Other cookies are configurable.
ECL, the certification for the executives who lead the crisis.
Executive Crisis Leader is a three level certification for board members, executives and the people who chair the crisis team. It is built on ISO 22361 and on the duties that NIS2, DORA and the CER Directive now place on the management body, and it is taught by practitioners who have run crisis functions themselves.
The law now expects the board to lead the crisis, not watch it
ECL, the Executive Crisis Leader certification, is Resilience Guard Academy's credential for the people who will be held accountable when a crisis outruns the plan: board members, executives, crisis team chairs and the designated crisis leaders who run the capability.
Most crisis training teaches staff to follow a plan. Serious crises rarely follow one. The global IT outage of July 2024 and the Iberian blackout of April 2025 both started outside the organisations they hurt, spread through suppliers and networks that nobody in those boardrooms controlled, and the questions afterwards were about what the leaders knew and decided in the first hours.
European law has caught up with that. NIS2 Article 20 requires management bodies to approve and oversee cybersecurity risk measures, to follow training and to answer for failures. DORA Article 5 gives the management body of a financial entity final responsibility for ICT risk. The CER Directive expects critical entities to run crisis management procedures and to train the people who carry them out. Accountability for crisis readiness now sits with named people, and ECL is built for them.
Each day answers one question a leader cannot delegate
01Govern and Decide
What am I personally accountable for, and what do I do in the first hours? The day separates a crisis from a large incident, sets out the duties of the board under NIS2, DORA, CER and national law, builds the parallel notification clocks into one timetable, and ends with the structure of the crisis team and the first public statement.
02Build and Run
How do I build the capability and run the team when it is live? Horizon scanning and cascade mapping, the battle rhythm of the crisis team, decision logs and legal privilege, communication with regulators, markets, employees, those harmed and the media, and exercises designed so they can fail.
03Lead Through Complexity
How do I lead when the crisis is cascading, hybrid, prolonged or existential? Working with the state and other critical entities, liquidity and legitimacy crises, artificial intelligence and synthetic media in the crisis room, and then a three hour assessed simulation.
Three credentials, with one hard gate before Expert
Every decision in the crisis room runs through the same fifteen minute cycle
The RG BRIDGE Cycle is the decision model taught at every ECL level. Resilience Guard designed it for the crisis room and named it after a ship's bridge, where the watch keeps deciding while the situation keeps moving.
It puts the pressure where crisis teams usually fail. The regulatory clocks sit inside the cycle rather than beside it. An appointed challenger speaks before the chair decides, not after. And no decision leaves the cycle without an owner, a deadline, a message and an entry in the log, which is what a supervisor or an inquiry will ask to see.
The cycle is introduced on Day 1, worked in timed decision sprints on Day 2 and observed under pressure in the Expert simulation. The anticipation and risk content uses the 7A Risk Management Framework, so ECL holders and 7A practitioners speak the same risk language.
Built on ISO 22361 and on the duties that now reach the management body
ISO 22361:2022
The international guidance standard for strategic crisis management, written for top management, and the spine of the curriculum alongside ISO/TS 22360 on how crises develop. ISO text is paraphrased and cited, never reproduced.
NIS2 Article 20
Management bodies approve and oversee cybersecurity risk measures, follow training and can be held liable. Articles 21 and 23 add crisis management and the reporting sequence of 24 hours, 72 hours and one month.
DORA Articles 5 and 11
The management body of a financial entity carries final responsibility for ICT risk and must keep its knowledge current. Article 11 requires response and recovery plans and a crisis management function.
CER Directive Article 13
Critical entities need crisis management procedures, protocols and alert routines, and people trained to run them. Article 15 adds incident notification within 24 hours.
National law
The German KRITIS umbrella act and NIS2 transposition, the Swiss Information Security Act with its 24 hour reporting duty, FINMA Circular 2023/1 for supervised firms, and Greek Law 5236/2025, which transposes the CER Directive.
Market disclosure
For listed issuers, ad hoc disclosure under the EU Market Abuse Regulation and the SIX rules runs alongside the security clocks. The course treats all of them as one timetable for the crisis team.
The language of the course is sector neutral. Its cases and its regulation carry the weight of critical infrastructure, because that is where the hardest of these duties fall.
CIRP proves the organisation is resilient. ECL proves its leaders can run the crisis.
CIRP and ECL are built as one family. CIRP certifies the people who make a critical entity resilient and compliant under NIS2, the CER Directive, KRITIS and the Swiss ISG. ECL certifies the people who lead that entity when its resilience is tested for real. The two schemes share governance, examination discipline and naming, so a CIRP holder recognises the structure from the first hour.
For many CIRP holders ECL is the natural next step, because careers move the same way: from building the programme to being the person in the room when it is used. The right ECL level depends on the role you hold now more than on your CIRP tier.
- CIRP-F holders in a board or executive role usually start with ECL-F, which takes the regulatory picture they already know into the boardroom and the first 24 hours.
- CIRP-A holders who chair or sit on the crisis team, with five years in management, go straight to ECL-A, where Day 2 builds on the programme work CIRP-A trained.
- CIRP-E holders already carry the accountability. Those who lead or deputise for the crisis team take ECL-A and then ECL-E, since Expert is open only to ECL-A holders. Board members among them usually find ECL-F or ECL-A the right level, because their duty is oversight rather than running the team.
Professional development hours are recognised in both directions. There are no examination exemptions either way, because each scheme tests something the other does not. Each ECL textbook carries a short box titled Where CIRP takes this further, at the points where the duties of the entity meet the decisions of its leaders.
The examinations test judgement, because that is where crisis leaders fail
Foundation and Advanced are examined by closed book multiple choice papers in which most questions open with a short board or executive scenario, and Advanced adds mini cases. Pure recall is kept to vocabulary and regulatory facts. Papers are sat after the course or proctored online, and results are issued within three business days.
Expert is assessed on what the candidate does. Each candidate chairs the crisis team for at least one phase of a three hour hybrid and cascading simulation on Resilience Arena, observed by two assessors who score behaviour rather than outcome. Scenario questions and a one page board memo on a set case complete the assessment, and results are issued within five to ten business days of the last submission.
The examination process is designed on ISO/IEC 17024 principles. The tutor who teaches a cohort does not mark its papers, results and appeals go to an examination board, and candidates sign a code of ethics. ECL is issued by Resilience Guard Academy and is not accredited by a third party. Renewal follows the same rules as CIRP, and a Crisis Management Masterclass run with your own team counts as exercise evidence when you renew.
Run for your own leadership team, online or in person
ECL runs as in house cohorts for a single organisation, live online or at your site anywhere in Switzerland, the EU and the UAE. Content and examinations are the same in both modes, and in person delivery adds travel and accommodation for the tutor. Teaching is in English at launch, with Greek and German to follow.
ECL and the Crisis Management Masterclass do different jobs. The Masterclass is a single day exercise that tests a leadership team together. ECL trains and certifies each person. Many organisations certify their executives through ECL first and then test them as a team in a Masterclass. The Masterclass gives no entry credit to any ECL level, since it has no individual assessment.
Frequently asked questions
What does ECL stand for?+
ECL stands for Executive Crisis Leader, the certification Resilience Guard Academy awards at three levels: ECL-F Foundation, ECL-A Advanced and ECL-E Expert. It certifies the person who leads, sits on or advises the crisis team, not the organisation's plans.
Who is each ECL level for?+
ECL-F Foundation is for board members, non executive directors, chief executives, finance and operating officers, general counsel and country heads. ECL-A Advanced is for executive committee members, crisis team chairs and members, and the risk, security, information, communication, people and legal officers who hold a crisis role. ECL-E Expert is for designated crisis leaders and their deputies, chiefs of staff, heads of resilience, security and continuity, and senior advisers to the board.
I hold CIRP. Is ECL the right next step?+
For many CIRP holders it is the natural next step. CIRP certifies the people who make a critical entity resilient and compliant, and ECL certifies the people who lead it when that resilience is tested. CIRP-F holders in a board or executive role usually start with ECL-F. CIRP-A holders who chair or sit on the crisis team, with five years in management, go straight to ECL-A. CIRP-E holders who lead or deputise for the crisis team take ECL-A and then ECL-E, while board members among them usually find ECL-F or ECL-A the right level, because their duty is oversight rather than running the team. See the CIRP page for the companion scheme.
Do CIRP holders receive credit or exemptions in ECL?+
Professional development hours are recognised in both directions, so ECL hours count towards CIRP renewal and CIRP hours count towards ECL renewal. There are no examination exemptions in either direction, because each scheme tests something the other does not. Holding CIRP-E does not give entry to ECL-E, which is open only to ECL-A holders.
Do I need ECL-F before ECL-A?+
No. ECL-A can be entered directly by attending Day 1 and Day 2. A Foundation holder may instead attend Day 2 only and sit the Advanced examination within 24 months of passing Foundation. ECL-A in date is the only route into ECL-E.
How is ECL assessed?+
Foundation and Advanced are examined by closed book multiple choice papers in which most questions open with a short board or executive scenario, and Advanced adds mini cases. Results are issued within three business days. Expert is assessed on performance: each candidate chairs a crisis team in a three hour simulation observed by two assessors, then completes scenario questions and a one page board memo. Expert results are issued within five to ten business days of the last submission.
How is ECL different from the Crisis Management Masterclass?+
The Crisis Management Masterclass is a single day exercise that tests a leadership team together. ECL is a certification that trains and examines each person, with a textbook per level. Many organisations certify their executives through ECL and then test them as a team in a Masterclass, which also counts as exercise evidence at ECL renewal. The Masterclass gives no entry credit to any ECL level.
How is ECL different from other ISO 22361 crisis management certifications?+
Most crisis management certifications are written for implementers and consultants and test knowledge of the standard. ECL is written for the board and the executive, carries the duties that NIS2, DORA, the CER Directive and national law place on the management body, and at Expert level assesses the candidate leading a live simulation. ISO 22361 is its spine, paraphrased and cited, never reproduced.
Is ECL accredited?+
ECL is issued by Resilience Guard Academy and is not accredited by a third party. Its examination process is designed on ISO/IEC 17024 principles, so the tutor who teaches a cohort does not mark its papers and results and appeals go to an examination board.
Can ECL be delivered in house or online?+
Yes. ECL runs as in house cohorts for a single organisation, live online or at your site anywhere in Switzerland, the EU and the UAE, with the same content and examinations in both modes. Teaching is in English at launch, with Greek and German to follow.
Related programmes
CIRP Professional Certification
The European training architecture for critical infrastructure resilience under NIS2, the CER Directive, KRITIS and the Swiss ISG, in three tiers plus a workforce awareness programme.
Crisis Management Masterclass
One intensive, practitioner led day that prepares boards and executives to lead through a serious crisis, anchored on ISO 22361.
Top-Team Exercises
Board level crisis simulations that place your leadership team inside a realistic, escalating disruption, scored and debriefed.
Crisis Management Exercises
Tabletop exercises, functional and cyber crisis exercises and full scale rehearsals: the exercise programme that proves your plans and evidences ISO 22301, NIS2 and DORA.
Operation HELVETIA
Our proprietary gamified crisis decision exercise: 72 cards, six functions, one cascading ransomware crisis, ninety minutes.
7A Risk Management Framework Training and Certification
A three level pathway on the proprietary 7A framework, from Foundation through Professional to the governed Lead and Assessor scheme.
Certify the people who will lead the response.
Whether you sit on a board, chair a crisis team or hold CIRP and now lead what you built, the first step is a conversation about your team and the right level. We respond within one working day.
Book a consultation