Real-time crisis response means acting while the story is still forming. You verify the facts, bring the right people together, say something credible, and keep adjusting as information changes. The organizations that handle it well rarely improvise. They decide in advance who is in the room, who speaks, and what triggers the alarm, so the first hour is spent on judgment instead of logistics.
This guide walks through that first day: what to do in the opening minutes, how to decide when a problem has become a crisis, how to organize decisions and approvals, and how the early hours connect to recovery.
TL;DR
- Real-time response is a prepared routine, not a burst of improvisation. The first hours set the direction for everything that follows.
- In the first hour: activate the crisis team, verify facts, assess the threat level, and pause scheduled content. Draft a holding statement in hours one to four.
- Define escalation triggers before you need them, so one clear threshold, not a debate, moves an issue to the crisis team.
- Name one spokesperson, give one person the job of recording decisions, and keep legal in the approval path.
- Recovery starts on day one. Credible action, not only messaging, is what rebuilds trust.
Table of Contents
- What real-time crisis response actually means
- The first hour: what to do in the opening minutes
- Detection and escalation: when a problem becomes a crisis
- Workflow: roles, approvals, and the command center
- The phases of crisis response
- Our perspective
- After the first day: from response to rebuilding trust
- Getting support before and during a crisis
- FAQ
- Sources
What real-time crisis response actually means
When a crisis breaks, information moves faster than any organization's approval process. Academic work on crisis communication notes that the need for speed keeps growing as technology spreads information faster, which leaves crisis teams less time to respond. In some cases, the people most affected hear about the situation from media reports before the organization has told them anything.
That chapter also makes a point I return to often with clients. A crisis creates an information void, and if you do not fill it, someone else will, sometimes with rumor and speculation. Silence is not neutral. It reads as uncertainty.
So "real time" does not mean saying everything immediately. It means saying something true, quickly, and committing to the next update. A holding statement that acknowledges the situation, says what you are doing, and tells people when they will hear more is a real response. A rushed explanation that turns out to be wrong is not.
The same chapter cites the 1982 Johnson & Johnson Tylenol crisis as an example of a "quickness mistake," where a spokesperson made an inaccurate statement under pressure and the error was corrected once it was discovered. The lesson is not to slow down. It is to build a verification step into speed.
The first hour: what to do in the opening minutes
Think of the first hour as the start of a relay race. The first runner does not need to win. The runner needs to hand the baton cleanly to the next one. In a crisis, the baton is verified information, a clear owner, and a defined next step.
PRSA's crisis communications checklist lays out a 24-hour response protocol that breaks the day into windows:
Hour one. Activate the crisis team, verify the facts, assess the threat level, and halt pre-scheduled content. That last item is easy to forget. A cheerful promotional post going out ten minutes after a serious incident can become its own story.
Hours one to four. Draft a public holding statement with legal approval and assign a single spokesperson.
Hours four to twelve. Release the statement, monitor public sentiment, and address misinformation.
Hours twelve to twenty-four. Identify the root cause, take corrective action, and document decisions.
Notice what the sequence protects. Verification comes before statements, and a single voice comes before multiple voices. Documentation runs alongside everything, because the decisions you make at hour three will be examined at week three.
Who speaks first
The same PRSA checklist suggests that for high-impact incidents involving safety or public harm, a senior executive such as the CEO or CMO should serve as spokesperson to convey accountability. For a technical crisis such as a data breach, a specialized leader such as a chief security officer may be a better fit. Where the harm is systemic or the issue is complex, independent auditors or community leaders may be brought in to protect credibility.
The point is to decide this by type of event ahead of time. Deciding it under pressure, while a reporter waits, is how organizations end up with the wrong person at the microphone.
Detection and escalation: when a problem becomes a crisis
Most crises send signals before they break. Small complaints, an unusual spike in mentions, a regulator's inquiry, a rumor inside the building. Our guide to early warning indicators covers how to read those signals. Here the question is narrower: once you see something, who decides it is serious?
Define the levels before the event
Gartner's guidance on crisis escalation separates three tiers. An incident is an emergency handled within a business unit's established plans. An issue is a regional or significant cross-functional emergency that needs management beyond one team and could damage the company's local reputation. A crisis is an event with potential to cause serious company damage, requiring oversight by the crisis management team and immediate notification by telephone.
Gartner also recommends building escalation around critical enterprise-level impacts regardless of the type of risk event, and escalating when a single criterion crosses a threshold, for example when operational impact grows from one region to several. A simple matrix works better than a long policy no one reads under stress.
Monitor continuously, not only during the event
The CDC's Crisis and Emergency Risk Communication manual says monitoring should happen at every point in a crisis communication plan, because it gives ongoing feedback on whether messages or the overall strategy need to change. It covers media monitoring, internet and social media monitoring, ongoing exchange of information with key partners, and public opinion monitoring.
PRSA describes the practical version as three streams: social listening, media monitoring, and web analytics. It adds that AI tools can process large volumes of data and analyze sentiment almost instantly. Taylor LaBelle of 84 Communications, quoted in PRSA's checklist, puts the balance well: pair AI-powered monitoring with human analysis to catch the context, emotion, and disinformation that algorithms often miss.
A useful reminder of scale comes from the airline industry. An ACRP case study on Southwest Airlines after Flight 1380 in April 2018 reports that the airline keeps a social media listening center running year-round and has criteria for when to switch it to crisis mode. Within 24 hours, message volume reached a point where the team could not reach every message, and the social team led the story for the first day before traditional media took over. Planning for volume, not just for the event, is part of readiness.
Escalation triggers that work
A trigger is only useful if it removes ambiguity. Good ones are written as plain yes-or-no conditions, such as the following:
- A statement from a government agency, regulator, or law enforcement naming the organization.
- Credible media inquiries arriving from more than one outlet.
- Reports of harm to customers, patients, students, or employees.
- A topic trending locally or nationally in connection with the organization.
- A single event spreading from one location or business unit to several.
Your own list will differ by industry. A hospital, a casino, a law firm, and a startup entering the Las Vegas market face different first signals. The principle holds across all of them: decide the thresholds when you are calm.
Workflow: roles, approvals, and the command center
A workflow is the answer to "who does what next" when no one has time to ask. It does not need to be elaborate. It needs to be known.
A seven-step loop
PRSA's planning guide outlines a structure for each protocol: verification (confirm the situation and scope), notification (alert key team members), assessment (severity and potential impact), management (coordinate internally), message development (tailored responses), approval and distribution (review and release through the right channels), and monitoring (track and adjust). Notice that it is a loop. Monitoring feeds back into verification, and the cycle repeats as facts change.
Roles worth naming
Incident response playbooks from the cybersecurity world are a useful model even outside technology. One published playbook from IR-OS names six roles: an incident commander who coordinates decisions and the timeline, a scribe who records decisions and timestamps, a communications lead who drafts internal and external messages, a legal liaison, a technical lead, and an executive sponsor who unblocks resources and briefs the board.
Not every organization needs six people. A small nonprofit may have three. What matters is that every function has an owner, and that someone is explicitly responsible for writing things down. The scribe's notes become your timeline, your learning record, and sometimes your legal defense.
A command center, physical or virtual
PRSA describes the command center as the nerve center of a response. It can be a conference room or a secure virtual space where the team reviews real-time data and crafts responses. Two practices from that guide deserve emphasis. First, set up a quick verification process for misinformation, especially AI-generated content. Second, watch internal sentiment so employees hear updates from leadership, not from outside sources. Your people are your first audience and often your most credible voice.
For more on how leaders make calls inside this structure, see our practical guide to crisis decision making. If you want the written rules that sit behind the workflow, the piece on what to put in a crisis communications policy covers it.
The phases of crisis response
Real-time response is one stretch of a longer arc. Knowledge at Wharton describes five phases of crisis management: early warning and signal detection, preparation and prevention, damage containment, recovery, and learning and reflection.
The order matters less than the recognition that the phases overlap. You may be containing damage while still detecting new signals. You may start recovery work in week one while the story is still active. Wharton frames recovery as recouping the time, resources, and revenue lost and moving forward better than before. The last phase, reflection, is where you decide how to use the experience to prevent or reduce the next one.
If you are building the structure that holds these phases together, our article on a crisis management framework goes deeper, and the crisis communication plan guide covers what to put on paper.
Our perspective
After many years of advising leaders through difficult moments, I keep seeing the same pattern. The organizations that come through with their reputations intact are not the ones with the cleverest statements. They are the ones that were ready to act, and then acted credibly.
We approach real-time response as two halves of one job. Preparation is the half you do calmly: assessing readiness, mapping the people and channels, agreeing on thresholds and spokespeople. Response is the half you do under pressure, with the same people, using decisions you already made. When those halves are connected, leaders are not starting from zero at the worst possible moment.
It also helps to remember that messaging alone does not rebuild trust. People watch what an organization does next. That is why our work pairs communications with credible action, and why we draw on a network of experts when a situation calls for legal, technical, or community perspectives. Leaders do not have to carry that weight alone.
A crisis is rarely welcome. But handled with discipline and honesty, it can become the moment an organization shows people who it really is.
Mark
After the first day: from response to rebuilding trust
The first 24 hours decide how the story starts. The weeks after decide how it ends. Three things carry the work forward.
Keep the update promise. If your holding statement said you would share more by a certain time, share it, even if the update is that the investigation continues. Missed updates are where trust leaks.
Close the loop with action. Credibility comes from visible change: a corrected process, a policy updated, an independent review commissioned. Statements describe the intention. Actions prove it.
Review honestly. A useful after-action review includes a one-page summary, a full timeline, what worked, the gaps with severity ratings, whether you met your own response times, and prioritized fixes with owners and dates, as the IR-OS playbook outlines. Then run the plan again in a drill. Our collection of tabletop exercise scenarios gives you nine situations to practice.
Online reputation also needs attention as the story fades. Search results and customer reviews keep telling the story long after the news cycle moves on, and review generation and reputation support can help an organization rebuild its public record of customer experience. For regulated or high-trust sectors, the specifics shift; our guide to healthcare crisis communications is one example. And for the longer view on growth, see how leaders can turn a setback into growth.
Getting support before and during a crisis
If your organization does not yet have a tested response routine, or if a situation is already unfolding, we can help. Mark Brown Strategies offers crisis management and communications, including real-time response, tailored crisis communication plans, crisis readiness assessments, reputation management and recovery, corporate communications, community relations, and litigation support. Our team brings more than 30 years of experience and a network of experts to executives, boards, and leaders at corporations and nonprofits across California, Nevada, Arizona, and Utah.
To talk through your situation or schedule a readiness assessment, contact Mark Brown Strategies.
FAQ
What is the difference between real-time and rapid crisis response?
In practice, the terms describe the same discipline: acting quickly while facts are still developing. Speed alone is not the goal. The aim is a fast, verified, coordinated response, with a holding statement, a named spokesperson, and a commitment to the next update.
What should a crisis response checklist include?
In the first hour, a strong checklist covers activating the crisis team, verifying facts, assessing threat level, and pausing scheduled content, per PRSA's 24-hour protocol. It then moves to a legally approved holding statement, a single spokesperson, monitoring, and documentation of decisions.
What are the phases of crisis response?
Wharton describes five: early warning and signal detection, preparation and prevention, damage containment, recovery, and learning and reflection. In real events they overlap, so you may be containing damage and starting recovery at the same time.
How should a crisis response workflow be organized?
Start with a repeatable loop: verify, notify, assess, manage, develop messages, approve and distribute, and monitor. Assign owners for coordination, communications, legal review, and record-keeping, and name a spokesperson by type of event before anything happens.
Sources
- Crisis Response (Sage Publications chapter)
- Crisis Communications Checklist: 24-Hour Response Protocol (PRSA)
- Crisis Communications Planning: Building Your Response Framework (PRSA)
- Managing Ambiguity in Crisis Escalation Procedures (Gartner)
- Crisis and Emergency Risk Communication manual (CDC)
- Southwest Airlines case study on social media and emergency management (ACRP)
- The Prepared Leader: The Five Phases of Crisis Management (Knowledge at Wharton)
- The 2026 Incident Response Playbook for CISOs (IR-OS)