise, regulatory consequences, safety, and critical dependencies.
Harel and Carmeli place this preparation in the pre-incident phase, where leadership should already understand critical assets, risk tolerance, and acceptable levels of disruption.
2. Separate advice from decision authority
Security can recommend shutdown without owning the commercial consequences. Legal can identify regulatory exposure without becoming the owner of every communication decision. Operations can explain continuity impact without deciding how much cyber risk the enterprise should accept.
The stronger the expertise in the room, the easier it becomes to confuse influence with authority.
A mature structure protects both.
3. Keep strategic and operational decisions separate
Boards should not become incident commanders, just as CEOs should not approve every forensic action.
Harel and Carmeli note that boards should receive information and consider strategic implications during an attack while avoiding continuous operational decision-making. Their role becomes more relevant when the issue reaches major shutdowns, ransom, stakeholder communication, legal exposure, or broader strategic prioritization.
Clear boundaries allow operational teams to move while leadership focuses on the decisions that actually require executive judgment.
4. Design decision rights for uncertainty
Cyber crises rarely wait until the facts are complete.
Björck and colleagues describe cyber crises as opaque, fast-moving, and difficult to manage through predefined procedures alone. Their research emphasizes situational sensemaking, where teams must interpret incomplete signals and make judgments under pressure when existing scripts no longer provide a complete answer.
Decision rights therefore need to work before certainty exists.
Someone must know who can approve precautionary action, when uncertainty itself justifies escalation, and when an earlier decision must be revisited because the evidence has changed.
5. Test authority in tabletop exercises
Most tabletop exercises test whether the organization knows what to do.
They should also test whether the organization knows who can authorize it.
Björck and colleagues found scenario-based exercises valuable because they expose managerial as well as technical gaps and help teams internalize their roles under stress. Their study also describes one organization using separate strategic and operational crisis structures, allowing one group to make decisions while another executed them.
A useful tabletop should therefore create disagreement deliberately.
Security recommends taking a critical service offline, Operations objects, Legal has incomplete information, and leadership wants another hour.
Who decides?
The attacker claims data exfiltration, the investigation remains uncertain, rumors are already circulating, and disclosure may become unavoidable.
Who decides now?
The exercise is not only testing whether the organization chooses correctly. It is testing whether the organization can choose at all.
Consensus Should Improve the Decision, Not Delay It
Cyber crisis management has to be collaborative because no single function sees the full picture.
The problem begins when collaboration quietly turns into a requirement for consensus.
Björck and colleagues found that cyber crisis leadership requires a balance between directive and collaborative approaches, particularly because cross-functional coordination becomes more important as uncertainty grows. Their research also shows how siloed leadership can weaken response when organizational boundaries remain stronger than the shared crisis structure.
Clear decision rights make disagreement safer.
The CISO can argue for containment, Operations can explain the cost, Legal can identify uncertainty, Communications can challenge the timing, and Finance can quantify the exposure without everyone needing to reach the same conclusion.
The decision owner hears the arguments and closes the decision.
That is not weaker collaboration. It is collaboration with an endpoint.
Conclusion: Define Decision Rights Before the Crisis
During routine operations, unclear authority is cheap. Another meeting can be scheduled, another executive can be consulted, and an ambiguous responsibility can survive for months without becoming visible.
A cyber crisis converts that ambiguity into delay.
Björck and colleagues argue that cyber crisis readiness depends on much more than documented procedures; organizations need internalized roles, adaptive behavior, leadership, and coordination that can survive pressure. Harel and Carmeli reach the same point through governance, arguing that organizations should establish tolerance levels, priorities, accountability, and crisis decision capacity before the attack begins.
Executive Decision Rights cannot guarantee that leaders will always make the perfect choice, because cyber crises rarely offer perfect choices.
They can ensure that when Security wants to shut something down, Operations wants to keep it running, Legal wants more evidence, and the clock is still moving, the organization does not have to solve one additional mystery.
Who decides?
For Further Reading
This blog post is based on insights and analysis from:
- Björck, Albena, et al. “Advancing cyber crisis readiness: context, microfoundations and the role of leadership.” Journal of Communication Management 30.3 (2026): 322-341.
https://doi.org/10.1108/JCOM-01-2025-0006
- Harel, Yaniv, and Abraham Carmeli. “A strategic cybersecurity oversight framework: a board’s imperative.” Journal of Cybersecurity 11.1 (2025): tyaf021.
