Crisis Communication Plan Template

Start with the incidents you could realistically face: a serious injury at work, a data breach, a faulty product, an allegation against a leader, a key supplier failing. Each can trigger three kinds of deadline: legal ones, notice clauses in customer contracts, and media ones, such as a reporter's request for comment.

Give each deadline its own row. One breach can owe notices to a regulator, a customer and the people affected, each on a different clock. Put them in a single row and the tightest deadline hides behind the loosest.

Read your largest customer contracts for notice clauses, which can be shorter than the law's. The European Commission notes that under the GDPR, a company processing personal data on a customer's behalf must report every breach to that customer³. In the US, the FTC points out that every state has its own breach notification law⁵.

Write down the event that starts each clock, in the rule's own words, and whose knowledge counts.

The CPSC, for example, treats product safety information received by any employee able to appreciate its significance² as known to the company. A defect report sitting in an engineering queue is already known, even if nobody in charge has read it. In ordinary circumstances, the rule allows at most 5 days for it to reach whoever handles reporting.

Other clocks start at a decision. The SEC ties the Form 8-K deadline not to discovery but to the determination⁴ that an incident is material, and that call must come without unreasonable delay. If your communications lead sits in that meeting, no time is lost passing on the news.

Then measure the delay: the hours between a clock starting and your team being told. Take your last real incident of any size, find those two timestamps and subtract. If nobody kept a timeline, rebuild one from alerts and chat logs. With no incident to measure, leave the cell blank and plan a drill. A flattering guess is worse than a blank, because nobody questions it.

Now do the arithmetic. From each deadline, subtract the hours lost before your team was told, then the hours needed to confirm the facts the notice can't leave out. What's left is your drafting window. Compare it with how long sign-off really takes at 2 a.m.

If sign-off is too slow, pre-approve the first statement, let someone lower down release it, and name a standing deputy for anyone hard to reach at night. If the window is negative, the delay and fact-finding have used up the deadline, and no approval change helps. Shorten them instead, starting with the people who discover incidents: they need to know their discovery can start a clock.

A holding statement is the short first response you issue while facts are still coming in. Crisis researcher W. Timothy Coombs, writing for the Institute for Public Relations, advises a first response within the hour⁶ that is accurate and consistent. It should tell people anything they need to stay safe, say what happened and express concern for anyone hurt.

Keep each one under 75 words, in four parts: what you know, what you're doing, who is affected and what they should do, and when you'll say more. Leave these out:

• A cause, until it is confirmed
• A count of people affected that hasn't been checked twice
• An update time nobody has agreed to keep
• Stock lines such as "we take this extremely seriously"

Hold back nothing people need, though. In its data breach guide, the FTC warns against misleading statements, or withholding details that help people protect themselves⁵.

Draft first for the shortest drafting windows, not the likeliest scenarios. Coombs recommends having your legal team review and pre-approve each draft. Write any statement that goes out with a regulatory filing in the same sitting as the filing, so the two never contradict each other.

Work out who needs to hear from you. Ready.gov, the Department of Homeland Security's preparedness site, lists audiences that will want information⁷: employees, customers, suppliers, management, and government officials and regulators. It also advises deciding in advance who will speak to the media and preparing them with talking points. Pick a spokesperson and a named deputy for each scenario.

Then build a contact tree: each role, a deputy, a personal mobile and a second route that works with company systems down. Time how long each approver takes to answer at night, and check it fits the drafting window.

Tell employees before the public, or at the same time. Coombs lists including employees in the initial response⁶ among his best practices. For planned news, such as a reorganization, use an internal announcement template instead.

Coombs recommends updating the plan and testing it at least once a year. A 2-hour tabletop drill is a good start, as long as people act rather than describe what they would do.

1. 1

   Pick the weakest row

   Choose the scenario with the least time to spare, or a delay nobody has measured.

2. 2

   Start at the real zero

   Begin when the person who would really find the incident does, without warning communications.

3. 3

   Call the real numbers

   Run it out of hours and phone each approver on the number in the plan.

4. 4

   Change a number

   Update the register with what you found. A drill that changes nothing hasn't finished.

Review real incidents the same way, false alarms included, using timestamps rather than memory.

The template on this page builds this arithmetic into its scenario register, and Edit with AI has River check a plan you already have. Pair it with a security incident response plan for the technical side of a breach, and a business continuity plan to keep work going.