Open with the facts
- What happened, its scale and its cause, as far as you can confirm.
Crisis communications plan template
This crisis communications plan template has ten sections, each a table you can copy into your own document.
Fill it in on a calm day with the people who will take the calls, so a deputy can follow it at night without the author.
For hands-on help, see crisis communications.
Deadlines and gaps the plan has to cover
- 29%of companies had no staff dedicated to crisis preparedness in PwC's global surveypwc.com
- 72 hoursto notify an EU data protection authority after learning of a personal data breachgdpr-info.eu
- 4 daysbusiness days for a US listed company to disclose a material cyber incident on Form 8-Ksec.gov
What is a crisis communication plan
A crisis communication plan is a written agreement, made in advance, about who speaks, who decides and what gets said when an event threatens your operations or reputation.
The business continuity plan keeps the lights on. The communications plan keeps customers, staff, regulators and reporters informed while that happens.
| Number | What it means | Source |
|---|---|---|
| 69% | of leaders had been through a corporate crisis in the previous five years | PwC Global Crisis Survey 2019 |
| 29% | of companies had nobody assigned to crisis preparedness | PwC Global Crisis Survey 2019 |
What should a crisis communications plan include
The questions that come up on the first day of an incident, one section each.
| No. | Section | Answers the question |
|---|---|---|
| 1 | Scenario register | what could realistically happen to us |
| 2 | Severity levels | how bad is this, and who needs to wake up |
| 3 | Roles and RACI | who does what, and who only needs to know |
| 4 | Approval chain | who signs a public statement, and how fast |
| 5 | Contact tree | whom we call, in which order |
| 6 | Holding statements | what we say before we know everything |
| 7 | Channel matrix | where each audience hears it first |
| 8 | Incident log | what we said, when, and who said it |
| 9 | Drill schedule | when we practise |
| 10 | Post-crisis review | what we change afterwards |
Crisis communications plan template
Copy each table and replace the sample rows, kept in grey until rewritten.
- Scenario register
List five to eight scenarios, ranked by likelihood times impact. A payroll error is likelier than a fire.
Scenario Likelihood Impact Business owner Deputy Legal or regulatory trigger Customer data exposed medium high Head of security CTO EU regulator within 72 hours of awareness Service outage over 2 hours high medium Head of engineering On-call lead contract SLA notices Workplace injury low high COO Site manager labour inspectorate Executive misconduct claim low high Board chair General counsel none by default False or hostile story medium medium Comms lead CEO none - Severity levels
Level Definition Who is alerted First statement due 1 harm to people, data of many customers, national press already calling CEO, board chair, legal, comms, owner within 1 hour 2 service or reputation damage visible to customers or trade press CEO, comms, owner within 3 hours 3 local complaint, single social post, no press interest yet comms, owner monitor, respond if it grows A level can go up at any time. It goes down only with the approver's written agreement.
- Roles and RACI
Responsible, accountable, consulted, informed. One letter per cell, one A per task.
Task CEO Comms lead Scenario owner Legal HR Customer support Confirm the facts I C R C I I Draft statements C R C C I I Approve statements A R C C I I Speak to press A R C I I I Brief staff A C I C R I Answer customers I C C C I R Notify regulators A I R R I I - Approval chain
Statement type Drafts Approves Deputy approver Max time to approve Holding statement Comms lead CEO COO 20 minutes Update statement Comms lead Scenario owner Comms lead 30 minutes Regulator notice Legal CEO General counsel as the law requires Staff note HR CEO COO 30 minutes Apology or admission of fault Comms lead CEO and legal jointly Board chair 2 hours If an approver does not reply inside the time limit, the deputy approves.
- Contact tree
Two phone numbers per person, one of them personal.
Order Role Name Mobile Backup number Calls next 1 Person who spots it anyone Scenario owner 2 Scenario owner Comms lead and CEO 3 Comms lead Legal, HR, support lead 4 CEO Board chair, key investors 5 External PR partner, outside counsel, insurer Keep an annex of reporters, largest customers, regulators and partners, each with a named owner.
- Holding statements per scenario
One first statement per scenario, under 80 words, with blanks for time, place and numbers.
Scenario Pre-approved first statement Customer data exposed On DATE we learned that some customer records were accessible without authorisation. We closed the access within HOURS, informed the data protection authority and are contacting affected customers directly. Customers can find what to do on our security page. Next update at TIME. Service outage Since TIME our SERVICE has been unavailable for some customers. Engineers are working on the fix and we will update our status page every 30 minutes until service is back. Workplace injury An employee was injured at our SITE today and is receiving medical care. We are supporting the family and working with the authorities. We will not share personal details. False story A report published today about COMPANY contains claims that are not accurate. We have sent the publication the correct facts and documents, and we will publish them on our press page. - Channel matrix
Staff first, then the people directly affected, then everyone else.
Audience First channel Second channel Who sends Timing Staff internal chat and email all-hands call HR with CEO before any public post Affected customers direct email or SMS account manager call Support lead with the public statement Regulators formal notice phone call Legal as the law requires Press press page statement reply to each reporter Comms lead with the public statement General public website banner company social accounts Comms lead same time as press Investors and board direct call written note CEO within the first hour - Incident log
Start at minute zero. Regulators, insurers and lawyers will ask for it.
Time What happened or was said Channel By whom Approved by Next action 16.20 Exposure found by security lead internal Owner called 17.10 Holding statement approved email Comms lead CEO Publish at 18.15 - Drill schedule
When Type Who takes part What we measure Every quarter contact check everyone in the tree how many answer within 15 minutes Twice a year spokesperson mock interview CEO and deputy key message said within 20 seconds Once a year tabletop exercise, unannounced leadership team time from alert to approved statement After staff changes name and number update comms lead plan current within one week - Post-crisis review
Within ten working days. Blame nobody, or the next incident will be reported late.
Question Answer Owner of the fix Due When did we first know, and when did we first speak Which approval took longest, and why What did we say that later changed Which audience heard it from someone else first Which coverage or AI answer still carries a wrong fact
Internal communications during a crisis
Staff are the audience most plans forget and the most likely to leak.
Brief them before any public post, even if you only know a little, and say where reporter calls go.
Support gets a customer script, updated with every statement.
Illustration
How to write a crisis press release
A crisis release follows the holding statement once facts are confirmed, and answers the questions reporters keep asking.
Show the response
- What you did for the people affected, what prevents a repeat, one quote from the accountable executive.
Close and send
- Where updates will appear and one named press contact. Publish on your own press page first, then send to the reporters already on the story, before any wire. Press coverage of an incident tends to repeat whatever was published first, so your page should be that source.
Crisis communications plan example
This illustrative example follows a fictional HR software company through a data exposure.
Illustration
The scenario register already named the privacy owner and the 72-hour regulator deadline
The severity table set level 1, so the CEO was called within minutes
The approval chain limited sign-off to 20 minutes
The channel matrix put applicants and staff first
So every channel said the same thing when the reporter called.
For a US listed company
A Form 8-K is due within four business days of deciding a cyber incident is material, so the plan names who decides.
How to test a crisis communications plan
Run the tabletop with a scenario the team has not seen and hand out new facts every ten minutes. Measure these.
- Minutes until the scenario owner is reached.
- Minutes until the holding statement is approved.
- Whether staff hear before the public.
Anything slower than the targets in section 2 goes on the fix list.
How we build the plan with your team
We fill in the ten sections with you
Two working sessions with your leadership produce the scenario register, the approval chain and the contact tree, written in your own names.
Statements written per scenario
For each of your top five scenarios we draft the holding statement, the staff note and the customer message, cleared by legal in advance.
One drill a year, on the calendar
We run an unannounced tabletop exercise, time every step against the plan and send back the list of fixes within a week.
A data breach, hour by hour
Data breach at a fictional HR software company
- Situation
- On a Tuesday at 16.20 the security lead finds that a misconfigured storage bucket exposed CVs of 3,000 job applicants for nine days.
- What we do
- The plan classes it as severity 1. The privacy owner starts the 72-hour regulator clock, the approval pair signs the holding statement by 17.10, affected applicants get an email at 18.00, the press page goes live at 18.15.
- Outcome
- When a trade reporter calls on Wednesday, the statement, the regulator notice and the applicant email all say the same thing. Illustrative scenario.
Anastasiia Bratkova
Chief Brand, Marketing & Communications Officer, RSE
Signs every pitch
Questions
What teams ask before writing the plan
What should a crisis communications plan include?
Ten parts. Scenario register, severity levels, roles, approval chain, contact tree, holding statements, channel matrix, incident log, drill schedule and a post-crisis review.
How long should a crisis communications plan be?
Short enough to use on a phone. Most working plans fit on six to ten pages, with longer annexes for contacts and statements.
Who owns the crisis communications plan?
One communications lead keeps it current. Every scenario also has a named business owner and a deputy.
How often should the plan be updated?
Every quarter for names and numbers, after every real incident, and after each drill.
Is there a sample crisis management plan PDF?
Paste the ten sections into a document and export it as a PDF. Or leave your email and get the same template as an editable file.
Read next
Related guides
- Media monitoring servicesMonitoring services compared, from free alerts to enterprise suites.
- How to write a press releaseA seven-part release template with an embargo line and a sample lead for each type of news.
- Qwoted pricing vs FeaturedTwo journalist request platforms compared on price and results.
Next step
Get the template
A senior PR expert sends it within one business day, with a story angle for your company.