Violence and assault
Who closes the facility in the event of a threat or attack — and who is allowed to announce it without confirmation from above.
Leadership readiness
Preparing for a crisis
We'll assess your readiness, build a crisis playbook with an escalation threshold, and practice decision-making before you need it for real.
readiness assessmentcrisis playbookstaff exercise (TTX)
He is responsible for this service
Lumír Němec
GBH Group Security Director
A crisis does not come according to a script
Threat, blackmail, attack, fire, system failure or media coverage will come most of the time outside working hours and at once. At that moment, two things decide: whether you have an escalation threshold — a predefined criterion when the event ceases to be an operational incident and the crisis team is called — and whether you know who calls whom first, what immediately shuts down or shuts down, what is protected on the contrary, and who talks outside. Without it, time is wasted and decisions are made by the person on the phone — not the one with authority and distance.
- Incidents occur suddenly and usually outside working hours.
- Without an escalation threshold, the event will either be underestimated or cause an unnecessary alarm.
- Under pressure, the one on the phone makes the decision — not the one with the authority.
- An unrehearsed procedure is just a document; under pressure one does what is rehearsed.
Scope
What the product is — and what it isn't.
Includes
- Readiness assessment: roles, contacts, gaps
- Scenario matrix, decision tree and escalation threshold
- Communication layers included holding statement — a pre-prepared first statement
- Staff training (TTX) separately for management and for operation
- Post-incident evaluation and playbook review
Does not include
- We do not track or verify third parties
- We do not replace IZS files or crisis plans according to the Crisis Act
- We do not guarantee that an incident will not occur
- We make no promises zero risk
Procedure
First the reality. Then measures.
-
01
Readiness
Readiness assessment
Let's measure the default state: who will decide on the evacuation today, who is allowed to talk to the media, in how many minutes the crisis team will meet. The output is gaps and unclear roles.
-
02
Readiness
Playbook and escalation threshold
For each scenario, we build a decision tree and an escalation threshold — a criterion for when the event is still an operational incident and when the crisis team is activated.
-
03
Reaction
Staff Exercise (TTX)
Practicing crisis decision-making at the table. The facilitator throws in injects — new inputs simulating the development of the situation — and management practices separately from traffic.
-
04
Restoration
Restoration and learning
The crisis does not end with mastering the first hours. After both the exercise and the actual incident, we evaluate what worked and what didn't and translate the lessons learned into the playbook.
Coverage
For each type of non-routine situation, we prepare a specific decision that the playbook addresses — not a universal lesson. For each domain, you know who decides, according to what and what is never done.
Blackmail and coercion
Whether and when to respond to writers, what never to send and when to turn the matter over to the police.
Evacuation and unavailability
Who has the authority to declare an evacuation or, on the contrary, an evacuation — hiding people in an object.
Operational and Cyber Outage
What disconnects immediately, what continues to run, and when the business continuity plan is activated.
Reputation and media crisis
One approved version of the message: who is speaking out, what is being said and what is not being published.
Key person out of reach
Who takes over decision-making and in what order when the owner cannot be reached.
Output for management
The crisis playbook
Both the printed card and the digital version; separate abbreviated cards for management and for reception/security.
What the document contains
- Scenario matrix with priorities and escalation threshold
- Decision tree: who decides and who informs whom
- Escalation and contact list (internal and external)
- Communication layers: employees, clients and partners, media, authorities, insurance company
- Minutes from the staff exercise with specific adjustments to the playbook
The playbook is a private equivalent of a crisis plan according to the crisis law — for the files of the Social Security Administration it continues, not replaces them. And it is concise, so you can use it under pressure, not a pile of theory in a drawer.
Role and mode
Who decides and how we cooperate.
- 01
Crisis manager (client)
Appointed person with the authority to activate the crisis mode and make decisions.
- 02
Backup leader
He takes over decision-making according to the same playbook when the main is out of reach.
- 03
GBH contact advisor
Facilitates exercise; in an acute crisis, he sits alongside your crisis team and guides you through the process.
- 04
Spokesperson / Communications
Holds a single approved version of the message; others refer to it.
Operational log
- We recommend a staff exercise at least once a year; new even after a merger, incident or role change.
- Management and operations train separately — each level deals with different decisions and the mixed exercise falls apart.
- Every real incident is followed by an evaluation: what worked, what didn't, what we are changing.
- The activation contact and escalation threshold are agreed upon in advance, not improvised.
- One time build
- Readiness assessment, playbook and one staff exercise as a closed project.
- Emergency flat rate
- Continuous update of the playbook, annual training and agreed activation line in case of an incident.
- Activation
- In the event of an incident, you call a pre-arranged contact; a counselor joins the crisis team and walks you through the playbook.
- Scope by scenarios
- We adapt the depth to what is realistically at risk; we don't do exercise for exercise's sake.
Discretion
There is no one to learn about cooperation with us. We work in mode need-to-know — only those who need it for their role have the information. The crisis playbook contains sensitive data about your people and operations, so we store it securely and pass it on only to named persons. We proceed inconspicuously, without ostentatious measures that would attract attention in themselves.
- Nondisclosure Agreement (NDA) as standard
- Secure storage and transfer of the playbook
- Access only for verified and appointed persons
- Unobtrusive procedure, no ostentatious measures
Standards and the law
Trusted capacity, within the limits of the law.
- A team with experience in security, crisis management and personal protection.
- Screened and contracted people, no random subcontractors.
- We are methodologically based on the logic of ISO 22301 (business continuity, BCM) and ISO 31000 — for us, they are a guide, not a certification.
- For soft targets, we respect the methodology of the Ministry of the Interior of the Czech Republic for soft targets.
- We work within the framework of the relevant authorizations; activities tied to the concession only in their scope.
We work within the law. We don't do what's over the edge. We only propose legal and reasonable measures, we handle data according to GDPR and we do not track or audit third parties. We do not have and do not offer any offensive capabilities against anyone else. We respect confidentiality — but it has legal limits, which we will tell you in advance.
Proof system
Specifically, but discreetly.
A service detail should not end with a promise. It shows an anonymized scenario, methodology and output that management will really use.
We do not show the client. We show the decision.
- 3 phases Preparedness → response → recovery. Each with a named output: assessment, playbook, evaluation report.
- 2 levels Exercises separately for management and operation. The management practices communication and escalation, the operation takes the first steps on site.
- 1x a year Recommended practice frequency. New exercises even after a merger, incident or role change.
Deliverable preview
The crisis playbook
- Scenario matrix with priorities and escalation threshold
- Decision tree: who decides and who informs whom
- Escalation and contact list (internal and external)
Part of the GBH group
GBH Partners
Evacuation of people and emergency airlift if the scenario requires a move.
GBH Capital
Investment division of the security infrastructure financing group.
GBH Cyber
Responding to an incident that starts in data or systems.
GBH Bunker
Protected background and shelters, if the plan provides for shelter in place.
GBH Academy
Rehearsal and training of the team to act according to the plan.
Related services
All services
Digital resilience
Cyber and data resilience
digital footprint map
incident response (IR) plan
priorities for management
Protection of persons
Protection of persons
personal risk profile
graduated protection mode
transfer plan with variants
Advisory
Security consulting
monthly risk brief
monitoring exposure changes
prioritized by impact
Questions for decision
Is it legal? Are you unfollowing someone for that?
Yes, it is legal. Crisis preparedness is organizational preparation — decision-making procedures, contacts and training. We do not monitor or verify third parties and do not replace IZS files; your playbook follows up on their intervention. We work within the framework of the relevant authorizations and within the limits of the law.
Will the preparation disrupt the normal operation of the company or family?
Nope. Most of the work is assessing readiness and building a playbook with you. A staff training exercise (TTX) — practicing crisis decision-making at the table — usually takes a few hours, with no real evacuation or alarm. We choose dates so that they do not interfere with traffic.
Who will learn about the collaboration?
Only the people you specify yourself. We work on a need-to-know basis and with a non-disclosure agreement. We store sensitive parts of the playbook securely. But there are legal limits to confidentiality — we'll tell you in advance, not in a crisis.
When does it make sense to activate the playbook?
This determines the escalation threshold that we agree on in advance and write into the playbook — typically a threat, blackmail, assault, evacuation, outage, or media coverage. In the emergency package, you call the agreed contact and we will guide you through the prepared procedure.
Do you guarantee that nothing will happen?
No, and no one can honestly guarantee that. We cannot rule out an incident. But we can reduce the time before you start to act correctly and reduce the chaos in the first minutes. Residual risk always remains and we say it out loud.
Does this also apply to schools and families?
Yes. For soft targets — publicly accessible places with a higher concentration of people, such as schools — and for families, we choose a calm, matter-of-fact tone. We will prepare procedures without scary details and without pressure on children.
Let's start with a casual conversation
"We'll talk about what's really threatening and what makes sense to prepare for. First we'll find out the real situation, only then will we propose measures — and we'll also tell you what you don't need."
Tomáš Šlesinger · GBH Group Security Advisor
Contact us
The first step doesn't have to be big. It must be correct.
First contact protocol
First we understand the situation. Then we suggest the next step.
Briefly write what you are dealing with. We will contact you discreetly and arrange a safe call format.
Call safely