Crisis Communication

Crisis Communication

Crisis Severity Classification

Response Playbook by Phase

Phase 1: Golden Hour (0–60 minutes)

• Confirm facts — do not guess, do not act on rumors
• Assemble crisis team: CEO, legal, comms, relevant exec, PR agency (if retained)
• Assess severity level (P1-P4)
• Draft holding statement (see template below)
• Designate single spokesperson — one voice only
• Identify who needs to be notified and in what order
• Freeze any automated social/email sends that could worsen situation
• Post holding statement on owned channels before media calls arrive

Phase 2: First 24 Hours

• Complete internal investigation to establish known facts
• Draft full external statement based on facts (not speculation)
• Brief key stakeholders: board, investors, key customers, regulators (as required)
• Activate dark site if needed
• Assign media monitoring watch
• Prepare spokesperson for media inquiries
• Establish hourly internal update cadence for crisis team

Phase 3: Days 2–7

• Move from holding statement to full public statement with timeline and remediation
• Regulatory notifications (check jurisdiction-specific deadlines)
• Customer/affected party notification (personalized where required)
• Daily leadership update to all employees
• Begin post-incident review

Holding Statement Templates

Data Breach

We are aware of a security incident that may have affected [data type].
The security and privacy of our [customers/users] is our highest priority.
We are actively investigating and have engaged third-party security experts.
We will provide a full update by [specific time]. Affected individuals will
be notified directly as soon as we have confirmed details.

Product/Service Failure

We are experiencing [brief description of issue] affecting [scope].
Our engineering team identified the issue at [time] and is working to
restore service. We expect resolution by [time estimate]. We apologize
for the disruption and will share a full post-incident report within
[48 hours/72 hours].

Leadership Issue (executive misconduct)

[Name] is no longer with [Company], effective [date]. [Company] holds
all employees, including senior leadership, to the highest standards of
conduct. [Interim leader name] will serve as [role] effective immediately.
We are committed to maintaining our values and will not comment further
on personnel matters.

Legal/Regulatory Action

We have received [legal/regulatory action] from [body] regarding [topic].
We are reviewing the matter with legal counsel and are committed to
cooperating fully. We believe our practices are [compliant/sound] and
look forward to demonstrating that through the appropriate process.

Internal vs. External Messaging Alignment

Rule: Internal audiences hear first, before or simultaneously with external. Never let employees learn about a crisis from a news article.

Spokesperson Preparation

Selection Criteria

• Calm under pressure; doesn't show panic
• Clear communicator — avoids jargon
• Authorized to speak on behalf of the company
• Has the facts; knows what they don't know
• Typically CEO for P1/P2; VP Comms or functional lead for P3/P4

Media Training Before Interviews

• Practice 3 key messages — return to them when off-topic: "What I'd really like to focus on is..."
• "Bridging" technique: acknowledge question → pivot → deliver key message
• Never say "no comment" — use "We can't share details while the investigation is active"
• Never speculate: "I don't have that information yet, but here's what I do know..."
• Silence is ok — don't fill with speculation

Interview Checklist

• Know the 3 key messages cold
• Know what you're NOT going to say (legal holds)
• Have specific facts ready (dates, numbers, actions taken)
• Know the hardest 5 questions and have prepared answers
• Have a single fact-check contact on call during interview

Dark Site Preparation

A dark site is a pre-built web page activated during a crisis to provide a single source of truth.

Dark Site Contents

• Statement from the CEO
• Known facts and timeline
• What we are doing about it
• What affected parties should do
• Contact information / FAQ
• Last updated timestamp

Activation Triggers

• Data breach affecting >500 people
• Product outage lasting >4 hours
• Any incident generating >10 inbound media inquiries
• Any P1 or P2 crisis

Pre-Crisis Dark Site Prep

• Build template annually — don't build during the crisis
• Test activation process (DNS switch or toggle)
• Keep contact info and company boilerplate current

Social Media Protocol

During Active Crisis

• Pause all scheduled posts immediately
• Appoint one person to own all social channels
• Respond to direct questions with holding statement link
• Do not engage with trolls or speculative threads
• Acknowledge receipt: "We're aware and are actively addressing this"

What Not to Do

• Delete posts — screenshots exist; deletion signals guilt
• Go silent for hours — silence is interpreted as hiding
• Argue publicly with affected parties
• Post unrelated content while crisis is active

Post-Crisis Recovery

30-Day Actions

• Publish full post-incident report (root cause + remediation)
• Complete all regulatory notifications
• Affected party remediation complete (credit monitoring, refunds, etc.)
• Internal lessons-learned session
• Update crisis playbook with learnings

Reputation Recovery Signals

• Media coverage tone shifting from negative to neutral
• Customer sentiment recovering in NPS/CSAT
• Employee morale recovering in pulse surveys
• No new incidents related to the original crisis

Never Do After Crisis

• Claim "it's behind us" prematurely
• Downplay severity once you know the full picture
• Let the story die without a resolution narrative — the public remember the incident; give them something to remember about how it was resolved