Jelle Niemantsverdriet is a Senior Crisis Management Trainer at CCRC, with more than twenty years of experience in cybersecurity and incident response. He has worked at Fox-IT, Verizon, Deloitte, and Microsoft, helping organizations respond to incidents and build crisis management capabilities. In this interview, he explains where teams often stumble, what makes an exercise truly valuable, and what you should absolutely avoid in the first 24 hours.
A plan is not preparation
Jelle sees one recurring pain point in boardrooms: “I think a big misconception is that a board assumes having a plan is the same as being prepared. A plan can look neat and complete, but a crisis rarely follows your checklist. The value of a plan is not the printed or saved document. It is the process of thinking together about what could go wrong, who does what, and how you will communicate with each other when things get tense.”
That preparation is also why training is essential. “You don’t become a great football player by only reading the rules.”
“In practice, you won’t read that plan from start to finish when systems are down and phones are ringing off the hook. Then you need people who know how to think under pressure.”
The first ten minutes tell you everything
In exercises, Jelle can quickly see whether a team responds in a mature way. He uses an image that makes it instantly clear: “You could say they either sharpen the saw first, or they start sawing immediately. Teams that are less sharp jump straight into action mode. A first alert comes in and within thirty seconds someone is already saying, ‘we need to isolate the service’ or ‘call the supplier.’ It feels decisive, but you actually have no idea yet what’s going on.”
Teams that do get it do something that feels counterintuitive. “They actively slow down first and ask questions like: what do we know for sure? What don’t we know yet? Who is missing at this table?” It can feel like wasted time, but it is exactly what you need, because that first impulse decision in a real crisis is often not the right one.
Training should create friction, not wrap up neatly
A crisis exercise is only useful if you add real tension. “If everyone says afterwards, ‘that went pretty well,’ then it may have been a bit too safe. By building in pressure and uncertainty, teams learn to make choices without having complete information.”
An exercise does not need to end perfectly, either: “You sometimes see exercises end like a Hollywood scene, where everything is resolved.” But real crises are different. “They are messy, and sometimes you only find out weeks later what actually happened. By stopping an exercise while things are still unresolved, you train that reality. You have parallel teams, open questions, and decisions you still have to make.”
Where roles tend to clash
Jelle often sees tension between security, legal, and communications. Everyone is right from their own role, and that is exactly what makes it hard. “The CISO, for example, would ideally want to shut everything down. Legal says, ‘be careful what we share externally.’ Communications says, ‘we need to say something now, because silence will be filled in by others.’ The problem is not that one perspective is wrong. The problem is that you have to weigh the interests. The real challenge is bringing those perspectives together, and having someone from the crisis team say: okay, three interests, three perspectives, how are we going to balance them right now?”
He also frequently sees friction between operations and the rest of the crisis team. Operations is focused on recovery and investigation and needs calm, while the rest continuously asks for updates. “The crisis team wants an update every 20 minutes, and all those interruptions cost time. But without updates, the rest cannot act either. Finding the right rhythm, when you update, how detailed, and for whom, is exactly something you need to practice together.”
Deciding with 60% of the information
Teams learn to make decisions under uncertainty by practicing it, and as Jelle puts it, sometimes simply by forcing them to. “That sounds a bit harsh, but you force them to do it anyway. In an exercise you can build in moments where, with only 60% of the information, you still have to make a decision.”
What helps is making uncertainty explicit: “What do we know for sure? What is an assumption? What do we need to do to confirm or disprove that assumption? What is the risk if the assumption is wrong?” Saying this out loud turns it into a conscious decision under uncertainty, rather than a guess. In a crisis, a reasonable decision now is often better than a perfect decision later.
“Not deciding, or not making a choice, is also a choice. And in the end, it is often a very bad one.”
The biggest mistake in the first 24 hours: silence
When it comes to communication, Jelle mentions one mistake most often: saying nothing. In his view, silence is the biggest vulnerability in a crisis. Not the technology, but silence. “It is understandable, because everyone wants to be sure first and seeks alignment. They are afraid of saying the wrong thing. Legal wants alignment first. The CEO wants all the facts first. Communications is waiting for approval. Meanwhile, the outside world will fill in that silence itself.”
Jelle is annoyed by the cliché that humans are the weakest link. “I think that is an untrue statement. In my view, people are the solution. But that only works if people feel safe enough to speak up, and if reporting is set up to be easy, with feedback. Better nine false alarms than one report too few.”
Finally, he emphasizes that early and honest communication is best, even if you do not know everything yet. “It is best to communicate early, be honest, and dare to say what you do not know yet. Also make your update rhythm concrete. We will come back with an update in two hours. And then you actually need to come back with an update in two hours.”
In the end, crisis management is not about the perfect playbook. It is about teams that dare to slow down, dare to speak up, and stay on course together when things get tense.