A crisis communication plan is a short, practiced framework that tells your organization who speaks, to whom, in what order and with what approved language when something goes wrong. It is not a binder. The best plans are brief enough to be read under pressure, specific enough to remove guesswork, and rehearsed often enough that people trust them. This guide walks through what belongs in the plan, how to write it, and how to keep it alive.
TL;DR
- A workable plan defines activation criteria, named spokespersons with backups, categorized contact lists, pre-approved message templates, a clearance process and the channels you will use.
- Aim for a high-level framework, not a manual for every scenario. A bloated plan goes unread.
- Staff should hear news before or at the same time as outsiders.
- Test the plan at least once a year. The value is in the practice, not the document.
- Avoid speculating on cause and avoid "no comment."
Table of Contents
- Why a plan matters before anything happens
- The three goals of the first hour
- What belongs in the plan
- How to write it: a practical sequence
- Passing the baton: employees first
- A worked example of a holding statement
- Testing, training and keeping it alive
- Measuring whether it works
- Mistakes we see most often
- Our perspective
- When to bring in outside help
- FAQ
- Sources
Why a plan matters before anything happens
In the first hours of a crisis, information is incomplete, facts are scattered and media interest is intense. That is how the federal Dams Sector Crisis Management Handbook describes the initial phase, and it matches what leaders tell us after the fact. Nobody feels ready, because nobody has the full picture.
A plan does not give you the full picture. It gives you a process, so the decisions that can be made in advance are already made. Who decides that this is a crisis? Who signs off on the first statement? Who calls the board? When those answers sit on one page, your attention goes to the facts rather than the logistics.
There is also a cultural point. Organizations often treat crisis communication as a marketing function. The same CISA handbook argues that communicators belong inside the emergency response structure, so messages are grounded in what is actually happening rather than in reactive PR. In our experience, that is the difference between a statement that calms people and one that gets picked apart by the next news cycle.
The three goals of the first hour
It helps to be clear about what you are trying to accomplish. CDC crisis communication guidance, summarized in its pandemic influenza CERC manual, points to three aims: preventing further injury or damage, restoring calm, and building confidence in the organization's response. Notice what is missing from that list: defending the brand. Confidence in your response is what protects the brand, and it is earned through action, not adjectives.
The CDC's CERC principles offer a useful checklist for tone. As laid out on the CDC's radiation emergency CERC page, they are: be first, be right, be credible, express empathy, promote action and show respect. Written for public health, they translate well to a company facing a data breach, a workplace injury or a viral complaint. Speed matters because people tend to keep following the first source they trust. Empathy matters because people who feel understood are more willing to listen.
What belongs in the plan
The federal handbook and Ready.gov converge on a short list of essentials. Think of these as the six working parts of the plan.
Activation criteria
Decide in advance what turns an incident into a crisis. It might be a threat to life or safety, a regulatory inquiry, a lawsuit that reaches the press, a data exposure, or media inquiries above a certain number in an hour. Without criteria, teams hesitate, and hesitation is expensive. Name the person who has authority to activate the plan, and a backup for that person.
Roles and spokespersons
List the crisis team by role and by name: the executive lead, communications lead, legal counsel, operations or safety lead, HR lead and a scribe who keeps a log. Name a primary spokesperson and at least one backup. Make sure the spokesperson has been trained for cameras and hostile questions before the day it matters. Not every CEO is the right voice in the first hour, and the plan should say who speaks when.
Contact lists by audience
Build categorized lists: employees, board members, customers, media, regulators and elected officials, insurers, suppliers, and partners. Ready.gov's crisis communications guidance stresses that many different audiences need information specific to their own interests. A neighbor of your casino, a patient's family and a bondholder want different things from you. Put mobile numbers, not just office lines, and review the lists every quarter.
Message templates
Write holding statements and templates for your most likely scenarios, with blanks for facts. A good holding statement acknowledges the situation, says what you are doing, says what you do not yet know and promises the next update at a stated time. The research is consistent that you should focus on what is known, what is being done and when people will hear more, and that you should avoid speculating on cause. The same guidance warns against "no comment," which signals a lack of transparency. If you cannot answer, say why and say when you will.
Verification and clearance
Every statement needs a path: who drafts, who checks facts, who approves legally, who gives final sign-off. Keep it short enough that approval takes minutes, not hours. For routine holding statements, pre-clear the language so only the facts need a final check.
Channels and tools
List how you will reach each audience: email, text alerts, your website, social accounts, a hotline, a media briefing, a staff call. Then plan for failure. Ready.gov-based guidance recommends an out-of-band system, meaning a secure repository separate from your main infrastructure that holds contact rosters, pre-approved statements and alternate channel instructions. If your email server is down, a plan stored on that server is no plan at all.
How to write it: a practical sequence
Here is the order we suggest, described as a narrative rather than a checklist because each step feeds the next.
Start with risk. Gather your leadership team and ask what could realistically happen to an organization like yours. A law firm worries about a conflict-of-interest allegation or a data leak involving client files. A casino worries about a security incident, a guest injury or a labor dispute. A hospital worries about a patient safety event or a privacy breach. A nonprofit worries about a donor controversy or a misuse-of-funds claim. You are not trying to list every possibility. You are trying to find the five or six that deserve a template.
Next, map your stakeholders. For each risk, write down who is affected, who will hear first, who will be angry and who can help. This map drives the contact lists and the order of notification.
Then set the structure: activation criteria, team, spokespersons, clearance. Keep this part to a page or two. The Georgia Public Library Service and several universities publish free templates, and they are fine starting points for format, but a template filled in without hard conversations produces a document that looks complete and fails in practice.
After that, draft the message templates. Aim for core categories rather than endless scenarios: acknowledgment of an incident, safety instructions, contact information for questions. The CISA handbook warns that trying to document every conceivable scenario leads to a bloated plan that gathers dust. Templates that can be tailored in real time beat a library nobody opens.
Finally, decide where the plan lives and who has it. Print copies for the crisis team, a secure offline copy, and a one-page quick reference with phone numbers on the first page.
Passing the baton: employees first
Leaders often picture the press conference. I would ask you to picture the break room instead. Your employees are your most credible messengers and your most exposed audience. If they learn about your crisis from a news alert, they will fill the silence with worry, and some of them will post about it.
Ready.gov guidance is explicit that internal teams should receive communications before or at the same time as external audiences. Think of a relay race. The message is the baton, and the first handoff is to your own people. If that pass is fumbled, the rest of the race gets harder.
A simple illustration: a mid-sized company learns that a vendor exposed customer records. Before the press release goes out, a manager-level call or message tells staff what happened, what the company is doing, what they should say if customers call and where to send media inquiries. The statement to the public is then repeated by hundreds of informed people rather than contradicted by hundreds of guessing ones.
A worked example of a holding statement
Imagine a hotel-casino group that learns of a serious guest incident on property. A strong first statement has four parts. It expresses concern for those affected. It states plainly what the company knows. It describes what the company is doing, such as cooperating with authorities and supporting those involved. It names when the next update will come.
What it leaves out matters as much: no speculation about cause, no blame, no legal hedging dressed up as sympathy, and no jargon. The CDC's own model for emergency messages is a good reminder that the first message should be short and empowering. In a radiation emergency the example is only a few words long. Yours will be longer, but the discipline is the same: say what people need to know and what to do.
Testing, training and keeping it alive
The most common misconception is that a crisis plan is a static policy. It is a living process. The value is not in the final PDF but in the practice, the regular meetings and the relationships with media and stakeholders built before an incident.
Ready.gov recommends testing plans annually through exercises so you can find gaps before a real event. A tabletop exercise is the easiest way to begin. Gather the crisis team for two hours, present a realistic scenario in stages, and make them draft and clear a statement against a clock. Then ask what slowed you down. Common discoveries include outdated phone numbers, an approver who is unreachable, a spokesperson who is uncomfortable on camera and a template that nobody can find.
After each exercise or real event, update the plan within thirty days while the lessons are fresh. Add new team members. Remove people who have left. Check that your out-of-band repository is current.
Measuring whether it works
Crisis communication metrics do not have to be elaborate. Track a few things in drills and in real events: time from first alert to activation, time from activation to first approved statement, how quickly staff were informed, how many inquiries were answered within your stated window, and whether coverage reflected your key facts accurately. The UK Government's STOP crisis communications planning guide frames planning around strategy, tactics, organization and people, and encourages being ready to communicate within the critical first hour. That makes a good benchmark for drills, even for private organizations outside the UK.
After the event, a short communications audit is worth the effort. Review the timeline, the statements, the channel performance and stakeholder reaction. Ask what you would do differently, and write it into the plan.
Mistakes we see most often
The first is treating the plan as a document rather than a practice. A beautiful plan nobody has rehearsed will fail in the first thirty minutes.
The second is over-engineering. Fifty pages of scenarios is a deterrent to use. Keep the core short, and attach appendices for contact lists and templates.
The third is waiting for perfect information. Practitioners note that situational awareness is at a premium early in a crisis and there are few second chances. You cannot wait for everything to be known, but you can say what is known and when you will update.
The fourth is inconsistent messaging. When the website, the spokesperson and the social post say slightly different things, credibility erodes. A single fact sheet, updated and cleared, solves most of this.
The fifth is forgetting that the crisis does not end when the news cycle does. Rebuilding trust comes through credible action afterward: fixing the underlying problem, reporting on progress and keeping promises.
Our perspective
We have spent more than 30 years advising leaders who thought they had more time than they did. What we have learned is that the organizations that come through a crisis well are rarely the ones with the thickest plan. They are the ones where leadership has talked through the hard scenarios in advance, where roles are clear and where people trust the process enough to act on it.
We also believe preparation and response belong together. A plan written without understanding how a live crisis unfolds tends to be tidy and unusable. Counsel given during a live crisis without knowing the organization's culture, stakeholders and history tends to be generic. Our approach joins the two, supported by a network of experts we can bring in when a situation calls for legal, technical or community knowledge.
And we would encourage you to see a crisis, handled well, as more than damage control. How you act under pressure shows people who you are. Leaders who respond with candor and credible action often find that trust deepens rather than disappears.
— Mark
When to bring in outside help
Many organizations can draft a first version of the plan internally, and we encourage that. Outside counsel becomes valuable when you are in a regulated or high-visibility setting, when leadership disagrees about risk, when you are entering a new market, or when a situation is already unfolding. Mark Brown Strategies offers crisis management and communications support, including crisis readiness assessments, tailored crisis communication plans, real-time response, reputation recovery and litigation support, for organizations across California, Nevada, Arizona and Utah. If you want a second set of eyes on your current plan, or need one built, that is a conversation we are glad to have.
FAQ
What should a crisis communication plan include?
At a minimum: activation criteria, named roles with primary and backup spokespersons, categorized contact lists, pre-scripted message templates, a verification and approval process, and a list of channels for internal and external audiences. Add a one-page quick reference and a schedule for testing. Keep the core document short.
How long should the plan be?
Long enough to guide decisions and short enough to be read under stress. The core framework often fits in a few pages, with contact lists and templates as appendices. Federal guidance warns that trying to document every scenario produces a bloated plan that goes unused.
How often should we update and test it?
Test it at least once a year through an exercise, as Ready.gov recommends. Review contact lists more often, ideally every quarter, and update after any real incident or leadership change.
Who should be the spokesperson?
Choose someone credible, calm and trained, and name a backup. It is not always the CEO. The right voice depends on the type of crisis, and the plan should say who speaks for which situations.
Is a free template enough?
A template is a useful starting format, but it only becomes a plan when your team makes real decisions about risks, roles and approvals. If your organization is in a heavily scrutinized sector such as healthcare, gaming or financial services, consider an outside readiness assessment.