How to Build a Crisis Communications Plan Before You Need One

To build a crisis communications plan, map the scenarios most likely to hit your company, define severity tiers and triggers, name a small crisis team with clear decision rights, pre-draft holding statements for each scenario, set up monitoring and an escalation path, agree a legal review process that works in hours, and drill the plan at least twice a year. Build it while things are calm.

Most companies do not lack goodwill in a crisis. They lack decisions made in advance. When an outage, breach, lawsuit, executive incident, or viral customer complaint lands, the first hours are spent working out who is in charge and who can approve a sentence. Meanwhile reporters, customers, employees, and AI assistants fill the silence. A plan converts those hours into minutes.

What is a crisis communications plan?

A crisis communications plan is a written playbook that tells your organization how to communicate when an event threatens its reputation, operations, or stakeholders’ trust. It specifies the scenarios, the people, the decisions, the statements, and the channels, so the first response is fast, accurate, and consistent.

A complete plan has eight components:

Component	What it contains	Owner
Scenario map	The 8 to 12 events most likely to affect your company, ranked by likelihood and impact	Comms with legal, security, operations
Severity tiers	Definitions of levels 1 to 3, with triggers and response times	Comms lead
Crisis team and decision rights	Names, backups, phone numbers, who approves what	CEO and general counsel
Holding statements	Pre-approved first statements for each scenario, with blanks	Comms and legal
Stakeholder map	Employees, customers, investors, regulators, partners, media, and the order they hear	Comms
Channels	Dark site or newsroom page, email lists, social accounts, internal tools	Comms and digital
Monitoring and escalation	What is watched, by whom, and the threshold for waking someone up	Comms and social
Review and drill schedule	Tabletop exercises, contact checks, post-incident reviews	Comms lead

Keep the core document short enough to read during an incident: ten pages or fewer, with appendices for statements and contacts.

Why do companies need a crisis plan before a crisis?

Companies need a plan in advance because disruption is near-universal and preparation consistently lags confidence. In PwC’s Global Crisis and Resilience Survey of 1,812 business leaders, 91% had experienced at least one disruption other than Covid-19 in the previous two years, averaging about three and a half disruptions, while 70% said they were confident they could recover.

The financial stakes are concrete. IBM’s Cost of a Data Breach Report 2025 put the global average cost of a breach at $4.44 million and the U.S. average at a record $10.22 million. Communications does not prevent a breach, but a slow, inaccurate, or contradictory response adds churn, regulatory attention, and lasting coverage to the bill.

There is also a newer reason. AI assistants now answer questions like “is this company safe to use?” by summarizing what has been written about you. If your first public statement is late or vague, the earliest coverage defines the answer. We cover this in depth in crisis PR in the age of AI search.

How do you build a crisis communications plan step by step?

Build the plan in eight steps, in order: map scenarios, set severity tiers, name the team, pre-draft statements, set up monitoring, agree the approval workflow, drill it, and review after every incident. A focused team can complete a first version in four to six weeks.

1. Map scenarios. Interview leaders in security, operations, legal, HR, product, and customer support. List the events most likely to happen and the ones that would hurt most: a data breach, a service outage, a product safety issue, an executive misconduct allegation, a layoff, a lawsuit, a regulator inquiry, a viral customer complaint, a deepfake or impersonation, a supplier failure. Rank by likelihood and impact.
2. Set severity tiers. Define three levels with plain triggers. Level 3: contained, handled by the owning team. Level 2: likely to reach customers or media; comms lead engaged within an hour. Level 1: threatens operations, safety, legal standing, or national coverage; full crisis team within an hour, CEO informed immediately.
3. Name the crisis team and decision rights. Keep the core team small: CEO (or delegate), general counsel, comms lead, the relevant operational owner, and HR when employees are involved. For each, name a backup. Write down who approves external statements and who is the single spokesperson for each tier.
4. Pre-draft holding statements. For each top scenario, write a short first statement with blanks, approved by legal in advance. It should acknowledge what is known, say what you are doing, and say when you will update. See the template below.
5. Set up monitoring and escalation. Decide what you monitor (news, social, review sites, Reddit, support tickets, AI assistant answers) and who watches after hours. Set thresholds that trigger escalation. Our roundup of social listening tools for PR teams is a starting point.
6. Agree the approval workflow. Legal review is essential and must work in hours, not days. Pre-approve language for common facts, agree who can sign off at night and on weekends, and define what can be said before every fact is confirmed.
7. Run tabletop drills. Twice a year at minimum, walk the team through a realistic scenario with injects (a reporter calls, a post goes viral, a customer threatens to leave). Time each decision. Fix the gaps you find.
8. Review after every incident. Within two weeks of any Level 1 or 2 event, run a blameless review: what was known when, what was said, what worked, what did not. Update the plan.

What should a holding statement say?

A holding statement should confirm what you know, explain what you are doing, show concern for the people affected, and commit to a time for the next update. It should not speculate about causes, assign blame, or minimize. It buys time without creating a vacuum.

A template:

We are aware of [brief, factual description of the issue] affecting
[who is affected] as of [time, time zone].

Our teams are [specific action: investigating, restoring service,
working with authorities]. [If relevant: The safety of / The security
of our customers' data is our priority, and we have [first action taken].]

We will share an update by [specific time] at [newsroom or status URL].
Customers with questions can reach us at [contact].

The Federal Trade Commission’s data breach response guide makes points that apply to any crisis: designate a point person for releasing information, do not make misleading statements, and post clear, plain-language answers where people can find them.

Who should hear about a crisis first?

People directly affected and the employees who will field their questions should hear first, followed closely by customers, investors, and regulators as required, then the media and the public. In practice, many of these happen within the same hour, but the order prevents employees and key customers from learning about the crisis from a news alert.

Audience	Typical timing for a Level 1 event	Channel
Crisis team and board chair	Within the first hour	Phone, secure messaging
Affected customers or users	As soon as facts allow, coordinated with legal and law enforcement	Direct email, in-product notice, account managers
Employees	Before or at the same time as the public statement	All-hands message, manager talking points
Regulators	As required by law or contract	Formal notice through counsel
Investors	At or before public disclosure, per securities law	Investor relations, filings
Media and public	When the holding statement is ready, or when the story breaks	Newsroom page, statement to reporters, social

Regulatory timelines should be built into the plan. All 50 U.S. states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have security breach notification laws, each with its own rules. For public companies, the SEC’s cybersecurity disclosure rule says a Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material. Your communications plan and your legal plan should share one timeline.

How do you communicate with the media during a crisis?

Communicate with the media through one trained spokesperson, with one consistent set of facts, updated on a published schedule. Reporters will cover the story with or without you; your goal is to be the most reliable source in it. Silence or “no comment” usually becomes the headline.

Practical rules for the first 24 hours:

• Publish before you are asked, if you can. A statement on your newsroom page gives reporters something accurate to quote. Our guide to building a newsroom page that gets cited covers how to set one up in advance.
• Use one spokesperson. Multiple voices produce contradictions. The spokesperson should be media trained before the crisis, not during it; see media training for executives.
• Separate fact from speculation. Say “we don’t know yet” and give a time for the next update.
• Correct errors quickly and specifically. Send the correction with documentation to the reporter, not to their editor first.
• Keep a log. Every inquiry, every statement, every commitment, with timestamps.
• Watch scale and context. When Microsoft disclosed that the July 2024 CrowdStrike update affected about 8.5 million Windows devices, less than 1% of all Windows machines, the number gave reporters accurate scale. Specific facts reduce speculation.

What crisis communication mistakes do companies make?

The most common mistakes are waiting for complete facts before saying anything, letting legal language replace human language, speaking through too many people, and treating the crisis as over once coverage fades. Each one prolongs the story.

Mistake	What it causes	Instead
Silence while facts are gathered	Others define the story	Holding statement within the first hours
Defensive or legalistic wording	Reads as indifference	Plain language, concern for those affected, then facts
Minimizing early	Credibility loss when the scope grows	State what you know; avoid “only” and “limited” until confirmed
Several spokespeople	Contradictions	One spokesperson per tier
Employees learn from the news	Leaks and morale damage	Internal message at or before the public one
Declaring it over too soon	Follow-up stories with no response	Publish a closing update with what changed
Ignoring AI search	Outdated answers persist for months	Update your newsroom, FAQs, and profiles with the resolution

Smaller-scale reputation issues follow the same principles. Our guide to responding to negative reviews covers the day-to-day version.

How do you rebuild reputation after a crisis?

Rebuild by showing what changed: new controls, new leadership, a third-party audit, restitution, or a policy shift. Then earn new coverage of the fix. Reputation recovers when the most recent credible story about you is about the solution, not the problem.

A recovery sequence that works:

1. Publish a closing update that summarizes what happened, what you did, and what changed.
2. Brief the reporters who covered the crisis on the fix, ideally with a third-party validator.
3. Return to proactive PR once the facts are settled: executive interviews, data stories, customer proof.
4. Check how AI assistants describe you each month, and update the owned and third-party sources they rely on. We cover this monitoring in AI-driven brand monitoring.

Want a plan in place before you need it? We build crisis plans, statements, and drills as part of our strategy and advisory practice, with media relations ready if the moment comes. Contact us to start with a scenario workshop.

Frequently asked questions

What are the key elements of a crisis communications plan?

The key elements are a scenario map, severity tiers with triggers, a named crisis team with decision rights and backups, pre-approved holding statements, a stakeholder communication order, channels such as a newsroom or dark site, monitoring and escalation thresholds, and a drill and review schedule. Keep the core plan short enough to use under pressure.

How quickly should a company respond to a crisis?

Aim to issue a holding statement within the first hours of a serious incident, even if facts are incomplete, and commit to a time for the next update. Speed matters because reporters, customers, and social media will fill any silence. Legal and regulatory constraints may limit what you can say, but rarely prevent saying that you are aware and responding.

Who should be on a crisis communications team?

Keep the core team small: the CEO or a delegate, general counsel, the communications lead, the operational owner of the affected area (such as security or product), and HR when employees are involved. Each member needs a named backup. Outside PR counsel and outside legal counsel often join for Level 1 events.

How often should a crisis communications plan be updated?

Review the plan at least twice a year, ideally alongside a tabletop drill, and after every real incident. Update contacts quarterly, because outdated phone numbers and departed team members are the most common failure points. Revisit the scenario map whenever the business changes significantly, such as a new market, product, or regulation.

What is a dark site?

A dark site is a pre-built web page or newsroom section that stays unpublished until a crisis, then goes live with the holding statement, updates, FAQs, and contact information. It gives reporters, customers, and search engines a single accurate source. Many companies now use a dedicated section of their existing newsroom instead of a separate site.