What belongs in a crisis communications plan?
The decisions you cannot make well under pressure — who speaks, who approves, who is told in what order, and what you say in the first hour — written down before anything happens.
Why it must exist in advance. In a real incident, information is incomplete, everyone is alarmed, and the cost of delay is high. Organisations that improvise reliably make the same mistakes: they say nothing for too long, then say something they must retract.
What the plan contains:
Severity tiers, defining what counts as a crisis rather than a bad day, with a different response for each.
A named team with deputies, since crises happen at weekends and people are unreachable.
A single decision-maker, because approval by committee is what produces the delay.
Contact details held somewhere that survives an outage — a plan stored only on the system that is down is a common and avoidable failure.
Stakeholder order. Employees usually first, since they will be asked and will otherwise learn from the news; then affected customers; then regulators where required; then media and public. Affected people should not find out from a press release.
Holding statements, pre-drafted for foreseeable scenarios, acknowledging the situation without speculating on cause.
Regulatory notification timelines, which are legally binding and short — notably for personal data breaches.
Monitoring, so you know what is being said.
A log of decisions and times, which matters enormously afterwards.
What good communication looks like:
Acknowledge quickly, even without answers. "We are aware and investigating; next update at 3pm" is a complete and useful message.
Say what you know, what you do not, and what you are doing.
Never speculate on cause, and never minimise.
Apologise properly where warranted — a conditional apology reads as evasion.
Keep updates on schedule, even when the update is that there is no news.
Afterwards: publish what happened and what changes, and run a blameless review of the response itself, not only the incident.
Rehearse it. An untested plan is a document, not a capability.