Quick reference
Key formula / structure
Name the domain, then follow its order: simple sense-categorize-respond; complicated sense-analyze-respond; complex probe-sense-respond; chaotic act-sense-respond.
Memory aid
Before you choose what to do, decide what kind of problem you have. The wrong label brings the wrong response.
TL;DR
The Cynefin framework, from Snowden and Boone (HBR, 2007), sorts situations by how cause and effect relate. Simple: the answer is known; sense, categorize, respond. Complicated: experts can find it; sense, analyze, respond. Complex: it emerges only in hindsight; probe with safe-to-fail experiments, then sense and respond. Chaotic: act first to establish order, then sense and respond. Disorder: you do not know which applies, so settle that first. Most failures come from applying a favorite response in the wrong domain.
What Is Cynefin Framework?
The Cynefin framework is a way to decide what kind of situation you are in before deciding what to do. It has five domains. Four of them (simple, complicated, complex and chaotic) each call for a different response; the fifth, disorder, is the state of not knowing which of the four applies. David J. Snowden and Mary E. Boone set it out in the Harvard Business Review in 2007.
Unfortunately, most leadership “recipes” arise from examples of good crisis management. This is a mistake, and not only because chaotic situations are mercifully rare.
— David J. Snowden and Mary E. Boone, "A Leader's Framework for Decision Making," Harvard Business Review (November 2007)
Each domain is defined by how cause and effect relate. In a simple context established practice applies: "Here, leaders sense, categorize, and respond." In a complicated one there may be several right answers and a clear link between cause and effect that "not everyone can see": "This is the realm of “known unknowns.”" Leaders sense, analyze and respond, often with experts. In a complex context, cause and effect can be understood only in retrospect, so leaders "need to probe first, then sense, and then respond," running experiments that are safe to fail. In a chaotic context, cause and effect shift constantly and searching for the right answer is pointless; "A leader must first act to establish order, then sense where stability is present, and then respond by working to transform the situation from chaos to complexity." The framework's value is the diagnosis. The same response that saves a company in chaos can wreck it in a complex market, and the analysis that suits a complicated problem is too slow for a crisis. The article's warning to leaders is that the danger often comes from past success: entrained thinking, "a conditioned response that occurs when people are blinded to new ways of thinking," and, in its words, "The most frequent collapses into chaos occur because success has bred complacency."
The Cynefin domains and their order of moves
Four domains, each with its own sequence. Disorder, the fifth, sits between them: not knowing which applies.
Origin & context
David J. Snowden and Mary E. Boone described the framework in "A Leader's Framework for Decision Making," Harvard Business Review, November 2007 (reprint R0711C). The article's cover line states its purpose: "Wise executives tailor their approach to fit the complexity of the circumstances they face." By then, the authors noted, the US Defense Advanced Research Projects Agency had applied the framework to counterterrorism, and it was a key component of Singapore's Risk Assessment and Horizon Scanning program.
Builds on: David J. Snowden and Mary E. Boone (2007), A Leader's Framework for Decision Making, Harvard Business Review (November 2007, reprint R0711C).
What we changed: Nothing. The page uses the article's own names for the domains: simple, complicated, complex, chaotic and disorder.
Cynefin Framework in action
Maersk
When the order of moves is act first
On June 27, 2017, a global cyberattack named Petya hit Maersk, and its IT systems went down across multiple sites and business units. It is the kind of situation the article calls chaotic: a search for the right answer would have been pointless.
Maersk acted first. It kept cargo moving by hand, absorbing an estimated 20% drop in volume rather than stopping altogether, and set about rebuilding its network. Two days after the attack, Maersk Line was taking bookings from existing customers again. Operations, the company said, gradually got back to normal over the following week.
Its chairman, Jim Hagemann Snabe, later described the rebuild at the World Economic Forum in Davos: "4,000 new servers, 45,000 new PCs, and 2,500 applications" over "a heroic effort over ten days," a job he said would normally take about six months. No source says Maersk used the Cynefin framework. The case shows its chaotic-domain answer in practice: act to establish order, sense where stability is, then respond.
In its interim report for the second quarter of 2017, chief executive Søren Skou wrote: "We expect that the cyber-attack will impact results negatively by USD 200-300m."
Norsk Hydro
Three decisions first, then the long work
In March 2019, ransomware hit Norsk Hydro. At the emergency meeting, as Microsoft later told the story, "Norsk Hydro executives made three swift decisions": they would pay no ransom, they would summon Microsoft's cybersecurity team to help restore operations, and they would be open about what had happened.
That is the chaotic domain's first move: act to establish order, without waiting for the full picture. Then came the sensing. Executives held daily press conferences at their Oslo headquarters, and the company's estimate of the cost was redrawn as it learned: $41 million at first, $52 million in April, $69 million in early June.
In July 2019, Hydro put the total financial impact for the first half of the year at up to $75 million (NOK 650 million). It never paid the ransom.
Using it in the room
Use it at the start of a planning cycle, before the team chooses how to work on each question, and in the first meeting of any crisis. Return to it whenever the team argues about method rather than substance.
Questions to ask
- ?Is the link between cause and effect here covered by established practice, knowable with expertise, visible only in hindsight, or shifting too fast to read?
- ?Which domain does each of us think this is in, and why?
- ?If we disagree, which parts of the situation can we place separately?
- ?What order of moves does that domain call for, and are we following it?
- ?What would tell us the situation has moved to another domain?
The 30-minute version
Five minutes: state the decision in two sentences. Five minutes: everyone writes the domain they would place it in, alone. Ten minutes: compare, and split the situation into parts if the room disagrees. Ten minutes: agree the order of moves for each part and the first step.
Core Components
Simple: sense, categorize, respond
Established practice covers the situation. Leaders assess the facts, sort them, and respond with that practice. The article warns that issues can be put here wrongly because they have been oversimplified.
Example
Processing a routine refund under a written policy.
Complicated: sense, analyze, respond
There is a clear link between cause and effect, but not everyone can see it, and there may be several right answers. The response takes analysis, often by experts. The article's example is a motorist taking a car to a mechanic.
Example
Choosing between two sites for a new warehouse, with engineers and cost analysts.
Complex: probe, sense, respond
Cause and effect can be understood only in retrospect. Leaders run experiments that are safe to fail, let patterns emerge, and decide which are desirable. Trying to impose order here fails.
Example
Testing three small offers in a new customer segment before committing to one.
Chaotic: act, sense, respond
Cause and effect shift constantly, and searching for the right answer would be pointless. The leader's first job is to act to establish order, then sense where stability exists, then work to move the situation from chaos to complexity.
Example
The first hours after a cyberattack takes down a company's systems.
Disorder
The fifth domain: the state of not knowing which of the other four applies.
Example
A leadership team split between those who want a detailed study and those who want to act today.
Cynefin, pronounced ku-nev-in, is a Welsh word. Snowden and Boone describe it as signifying "the multiple factors in our environment and our experience that influence us in ways we can never understand."
When to Use Cynefin Framework
At the start of a strategy review
Problem it solves: The team is about to apply the same planning process to every question, whether or not the answer can be known in advance.
Real-world application
A leadership team sorts its ten open questions by domain and finds that three need experiments, not more analysis.
In the first hours of a crisis
Problem it solves: People reach for analysis and consensus when the situation needs someone to act and establish order.
Real-world application
After a systems failure, the crisis lead takes the first decisions alone and hands analysis to a second team once operations are stable.
Entering a new market
Problem it solves: The plan treats an unknown market as a complicated problem that more research will solve.
Real-world application
Instead of a year-long study, a company runs small, safe-to-fail pilots in two cities and watches what customers do.
When a team keeps arguing about method
Problem it solves: Half the room wants data and the other half wants action, and neither can say why.
Real-world application
The facilitator asks each person to name the domain they think the problem is in; the disagreement turns out to be about that.
Every leader has a domain they are most at home in. When a team cannot agree which domain it is in, the most senior person's favorite response tends to win. Name the domain first, out loud, before anyone proposes what to do.
How to Apply Cynefin Framework: Step by Step
Before you start
- →A specific decision or situation, not a general topic
- →The people who will act on it in the room
- →Agreement that the first question is what kind of problem this is
State the situation
Write down in two or three sentences what is happening and what decision is needed.
Tips
- ✓Keep it to one situation; split a large topic into its decisions
Common mistakes
- ✗Placing a whole business in one domain instead of one decision
Ask how cause and effect relate
Is it covered by established practice, knowable with expertise, visible only in hindsight, or shifting too fast to read? The answer places the situation in a domain.
Tips
- ✓Ask people to place it alone before discussing
Common mistakes
- ✗Choosing the domain that suits the response you already prefer
Name disorder when you see it
If the team cannot agree, it is in disorder. Settle the domain before deciding anything else, by breaking the situation into parts that can be placed.
Tips
- ✓Different parts of one situation can sit in different domains
Common mistakes
- ✗Letting the most senior person's domain win by default
Apply the domain's order of moves
Simple: sense, categorize, respond. Complicated: sense, analyze, respond. Complex: probe, sense, respond. Chaotic: act, sense, respond.
Tips
- ✓In a complex domain, design experiments that are safe to fail
Common mistakes
- ✗Demanding a full analysis in chaos, or imposing a plan in a complex market
Watch for movement
Situations move between domains. A crisis should move from chaos toward complexity, and the article warns that the most frequent collapses into chaos come from complacency bred by success.
Tips
- ✓Set a date to place the situation again
Common mistakes
- ✗Keeping a crisis team's command style after the crisis has passed
Showing the result
One slide: the open decisions placed in their domains on a simple four-part drawing, each with the order of moves it calls for and the first step. Disorder, if any, is named in the middle with the question that must be settled first.
On the slide
- ✓Each decision, placed in its domain
- ✓The order of moves for each, and the first step
- ✓Anything still in disorder, and who will settle it
Left off
- ✕A lecture on the framework (one line under the drawing is enough)
- ✕Placements nobody in the room agreed
- ✕The full list of minor decisions (put it in the appendix)
Value & Outcomes
Primary benefit
It makes a team name what kind of problem it faces before it chooses a response, so the response fits the problem.
Additional benefits
- ✓Explains why the same leadership style works in one situation and fails in another
- ✓Gives a team words for a disagreement that is really about the kind of problem
- ✓Warns against copying crisis lessons into situations that are not crises
What you'll learn
- →The five domains and how cause and effect differ in each
- →The order of moves each domain calls for
- →How to spot disorder and settle it first
Typical outcomes
Best Practices
📋 Preparation
- •Break the topic into specific decisions before the meeting
- •Invite people with different views of the problem
- •Draw the domains large enough to place cards on
🚀 Execution
- •Have people place each decision alone before discussing
- •Name disorder whenever the room disagrees
- •Agree the order of moves for each domain before proposing actions
🔄 Follow-Up
- •Place the situation again when the facts change
- •In a crisis, plan the move from chaos toward complexity
- •Look for complacency in the domains that feel simple
💎 Pro Tips
- •If everything lands in the simple domain, ask what has been oversimplified
- •If a leader always asks for a one-page summary, check which problems it is hiding
- •A crisis playbook is a playbook for chaos, not for everything
A crisis that starts in chaos should not stay there. Once order is established, the article's advice is to move the situation toward complexity, where experiments and patterns take over from commands.
Limitations & Pitfalls
It does not place the situation for you. Two smart people can put the same problem in different domains.
Mitigation: Treat the disagreement as information: break the situation into parts and place each one
The boundaries between domains are a matter of judgment, and situations move between them.
Mitigation: Set a date to place the situation again, and watch for signs it has moved
Crisis stories are vivid, which tempts leaders to treat every hard problem as chaos and reach for command.
Mitigation: Ask whether the cause and effect really shift too fast to read, or are only unknown yet
It tells you the order of moves, not which moves to make.
Mitigation: Pair it with the tools that suit each domain: analysis for the complicated, experiments for the complex
What comes before and after
Run first
The decision-making framework →
Frames the decision clearly enough that it can be placed in a domain.
Run next
For decisions in the complex domain: design the safe-to-fail experiments.
For decisions in the complicated domain: analyze the options against the futures that matter.
Once a plan is drawn for any domain, test it before committing.
Where this comes fromDavid J. Snowden and Mary E. Boone introduced this (2007).
Sources & further reading
- David J. Snowden and Mary E. Boone (2007). A Leader's Framework for Decision Making. Harvard Business Review (November 2007, reprint R0711C).The five domains, the response for each, the meaning of Cynefin, entrained thinking, complacency, the warning about crisis recipes, and the DARPA and Singapore uses.
- A.P. Møller - Mærsk A/S (2017). Cyber attack update. Maersk investor relations (June 28, 2017).The attack on June 27, 2017, and IT systems down across multiple sites and business units.
- CNBC (2017). Maersk says NotPetya cyberattack could cost $300 million. CNBC (August 16, 2017).Bookings from existing customers two days after the attack; operations back to normal over the following week.
- Computing (2018). Maersk rebuilt its infrastructure to recover from NotPetya. Computing (January 26, 2018).Jim Hagemann Snabe at Davos: 4,000 servers, 45,000 PCs and 2,500 applications in ten days, against about six months normally; an estimated 20% drop in volume handled manually.
- A.P. Møller - Mærsk A/S (2017). Interim Report Q2 2017. A.P. Møller - Mærsk A/S (August 16, 2017).The expected negative impact of USD 200-300m.
- Microsoft (2019). Hackers hit Norsk Hydro with ransomware. The company responded with transparency. Microsoft Source (December 16, 2019).The three swift decisions and the daily press conferences in Oslo.
- Luke Gallin (2019). Norsk Hydro puts H1 cyber-attack impact at up to $75 million. Reinsurance News (July 23, 2019).Up to $75 million (NOK 650 million) for the first half of 2019, and the earlier estimates.
More Management Frameworks
Other frameworks in the Stratrix library.
Business Model Canvas
A visual strategic management tool that describes, designs, challenges, and pivots a business model through nine interconnected building blocks covering value creation, delivery, and capture.
Strategy DevelopmentGE McKinsey Matrix
The GE McKinsey matrix places each business in a portfolio on a nine-box grid by how attractive its industry is and how strong the business is, then sorts it to invest, invest selectively, or sell. It scores each business alone; the risk often sits in the ties between them.
Strategy DevelopmentOODA Loop
The OODA loop is John Boyd's cycle of observe, orient, decide and act, repeated as a feedback loop. Most people remember it as a race to decide faster. Boyd put the weight on orientation: the picture of events in your head, which is where a fast team goes wrong.
Strategy DevelopmentCore Competency Analysis
A framework for identifying an organization's unique bundle of skills and technologies that provide access to multiple markets, contribute significantly to customer value, and are difficult for competitors to imitate.
Strategy DevelopmentReal Options
Real options treats a strategy as a series of options rather than a single forecast: pay a little now for the right, but not the obligation, to invest more later, once you know more. The protection covers only the money that can still wait.
Strategy DevelopmentBalanced Scorecard
The balanced scorecard, from Robert Kaplan and David Norton (1992), runs a strategy on a few measures in four perspectives: financial, customer, internal process, and learning and growth. It works by subtraction: each measure must cause the result.
Tools to try
- Business model canvas builderFramework: Business Model Canvas
- Ansoff move finderFramework: Ansoff Matrix
- Change readiness checkFramework: Kotter's 8-Step Change Model
- Five Forces scorerFramework: Porter's Five Forces
- SMART goal builderFramework: SMART Goals
- SWOT builderFramework: SWOT Analysis
More from Stratrix
Test a decision, free
Set a live decision against the companies that made it before you.
AcquisitionsThe Distance TestDivestituresThe Divestiture TestDiversificationThe Diversification TestMake or buyThe Make-or-Buy TestStratrix Team
Every Casebook, three Strategy Packs a seat each year and Ask Stratrix, for teams that face these decisions all year.
$1,999 a year · $499 a seatWhat is included →New analyses, by email
The defining moves in business, and what they teach, as they publish.
See Cynefin Framework in the wild.
Follow Cynefin Framework across the companies and lenses where it actually shaped the strategy — the decision, the rationale, and how it played out.