VSI GLOBAL // ENTERPRISE ARCHITECTURE

EP-025-crisis-actions-playbook-collection

10 min read

[OPERATION - ENGAGEMENT REF] - Crisis Actions Map

EP-025 Crisis Actions Playbook - process workspace for the drill library and decision flow that executes the Emergency Action Plan (EP-012) on this engagement. Central topic = this operation’s crisis-response posture. Branches = the universal sequence, the drill library, the leader decision flow, comms formats, casualty/CASEVAC, notification, post-incident, and rehearsal standard that EP-025 defines. Tick drills as rehearsed; run the decision/comms/notification branches live during an actual incident; log everything in §99. → feeds/executes deliverable EP-025; engagement data (facilities, rally points, numbers) is read by pointer from EP-012, EP-002, and the region package - do not duplicate that data here.

00 * Process Plan - Gates & Triggers

The drill doctrine and the universal sequence every drill below specializes. Rehearsal currency gates movement per EP-020 G5; this branch is the pre-flight check that the doctrine is understood and current before any drill is called live. → EP-025 SS1 Purpose and Drill Doctrine, SS2 Universal Crisis Sequence.

Doctrine gate (SS1)

  • Drill definition briefed: pre-decided first [60-120] seconds, executed without orders
  • “Any operator may call any drill” briefed; wrong-but-safe call is never punished
  • Three valid drill end states briefed: principal secured in place / evacuated / casualty care in progress
  • Every operator can state where EP-012 pointer data lives (daily brief card per EP-016)
  • Rehearsal currency at brief time: [date of last drill per drill, from EP-021 log]

Universal Crisis Sequence (SS2) - the six steps every drill runs

  • 1. Call it: drill name + location on the net, flash per EP-011
  • 2. Cover: body cover and cover from view between threat and principal
  • 3. Move or hold: call-maker states which, per the drill’s default
  • 4. Account: principal, party, operators, by name/callsign, at a secure point
  • 5. Report: SITREP to Team Leader; external calls per Notification Matrix (→ 05)
  • 6. Transition: hand to responding services, EP-012 sustained procedures, or stand-down per leader
  • Decision: [ ] sequence confirmed briefed to full detail roster this rotation

01 * Drill Serials

The drill library - each drill is a specialization of the universal sequence at 00. Seed each drill once, clone the block per rehearsal cycle or per new venue/AO to log a fresh run. → EP-025 SS3 Drill Library (3.1-3.8); rehearsal currency feeds 07 Rehearsal Standard and EP-021 battle rhythm.

3.1 Attack on Principal (AOP) serial

Clone per rehearsal run or live execution.

  • [run - e.g. weekly rehearsal, venue X, 2026-07-06]
    • Call: “AOP + location”
    • Nearest operator body-covers the principal
    • Principal moved off attack line to hard cover or vehicle, whichever is faster
    • Driver brings vehicle to principal where geometry allows
    • Evacuate along briefed egress; no engagement beyond lawful defense of the principal
    • Accountability at safe haven / rally point
    • End state: [principal evacuated to safe haven per EP-012 / casualty drill stacked]
    • Time to principal-under-cover: [ ] sec (standard: SS9)
    • Notes / corrections: [ ]

3.2 Medical Emergency serial

Clone per rehearsal run or live execution.

  • [run]
    • Call: “MEDICAL + who + location”
    • Detail medic to casualty; close cover maintained on principal by remaining operators
    • Treat per training scope: hemorrhage first (SYS-009 / SYS-010 kits)
    • Evacuation decision per 04 Casualty Management (self-transport vs. EMS)
    • Hospital escort posture set per EP-012
    • End state: [casualty in definitive care, protective coverage maintained]
    • Notes / corrections: [ ]

3.3 Vehicle Contact / Blocked Route serial

Clone per rehearsal run or live execution.

  • [run]
    • Call: “CONTACT VEHICLE / BLOCKED + location”
    • Unblocked vehicles create standoff and cover the principal vehicle
    • Decision: [ ] drive through / reverse out / cross-load
    • Cross-load executed under body cover on protected side (if selected)
    • Move to alternate route or safe haven
    • If immobilized and threatened: defend in place per lawful posture, LE called
    • End state: [principal mobile on alternate / secured awaiting response]
    • Notes / corrections: [ ]

3.4 Residence / RON Intrusion serial

Clone per rehearsal run or live execution.

  • [run]
    • Call: “INTRUSION + point”
    • Principal to safe room per EP-012 residence annex with one operator
    • Remaining posts collapse to protective core, not toward the intruder
    • Lights / announce per residence policy - denial and withdrawal, not capture
    • LE called per Notification Matrix (→ 05)
    • No clearing beyond what protecting the core requires; hold for responders
    • End state: [principal in safe room; responders clearing; accountability held]
    • Notes / corrections: [ ]

3.5 Fire / Environmental serial

Clone per rehearsal run or live execution.

  • [run]
    • Call: “FIRE/ENVIRONMENTAL + location”
    • Immediate movement along walked egress from EP-002 (not the crowd default exit)
    • Low-smoke discipline observed; no elevators
    • Mount vehicles or muster upwind / upgrade at briefed point
    • Vehicle fire only: occupants out and upwind [50+ m]; extinguisher (SYS-010) on incipient fire only if egress secure
    • End state: [party clear, accounted, moving to alternate location]
    • Notes / corrections: [ ]

3.6 Lost Communications serial

Clone per rehearsal run or live execution.

  • [run]
    • PACE fallback executed in order per EP-011
    • Unreachable mobile element proceeds to briefed rally / lost-comms point and holds
    • Detail assumes elevated posture until picture restored
    • Overdue past [T+X min]: search / notification sequence triggered
    • End state: [comms restored / overdue procedure running]
    • Notes / corrections: [ ]

3.7 Missing Principal serial

Clone per rehearsal run or live execution.

  • [run]
    • Call: “PRINCIPAL UNACCOUNTED + last known”
    • Freeze and search from last known outward (hold, restroom option, vehicles, egress paths per EP-002 advance geometry)
    • Venue lockdown request via liaison where cooperative
    • Decision: [ ] at [T+X min] unfound, or any hostile indicator: treat as abduction
    • LE notified per Notification Matrix; all movement stops; scene preserved (if abduction path)
    • End state: [principal recovered / LE-led response running, detail record handed over]
    • Notes / corrections: [ ]

3.8 Arrest / Detention by Authorities serial

Clone per rehearsal run or live execution.

  • [run]
    • Comply - no obstruction, no argument at the scene
    • Call: “DETENTION + who + authority + location”
    • Identify per license and region package legal annex; volunteer nothing beyond identification without counsel
    • Team Leader engages counsel and client channel per Notification Matrix
    • Detail continuity: remaining operators re-form coverage on principal
    • End state: [legal process running with counsel engaged; coverage intact]
    • Notes / corrections: [ ]

02 * Crisis Decision Flow - Leader Sequence

Runs from the moment a drill’s immediate actions are moving; this is the leader’s judgment layer after the drill’s pre-decided first seconds end. → EP-025 SS5 Crisis Decision Flow (Leader Sequence).

  • 1. Confirm drill end state is being reached; redirect only if geometry is failing
  • Decision: [ ] threat still active - hold protective posture; do not release cover for care/accountability tasks others can do
  • Decision: [ ] casualties present - route to 04 Casualty Management (self-evacuate vs. EMS, facility)
  • 2. Report and notify per 05 Notification Matrix; start log clock (who / what / when) at 99
  • Decision: [ ] continue / relocate / abort today’s activity per OPORD no-go criteria (default after AOP, intrusion, or abduction indicator: abort to safe haven and hold)
  • Stand-down gate - all required before stand-down:
    • Accountability complete
    • Threat assessed clear or handed to LE
    • Casualties in care
    • Principal decision made
    • Client notified

03 * Comms Formats

The transmission formats that carry every drill call, report, and duress signal. → EP-025 SS4 Crisis Communications Formats.

Drill call

  • Format used: “[DRILL NAME], [LOCATION], [initiator callsign]”
  • Note: nothing else required to start execution

Flash SITREP (within [5] min, leader to Team Leader)

  • Field: situation: [ ]
  • Field: principal status: [ ]
  • Field: casualties: [ ]
  • Field: location and direction: [ ]
  • Field: support needed: [ ]
  • Sent within [5]-minute standard

Duress

  • EP-011 duress word recognized in any transmission = coercion
  • Do not acknowledge on net
  • EP-011 duress procedure executed

External emergency call

  • Field: location: [ ]
  • Field: nature: [ ]
  • Field: casualties: [ ]
  • Field: caller identity stated as: [security staff]
  • No client identification given beyond what response requires

04 * Casualty Management & CASEVAC

Hemorrhage-first care, the self-transport-vs-EMS decision, and hospital protocol; feeds and is fed by every drill in 01 that produces a casualty. → EP-025 SS6 Casualty Management and Evacuation.

  • Massive hemorrhage addressed first
  • Kits used per scope: SYS-009 (individual) / SYS-010 (vehicle)
  • Treatment kept within trained scope only
  • Decision: [ ] self-transport (stable-movable, facility within [X] min) vs. EMS (unstable / entrapped / scene-safe to wait)
  • Field: facility / trauma center selected (from EP-012 / EP-002 / region package): [ ]
  • One operator escorts and stays with casualty
  • Protective coverage of principal never reduced below [floor] to staff the escort
  • Family / client notification made by Team Leader, not from the scene
  • Operator-down case: principal’s protection continued without pause, or day aborted

05 * Notification Matrix

Who gets called, how fast, and by whom for each event class. → EP-025 SS7 Notification Matrix.

Any drill executed (no injury / loss)

  • Immediate: Team Leader notified
  • Same day: client ops contact briefed; log + EP-017 entry made
  • Authority: Shift Lead notifies

Casualty (any)

  • Immediate: Team Leader; EMS/LE as needed
  • Same day: client principal channel; insurer per BIZ-012; family per client protocol
  • Authority: Team Leader

Criminal act (attack, intrusion, abduction indicator)

  • Immediate: LE per region package; Team Leader
  • Same day: client; counsel; referral package per EP-024 SS10 where surveillance history exists
  • Authority: Team Leader

Detention / legal

  • Immediate: counsel; Team Leader
  • Same day: client; licensing authority if reportable
  • Authority: Team Leader

Firm-reportable incident (use of force, weapon display)

  • Immediate: Team Leader; counsel
  • Same day: insurer; licensing authority per jurisdiction
  • Authority: Team Leader

06 * Post-Incident Actions

The sequence run after any drill that produced an incident of consequence, before the detail returns to routine posture. → EP-025 SS8 Post-Incident Actions.

  • 1. Preserve: scene photos (where lawful and safe), kit and vehicle states, net logs, device data per SYS-003 handling - nothing deleted, nothing reconstructed later
  • 2. Statements: operator accounts written independently, same day, facts only, before group discussion; use-of-force accounts follow counsel’s direction
  • 3. Report: incident AAR per EP-017 within [72] hours; serious incidents get full sequence (chronology, decision review, corrective actions)
  • 4. Care: post-incident operator screening per firm policy; shaken operator relieved without stigma; backfill via ART-vendor-roster
  • 5. Feed-forward: corrective actions routed and versioned into EP-012 data, this playbook’s drills, EP-020/EP-021 process
  • Field: AAR reference: [ ]
  • Field: corrective actions opened (route to §99 open actions): [ ]

07 * Rehearsal Standard

The cadence and performance floor that keeps every drill in 01 current and gate-ready. → EP-025 SS9 Rehearsal Standard; feeds EP-020 G5 and EP-021 battle rhythm.

  • Cadence: at least one drill per week on the battle rhythm (EP-021)
  • Full library cycled within [8] weeks
  • New AO or venue set: AOP, medical, and vehicle drills run before first movement (EP-020 G5)
  • Decision: [ ] realism floor met - walked at actual venue/vehicle where operationally acceptable, tabletop otherwise
  • Drill never rehearsed at site flagged in G5 brief
  • Field: standard - initiation to principal-under-cover: [X] sec
  • Field: standard - accountability complete: [Y] min
  • Misses logged and re-drilled, not waived
  • Rehearsal log entry made (date, drill, participants, time-to-standard, corrections) with EP-021 daily logs

99 * Execution Admin

Running decision/deviation log, product register, sign-offs, and open actions for this crisis-actions instance of the engagement. Not a deliverable section; feeds EP-025 usage record and EP-017 AAR chain.

Decision / deviation log (running, from 02 stand-down gate)

  • [entry - who / what / when]
  • [entry 2]

Product register (deliverables this process produced or updated)

  • EP-017 incident AAR: [reference / status]
  • EP-012 EAP data correction: [reference / status]
  • EP-021 rehearsal log entry: [reference / status]

Sign-offs

  • Team Leader: [initials / date]
  • Detail Medic: [initials / date]
  • Counsel (if detention/legal event): [initials / date]

Open actions / RFIs

  • [open item] → route to [drill / decision / notification / post-incident branch]
  • [open item]

Graph View