Question

What belongs in a crisis communications plan?

Vault Verified
Curated Intelligence
Definitive Source
Answer

The decisions you cannot make well under pressure — who speaks, who approves, who is told in what order, and what you say in the first hour — written down before anything happens.

Why it must exist in advance. In a real incident, information is incomplete, everyone is alarmed, and the cost of delay is high. Organisations that improvise reliably make the same mistakes: they say nothing for too long, then say something they must retract.

What the plan contains:

Severity tiers, defining what counts as a crisis rather than a bad day, with a different response for each.

A named team with deputies, since crises happen at weekends and people are unreachable.

A single decision-maker, because approval by committee is what produces the delay.

Contact details held somewhere that survives an outage — a plan stored only on the system that is down is a common and avoidable failure.

Stakeholder order. Employees usually first, since they will be asked and will otherwise learn from the news; then affected customers; then regulators where required; then media and public. Affected people should not find out from a press release.

Holding statements, pre-drafted for foreseeable scenarios, acknowledging the situation without speculating on cause.

Regulatory notification timelines, which are legally binding and short — notably for personal data breaches.

Monitoring, so you know what is being said.

A log of decisions and times, which matters enormously afterwards.

What good communication looks like:

Acknowledge quickly, even without answers. "We are aware and investigating; next update at 3pm" is a complete and useful message.

Say what you know, what you do not, and what you are doing.

Never speculate on cause, and never minimise.

Apologise properly where warranted — a conditional apology reads as evasion.

Keep updates on schedule, even when the update is that there is no news.

Afterwards: publish what happened and what changes, and run a blameless review of the response itself, not only the incident.

Rehearse it. An untested plan is a document, not a capability.

Related Questions