crisis-communication

name	crisis-communication
description	Manage communication during brand crises, PR incidents, and reputation threats. Use when responding to negative press, social media incidents, or brand crises.
origin	ECM

Crisis Communication

When to Activate

• A data breach, security incident, or product failure affects customers
• Negative press coverage or a viral negative story about the company
• An employee or executive does or says something publicly problematic
• A social media post goes viral for the wrong reasons
• Customer backlash to a policy change, pricing change, or product decision
• Legal issues become public (lawsuits, regulatory actions)
• Industry-wide crisis where your company needs to take a position
• Any situation where "should we say something?" is being asked urgently

First Questions

1. What happened? (Facts only. No assumptions, no rumors.)
2. Who is affected? (Customers, employees, partners, investors, public)
3. How severe is this? (Use the severity classification below.)
4. Is the situation still developing or has it stabilized?
5. Who knows about it? (Internal only, some external, widely public)
6. What is the factual, confirmed information vs. speculation?
7. Do we have legal exposure? (If yes, loop in legal immediately.)
8. Who is our spokesperson? (One voice. Consistent.)

Crisis Classification

Severity Level 1 — Minor

Examples: Negative review goes slightly viral. Minor product bug frustrates users. Employee tweets something mildly controversial. Response window: 24-48 hours. Response level: Social media team handles. Manager approval. Communication: Social media response. Possibly a brief statement.

Severity Level 2 — Moderate

Examples: Significant product outage (4+ hours). Negative press article in a major outlet. Customer data affected (small scale). Leadership misstep. Response window: 4-12 hours. Response level: VP/Director-level ownership. Cross-functional coordination. Communication: Public statement. Direct customer communication. Social media response.

Severity Level 3 — Severe

Examples: Major data breach. Executive misconduct. Product causes harm. Regulatory action. Massive public backlash. Response window: 1-4 hours (golden hour principle). Response level: CEO-level ownership. War room. Legal counsel. Board notification. Communication: Press statement. Customer notification. Employee communication. Potentially regulator notification. May require media interviews.

Response Timeline: The Golden Hour

First 60 Minutes

1. Assemble the crisis team. (CEO, comms lead, legal, relevant department head)
2. Confirm the facts. What do we know for certain? What is still unconfirmed?
3. Assess severity. Level 1, 2, or 3.
4. Draft a holding statement. (See template below.) Acknowledge the situation while investigation continues.
5. Decide on channels. Where does the response need to be posted?
6. Designate the spokesperson. One person. Everyone else redirects to them.
7. Notify internal stakeholders. Employees should not learn about a crisis from the press.

Hours 1-4

8. Publish the holding statement on relevant channels.
9. Monitor social media and press for developing angles and sentiment.
10. Investigate root cause if not yet known.
11. Prepare a more detailed statement once facts are confirmed.
12. Brief the spokesperson with approved talking points and Q&A prep.

Hours 4-24

13. Publish the detailed statement with specifics, remediation, and next steps.
14. Proactive media outreach if needed (offer interviews, provide updates).
15. Direct customer communication (email) if customers are affected.
16. Monitor and respond to ongoing social media and press coverage.

Days 2-7

17. Daily update cadence if the situation is ongoing.
18. Execute remediation actions and communicate progress.
19. Engage supporters — customers and partners willing to speak positively.
20. Begin planning the post-crisis review.

Holding Statement Template

Use this when you need to say something immediately but don't yet have full information.

We are aware of [brief description of the situation]. We are
actively investigating and take this matter seriously.

[If applicable: We have taken immediate action to [contain/
address the immediate issue].]

We will provide an update as soon as we have more information.
[If applicable: Affected customers can contact [support channel]
for assistance.]

[If customer data is involved: The security and privacy of our
customers is our top priority.]

Holding Statement Rules

• Acknowledge the situation. Never "no comment" in the first response.
• Do not speculate on cause or blame.
• Do not commit to specific remediation until you know the full picture.
• Show you're taking it seriously and taking action.
• Provide a channel for affected people to get help.
• Keep it under 100 words.

Stakeholder Communication Order

When a crisis breaks, communicate in this order:

1. Internal First (Employees)

• Employees should hear from leadership before they hear from the press.
• Brief all-hands or targeted department communication.
• Provide approved talking points for employees who may be asked by outsiders.
• Tell employees what to do if contacted by media: "Direct all media inquiries to [comms lead]."

2. Board / Investors (for Severity 2-3)

• Brief call or written update to the board chair.
• Include: What happened, what we know, what we're doing, expected timeline.
• For publicly traded companies, assess disclosure obligations.

3. Directly Affected Parties

• Customers whose data was affected, users impacted by an outage, etc.
• Direct, personal communication (email, in-app notification).
• Be specific about what happened and what they should do.

4. Media / Public

• Press statement, social media, blog post.
• This is the last group, not the first (but it may need to happen within hours).

5. Regulators (if applicable)

• Data breaches often have mandatory notification timelines (GDPR: 72 hours).
• Consult legal counsel immediately for regulatory obligations.

Social Media Crisis Response

Immediate Actions

• Pause scheduled posts. Nothing kills credibility like a cheerful marketing post during a crisis.
• Monitor all channels. Set up real-time alerts for brand mentions, hashtags, and keywords.
• Respond on the platform where the crisis originated. If it started on X/Twitter, respond there first.
• Pin the official response to the top of your social profiles.

Social Media Response Guidelines

• Do respond to: Direct questions, concerned customers, factual misinformation you can correct.
• Don't respond to: Trolls, inflammatory bait, every single negative comment. Engaging with trolls amplifies them.
• Tone: Empathetic, factual, human. Not defensive, legalistic, or dismissive.
• Template response for volume situations:
  • "We hear you, and we understand your frustration. Here's what we know so far: [link to statement]. We'll continue to share updates as we learn more."

What NOT to Do on Social Media

• Delete negative comments (unless they contain threats or personal information). Deletion gets screenshotted and makes things worse.
• Get into arguments. Even if someone is wrong.
• Use humor or try to be clever. This is not the time.
• Go silent. Silence is interpreted as indifference or guilt.
• Blame others. Even if it's someone else's fault, lead with what you're doing.

Spokesperson Preparation

Selecting the Spokesperson

• Severity 1: Senior team member relevant to the issue.
• Severity 2: VP or C-level executive.
• Severity 3: CEO. Always the CEO for the most serious crises.

Spokesperson Briefing Checklist

• Confirmed facts (what we know for certain)
• Approved talking points (3-5 key messages)
• Boundaries (what we can't discuss — legal, ongoing investigation)
• Q&A document with anticipated tough questions and approved answers
• Bridge phrases for redirecting difficult questions
• Empathy statements (lead with human impact, not corporate defense)

Bridge Phrases for Difficult Questions

• "What I can tell you is..."
• "The most important thing right now is..."
• "What our customers/users need to know is..."
• "We're focused on [action], and here's what we're doing..."
• "I understand the concern. Here's what we know so far..."

What the Spokesperson Should NEVER Say

• "No comment." (Say "I don't have that information yet, but we'll share it as soon as we do.")
• "It's not our fault." (Even if true, lead with empathy and action.)
• "I can't discuss that." (Say "That's part of our ongoing investigation, and we'll share findings when complete.")
• Speculation about cause, blame, or timeline before facts are confirmed.
• Minimizing language: "It's not a big deal," "only a few customers," "minor issue."

Q&A Document Preparation

Structure

For each anticipated question, prepare:

QUESTION: [The tough question a journalist or customer might ask]

KEY MESSAGE: [The core point we want to make]

APPROVED ANSWER: [Full response, written in natural language]

BRIDGE TO: [The talking point we want to steer toward]

DO NOT SAY: [Specific language to avoid]

Common Crisis Questions to Prepare For

1. What happened?
2. When did you first know about this?
3. How many people are affected?
4. What are you doing about it?
5. How did this happen? Could it have been prevented?
6. Who is responsible?
7. Will affected people be compensated?
8. How do you prevent this from happening again?
9. Why should customers still trust you?
10. Are there legal implications?

Post-Crisis Review

When to Conduct

• 1-2 weeks after the crisis has fully resolved.
• Include all members of the crisis team plus broader leadership.

Review Framework

1. Timeline reconstruction: What happened, when, in what order?
2. Response assessment: What did we do well? What could we have done better?
3. Communication audit: Were our communications timely, accurate, and effective?
4. Stakeholder feedback: How did customers, employees, media, and partners react?
5. Root cause analysis: What caused the crisis? What systemic issues contributed?
6. Process improvements: What changes to our crisis plan are needed?
7. Reputation impact assessment: What is the lasting impact on brand perception?

Metrics to Review

• Time from incident to first public response
• Social media sentiment before, during, and after
• Media coverage volume and tone
• Customer churn or support volume during and after
• Employee sentiment
• Share price impact (public companies)

Crisis Communication Plan Template

Pre-Crisis Preparation (Build This Before You Need It)

1. Crisis Team Roster

Role	Primary	Backup	Contact
Crisis Lead	[Name]	[Name]	[Phone/Email]
Communications	[Name]	[Name]	[Phone/Email]
Legal	[Name]	[Name]	[Phone/Email]
Technical/Product	[Name]	[Name]	[Phone/Email]
Customer Support	[Name]	[Name]	[Phone/Email]
Executive Sponsor	[Name]	[Name]	[Phone/Email]

2. Escalation Framework

Issue detected
    ↓
Assess severity (Level 1 / 2 / 3)
    ↓
Level 1 → Comms team handles → Manager approval → Respond within 24h
Level 2 → Crisis team assembled → VP approval → Respond within 4h
Level 3 → War room activated → CEO approval → Respond within 1h

3. Pre-Approved Templates

• Holding statement (general)
• Holding statement (data/security)
• Holding statement (product/service disruption)
• Internal communication template
• Customer notification template
• Social media response templates

4. Media Contacts

• Journalist relationships to leverage for fair coverage
• Wire service accounts for rapid distribution
• Social media access and admin credentials

5. Monitoring Setup

• Social listening tools configured for brand mentions
• Google Alerts for company name
• Real-time notification for key platforms

Common Crisis Types and Response Patterns

Data Breach / Security Incident

• Priority: Contain the breach. Notify affected users. Notify regulators (GDPR: 72 hours).
• Tone: Serious, transparent, action-oriented.
• Key message: "We discovered [incident]. Here's what happened, who's affected, and what we're doing. Here's what you should do."
• Offer: Free credit monitoring, password reset, dedicated support line.

Product Failure / Outage

• Priority: Fix the problem. Communicate status. Set expectations.
• Tone: Empathetic, technical but accessible, frequent updates.
• Key message: "We're experiencing [issue]. Our team is working on it. Here's our estimated timeline."
• Channel: Status page, social media, email to affected users.

Executive / Employee Misconduct

• Priority: Investigate. Take decisive action. Separate the individual from the brand.
• Tone: Serious, values-driven, decisive.
• Key message: "This behavior does not reflect our values. We have taken [action]. We are committed to [standard]."

Pricing / Policy Backlash

• Priority: Listen. Assess whether the backlash is justified. Decide whether to adjust.
• Tone: Humble, listening, willing to engage.
• Key message: "We hear your feedback. Here's why we made this decision. Based on your input, here's what we're going to do."
• Options: Reverse the decision, modify it, or explain the reasoning more clearly while holding firm.

Misinformation / False Claims

• Priority: Correct the record with facts. Don't amplify the false claim.
• Tone: Factual, calm, confident.
• Key message: "We want to set the record straight. Here are the facts: [specifics]."
• Caution: Only respond if the misinformation is gaining traction. Responding to obscure claims can amplify them.

Quality Gate

During a crisis:

• Have you confirmed the facts before making any public statement?
• Have employees been notified before or simultaneously with the public?
• Is there a single designated spokesperson?
• Does the response lead with empathy and action, not defense?
• Are scheduled marketing posts paused?
• Is legal counsel involved (for Severity 2-3)?
• Is there a monitoring system tracking sentiment and coverage in real time?
• Have you prepared a Q&A document for anticipated tough questions?
• Is there an update cadence committed to (and followed)?
• Have you planned a post-crisis review?

After a crisis:

• Has a post-crisis review been conducted?
• Have process improvements been documented and implemented?
• Has the crisis communication plan been updated based on learnings?
• Has the team been debriefed and acknowledged for their work?