Business continuity communications is the part of your continuity plan that tells people what is happening while operations are disrupted: who speaks, to whom, through which channel, and how often. A recovery plan can be technically perfect and still fail if employees, customers and partners hear nothing, or hear conflicting things. This guide walks through what the plan should contain, who owns it, which backup channels to line up, and how to keep it alive after the first draft.
TL;DR
- A business continuity communications plan is the communication layer of your continuity plan: audiences, owners, channels, message templates and update frequency, all decided before an incident.
- Name a communications lead, a deputy, a spokesperson and approvers in advance, and keep contact lists somewhere you can reach when normal systems are down.
- Build backup channels (text, phone trees, a hotline, an informational webpage) and treat security of the message as part of the choice.
- Give regular, time-stamped updates even when there is nothing new, and test the plan at least once a year.
- After recovery, run an after-action review and fold the lessons back into the plan.
Table of Contents
- What business continuity communications actually covers
- The building blocks of the plan
- Channels and backup methods
- Writing the update, and keeping the rhythm
- Testing, training and updating
- Communicating during recovery
- Perspective
- Where we can help
- FAQ
- Sources
What business continuity communications actually covers
Think of a continuity plan as a relay race. The technical team runs the first leg: restoring systems, relocating staff, switching to alternate suppliers. Communication is the baton that keeps everyone else in the race. If it is dropped, the people waiting on the next leg (customers, employees, regulators, the press) stop running or start running in the wrong direction.
A business continuity communication plan defines how an organization informs its people, customers and partners while operations are disrupted and until they are restored. It specifies who tells whom, through which channel and how often. That is a different job from a general crisis communication plan, though the two overlap. Continuity communication is anchored to operations: an outage, a facility loss, a cyber incident, a supplier failure. Crisis communication adds the reputational layer, such as media scrutiny and public controversy. In practice you need both, and our guide to what a crisis communication plan should include covers the second half.
The official guidance is consistent on why this matters. Ready.gov says a crisis communications plan is an important component of a business's preparedness program, and that a business must be able to respond promptly, accurately and confidently in the hours and days after an emergency. Those three words are a useful test for everything that follows. Prompt means the first notice goes out on a target you set in advance. Accurate means one verified source of facts. Confident means the spokesperson has been chosen and prepared, not improvised at 2 a.m.
The building blocks of the plan
Most plans that fail in practice fail on the basics, not on sophistication. Here is what the authorities say belongs in the document.
Audiences and contact information
Start with a list of everyone who needs to hear from you. Ready.gov advises compiling contact information for each audience in advance, including organization name, contact name, business phone, cell number and email, and keeping the lists updated regularly and secured. A list that lives only on the server that just went down is not a plan.
The audiences differ by industry. For financial institutions, the FFIEC handbook names federal and state regulators, emergency responders, law enforcement, customers, third-party service providers, counterparties, payment system operators and information-sharing groups such as FS-ISAC as external groups the protocols should reach. A casino, a hospital and a law firm will each have a different list, but the exercise is the same: write down every group that would call you, or that you would regret not calling first.
Roles and approvals
Someone has to own the wording and the cadence. A workable structure has a communications lead, a deputy who covers when the lead is unavailable, and approvers who sign off on anything going to customers or regulators. Ready.gov adds a designated media spokesperson with prepared talking points. CISA and FBI guidance on outage communications, as reported by TechInformed, recommends naming an incident lead, a communications lead and a spokesperson before an outage happens, not during it.
The ISO technical specification on crisis management describes a hierarchy in which a strategic team handles external communication, regulatory and reputation issues, tactical teams manage the internal response, and operational teams respond to the disruption itself, as laid out in ISO/TS 22332:2021. The point for a smaller organization is not to copy the org chart. It is to separate the people fixing the problem from the people explaining it, so that neither job starves the other.
Activation: who decides the plan is live
A communications plan needs a trigger. The FEMA Continuity Guidance Circular says organizations should outline the process for activating the continuity plan and identify who has authority to activate it. CISA's resource guide on service continuity goes further, recommending that activation conditions be documented, with triggers tied to the interruption tolerances, recovery time objectives and recovery point objectives set in the business impact analysis, per the CRR Resource Guide.
In plain terms: decide in advance what level of disruption starts the first notice clock. If the answer is "whenever someone senior feels it is serious," the first message will be late.
Pre-written message templates
The worst time to draft a statement is during the incident. Ready.gov recommends pre-scripted message templates stored on a remotely accessible server, with a coordinated review and distribution process. The City of Boston's business continuity template shows what such a template can look like: a short crisis communication form with sections for describing the disruption, what the organization is doing, what it asks of recipients, and contact information. The same template includes a table of primary and backup communication systems for internal, customer, vendor, supplier and regulator communication.
Four questions answered in plain language beat four paragraphs of careful hedging. What happened? What are we doing? What do we need from you? Where do you hear next?
Channels and backup methods
Every plan has a primary channel, usually email or a corporate messaging tool. The question the plan must answer is what happens when that channel is the thing that broke.
The FFIEC handbook suggests several options when traditional voice communications are impaired: text messaging through employer-provided and personal mobile phones, personal email, instant messaging, an inbound hotline number, an informational webpage, or a two-way polling phone system. The CISA and FBI outage guidance lists backups including SMS and phone trees, radios, alternative email or messaging systems, out-of-band communications and conference bridges, and advises testing them before you need them.
One caution belongs right here, where the choice is made. The FFIEC stresses that regardless of the device used, appropriate controls to safeguard customer and other sensitive information must be maintained. A personal text thread is fine for "the office is closed, call this number." It is not fine for patient data, account details or legal strategy. Decide in advance which categories of information may travel over which channel, and tell staff.
Communication is also two-way. Ready.gov notes that stakeholders will ask questions and request information, and that the business answers through a contact center and an information center. If your plan only covers outbound announcements, your phones and inbox will fill with the same ten questions, and your team will answer them ten different ways. A single informational webpage and a scripted answer sheet for whoever picks up the phone solve most of this.
Writing the update, and keeping the rhythm
Cadence matters as much as content. CISA and FBI guidance, as summarized by Cybernoz, calls regular, time-stamped updates critical because they limit speculation and demonstrate an active response. It recommends a clear timeline, documentation of actions taken and recovery milestones, and a timestamp on every update, even when there is no news.
That last point surprises many leaders. Silence feels safer than saying "no change." It is not. A message that says "as of 3:15 p.m., engineers are still isolating the fault; next update at 5:00 p.m." tells people you are in control of the process even when you are not yet in control of the outcome.
The same guidance describes parallel, synchronized workstreams: technical teams diagnose and fix, communications teams handle public messaging, and leadership manages strategy and regulatory outreach. Communication is not a secondary activity done once the fix is in. If you want a deeper look at how a team can structure that rhythm for fast-moving news, a 24 to 72 hour response system for comms teams is worth studying alongside your own plan.
A few habits make the rhythm hold under pressure:
Set the time target for the first notice in the plan itself, and name the channel that can meet it. Agree on the next-update time in every message. Keep one fact sheet that every spokesperson reads from. And route anything going to customers or regulators through the named approvers, even if that costs ten minutes.
Testing, training and updating
A plan nobody has rehearsed is a hypothesis. The public-sector guidance is firm on this. Ohio's 2025 business continuity planning guidance states that testing, training and exercises must occur annually, and that within three months of an exercise or actual incident the plan is to be modified, approved and redistributed. The Boston template adds that the plan should be reviewed after an exercise, a disruption or a significant change to the business, and that training should happen whenever responsibilities change.
For communications specifically, three exercises pay for themselves.
First, a call-tree drill: send a test message through your backup channel and measure how long it takes for most people to confirm. You will find out who changed numbers and who never joined the group. Second, a tabletop scenario with the spokesperson and approvers, where the facilitator injects a reporter's call, a customer complaint and a regulator's question in the first hour. We have collected nine scenarios you can run for exactly this purpose. Third, a no-primary-systems drill, where the team works only from the backup channels for an hour. Teams that cannot find the message templates without the shared drive learn it cheaply this way. Platforms that build decision-based training for operations teams can also help with rehearsing the judgment calls, not just the logistics.
Training should reach beyond the core team. The Maryland continuity manual, which the research cites, calls for educating all staff on their role in plan execution and testing backup systems for effectiveness. Employees are an audience and a channel: what they say to neighbors and on social media will travel faster than your official statement.
Communicating during recovery
Restoring systems does not end the communication job. Trust is rebuilt by what you do and say in the days after. TechTarget's guidance on emergency communications plans lists post-event steps that include confirming employees have returned to work safely, completing a final status report with an after-action review, reporting on how the notification systems performed, and updating the plan with lessons learned.
In our experience, the closing message matters more than leaders expect. It should say plainly what happened, what was restored, what changed so it is less likely to recur, and where people can take questions. Credible action is the foundation: stakeholders forgive disruptions far more readily than they forgive evasion. If the event carries legal exposure, coordinate the wording with counsel from the start. Our guide to litigation communications for leaders and counsel explains how to keep both audiences in mind.
Perspective
Over three decades of advising organizations, I have noticed that continuity plans are usually written by the people who care most about systems, and communication gets a paragraph near the end. Then an incident arrives and the paragraph becomes the whole story.
What we try to do differently is treat preparation and real-time response as one discipline. The plan on the shelf and the call at 6 a.m. should be the same document in practice. That means a readiness assessment that asks hard questions about who decides, who speaks and who approves, templates the team has actually used in a tabletop, and a network of specialists you can reach when the situation needs more than your internal team.
I would encourage leaders to see this work as more than insurance. An organization that tells the truth quickly, in a steady voice, and then follows through with visible action often emerges with its reputation stronger than before. That is the shift in perspective I hope this article offers: continuity communication is not damage control, it is leadership made visible.
Mark
Where we can help
If your continuity plan has a thin communications section, or you are not sure it would hold on a bad day, that is the work we do. Mark Brown Strategies offers crisis readiness assessments, tailored crisis communication plans, real-time crisis response, corporate communications, reputation management and recovery, community relations and litigation support, drawing on more than 30 years of experience and a network of experts.
We work with organizations across California, Nevada, Arizona and Utah, including law firms, healthcare organizations, casinos, financial services firms and nonprofits. To talk through your plan, contact Mark Brown Strategies. If your sector is healthcare, start with our guide to healthcare crisis communications, and for the decision layer behind the messaging, see crisis decision making for leaders.
FAQ
What is the difference between a business continuity plan and a crisis communication plan?
A business continuity plan covers how operations keep running or get restored after a disruption. A crisis communication plan covers what you tell people and how. The communications plan is the layer of the continuity plan that connects operations to audiences, and it extends further when the event draws media or public attention.
Who should be on the business continuity communications team?
At a minimum, a communications lead who owns wording and cadence, a deputy, a spokesperson, and approvers for customer and regulator messages. Ready.gov and the CISA and FBI outage guidance both point to naming these roles before an incident. Larger organizations often add a technical liaison so facts flow from responders to communicators.
How often should we test the communications plan?
At least once a year, based on public-sector guidance such as Ohio's, and again after any real incident, major exercise or significant business change. Ohio's guidance calls for revisions within three months of an exercise or incident. Test your backup channels separately from your tabletop discussion.
What should we do if email and phones are down?
Use the backups you set up in advance: text messaging, a phone tree, an inbound hotline, an informational webpage or a conference bridge. The FFIEC and the CISA and FBI guidance list these options. Keep sensitive information off personal channels, and make sure contact lists and templates are stored where you can reach them without your main systems.
Sources
- Crisis Communications Plans, Ready.gov
- Business Continuity Communication Plan: Template
- FFIEC IT Examination Handbook, IV.B Communications
- CISA & FBI issue new guidance for outage communications, TechInformed
- ISO/TS 22332:2021
- FEMA Continuity Guidance Circular
- CISA CRR Resource Guide: Service Continuity Management
- Boston.gov Business Continuity Plan template
- CISA, FBI, partners release guidance on IT/OT outage communications, Cybernoz
- Ohio DAS 2025 Business Continuity Planning Guidance
- Developing an emergency communications plan, TechTarget
- Reactive PR: Build a 24 to 72 Hour Response System
- Cognistry: Operations Teams