# Crisis Communication

> When to activate: crisis communication, crisis management, media statement, crisis response, spokesperson, dark site, crisis PR, crisis plan

- Skill: `mattakushi432/crisis-communication` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/crisis-communication`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/crisis-communication/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/crisis-communication

---


# Crisis Communication

## Crisis Severity Classification

| Level | Definition | Response time | Who leads |
|-------|-----------|---------------|-----------|
| P1 — Critical | Existential risk: mass data breach, fatality, regulatory shutdown | <1 hour | CEO + board |
| P2 — Major | Significant reputational or financial damage | <4 hours | CEO + comms |
| P3 — Moderate | Contained incident with public visibility | <24 hours | Comms + functional lead |
| P4 — Minor | Internal issue unlikely to surface publicly | <48 hours | Functional lead |

## Response Playbook by Phase

### Phase 1: Golden Hour (0–60 minutes)
- [ ] Confirm facts — do not guess, do not act on rumors
- [ ] Assemble crisis team: CEO, legal, comms, relevant exec, PR agency (if retained)
- [ ] Assess severity level (P1-P4)
- [ ] Draft holding statement (see template below)
- [ ] Designate single spokesperson — one voice only
- [ ] Identify who needs to be notified and in what order
- [ ] Freeze any automated social/email sends that could worsen situation
- [ ] Post holding statement on owned channels before media calls arrive

### Phase 2: First 24 Hours
- [ ] Complete internal investigation to establish known facts
- [ ] Draft full external statement based on facts (not speculation)
- [ ] Brief key stakeholders: board, investors, key customers, regulators (as required)
- [ ] Activate dark site if needed
- [ ] Assign media monitoring watch
- [ ] Prepare spokesperson for media inquiries
- [ ] Establish hourly internal update cadence for crisis team

### Phase 3: Days 2–7
- [ ] Move from holding statement to full public statement with timeline and remediation
- [ ] Regulatory notifications (check jurisdiction-specific deadlines)
- [ ] Customer/affected party notification (personalized where required)
- [ ] Daily leadership update to all employees
- [ ] Begin post-incident review

## Holding Statement Templates

### Data Breach
```
We are aware of a security incident that may have affected [data type].
The security and privacy of our [customers/users] is our highest priority.
We are actively investigating and have engaged third-party security experts.
We will provide a full update by [specific time]. Affected individuals will
be notified directly as soon as we have confirmed details.
```

### Product/Service Failure
```
We are experiencing [brief description of issue] affecting [scope].
Our engineering team identified the issue at [time] and is working to
restore service. We expect resolution by [time estimate]. We apologize
for the disruption and will share a full post-incident report within
[48 hours/72 hours].
```

### Leadership Issue (executive misconduct)
```
[Name] is no longer with [Company], effective [date]. [Company] holds
all employees, including senior leadership, to the highest standards of
conduct. [Interim leader name] will serve as [role] effective immediately.
We are committed to maintaining our values and will not comment further
on personnel matters.
```

### Legal/Regulatory Action
```
We have received [legal/regulatory action] from [body] regarding [topic].
We are reviewing the matter with legal counsel and are committed to
cooperating fully. We believe our practices are [compliant/sound] and
look forward to demonstrating that through the appropriate process.
```

## Internal vs. External Messaging Alignment

**Rule:** Internal audiences hear first, before or simultaneously with external. Never let employees learn about a crisis from a news article.

| Audience | Timing | Medium | Content level |
|----------|--------|--------|--------------|
| Board | Before public statement | Phone call (CEO) | Full known facts + response plan |
| Senior leaders | Simultaneously with board | Briefing call | Facts + talking points |
| All employees | Same day, before media | Email + all-hands | Facts + what it means for them |
| Customers (affected) | Within regulatory deadline | Direct email/call | Facts + remediation steps |
| Media/public | After internal | Press statement | Facts only, no speculation |
| Regulators | Per jurisdiction deadline | Formal notice | Per regulatory requirement |

## Spokesperson Preparation

### Selection Criteria
- Calm under pressure; doesn't show panic
- Clear communicator — avoids jargon
- Authorized to speak on behalf of the company
- Has the facts; knows what they don't know
- Typically CEO for P1/P2; VP Comms or functional lead for P3/P4

### Media Training Before Interviews
- Practice 3 key messages — return to them when off-topic: "What I'd really like to focus on is..."
- "Bridging" technique: acknowledge question → pivot → deliver key message
- Never say "no comment" — use "We can't share details while the investigation is active"
- Never speculate: "I don't have that information yet, but here's what I do know..."
- Silence is ok — don't fill with speculation

### Interview Checklist
- [ ] Know the 3 key messages cold
- [ ] Know what you're NOT going to say (legal holds)
- [ ] Have specific facts ready (dates, numbers, actions taken)
- [ ] Know the hardest 5 questions and have prepared answers
- [ ] Have a single fact-check contact on call during interview

## Dark Site Preparation

A dark site is a pre-built web page activated during a crisis to provide a single source of truth.

### Dark Site Contents
- Statement from the CEO
- Known facts and timeline
- What we are doing about it
- What affected parties should do
- Contact information / FAQ
- Last updated timestamp

### Activation Triggers
- Data breach affecting >500 people
- Product outage lasting >4 hours
- Any incident generating >10 inbound media inquiries
- Any P1 or P2 crisis

### Pre-Crisis Dark Site Prep
- Build template annually — don't build during the crisis
- Test activation process (DNS switch or toggle)
- Keep contact info and company boilerplate current

## Social Media Protocol

### During Active Crisis
- Pause all scheduled posts immediately
- Appoint one person to own all social channels
- Respond to direct questions with holding statement link
- Do not engage with trolls or speculative threads
- Acknowledge receipt: "We're aware and are actively addressing this"

### What Not to Do
- Delete posts — screenshots exist; deletion signals guilt
- Go silent for hours — silence is interpreted as hiding
- Argue publicly with affected parties
- Post unrelated content while crisis is active

## Post-Crisis Recovery

### 30-Day Actions
- Publish full post-incident report (root cause + remediation)
- Complete all regulatory notifications
- Affected party remediation complete (credit monitoring, refunds, etc.)
- Internal lessons-learned session
- Update crisis playbook with learnings

### Reputation Recovery Signals
- Media coverage tone shifting from negative to neutral
- Customer sentiment recovering in NPS/CSAT
- Employee morale recovering in pulse surveys
- No new incidents related to the original crisis

### Never Do After Crisis
- Claim "it's behind us" prematurely
- Downplay severity once you know the full picture
- Let the story die without a resolution narrative — the public remember the incident; give them something to remember about how it was resolved