This paper explains the notions of crisis and business crisis in an organisation, their causes and consequences, as well as the role of crisis management in preventing, managing and overcoming crises. The concept of risk management is portrayed in the paper, with an emphasis on managing information security risk, which is covered in a separate chapter related to the importance and implementation of information security and data protection in conducting business. The notions related to information security are defined and the implementation of information security explained, along with references to relevant legislation in the Republic of Croatia, as well as to general regulations and guidelines on information security. The paper also draws attention to the contribution of international norms in resolving business crises through the establishment of a series of comprehensive security risk management strategies, by which information security is becoming crucial in maintaining competitiveness and productivity, as well as in building business reputation and image. The aim of the paper is to emphasize the importance of security related behaviour in organisations, as well as the way in which the management, through its initiatives, can ensure the continuity of conducting business and significantly influence an organisation’s culture, as well as the attitudes of all stakeholders towards respecting data protection policies.