Crisis management and incident response planning engine that builds classification frameworks, decision trees, communication playbooks, and post-crisis recovery roadmaps. USE THIS SKILL when the user mentions crisis response, crisis management plan, incident playbook, reputation risk, business continuity activation, crisis communication, tabletop exercise, crisis simulation, golden hour protocol, stakeholder notification, or post-crisis after-action review. Covers the full crisis lifecycle from preparedness through recovery.
Crisis management and incident response planning engine that builds classification frameworks, decision trees, communication playbooks, and post-crisis recovery roadmaps. USE THIS SKILL when the user mentions crisis response, crisis management plan, incident playbook, reputation risk, business continuity activation, crisis communication, tabletop exercise, crisis simulation, golden hour protocol, stakeholder notification, or post-crisis after-action review. Covers the full crisis lifecycle from preparedness through recovery.
Crisis Management
Required Inputs
Organization: Company name, industry, size, and geographic footprint.
Crisis History: Past incidents, near-misses, and lessons learned.
START: Operational disruption detected
|
+--> Can operations continue at >80% capacity?
| YES --> Level 1-2: Monitor, activate backup procedures
| NO --> Proceed
|
+--> Is customer delivery impacted?
| YES --> Level 3+: Activate BCP
| | +--> Backup facility available?
| | | YES --> Failover within RTO
| | | NO --> Invoke mutual aid / emergency vendor contracts
| | +--> Customer notification required?
| | YES --> Activate customer communication template
| NO --> Level 2: Internal remediation, enhanced monitoring
|
+--> Duration estimate?
< 24 hours --> Manage internally with status updates
24-72 hours --> CMT activated, stakeholder communication
> 72 hours --> Level 4: Full crisis response, regulatory notification if required
3B. Reputational Crisis (Negative Media, Social Media Viral, Executive Misconduct)
START: Reputational threat identified
|
+--> Is the allegation/story true?
| YES --> Acknowledge, take responsibility, announce corrective action
| NO --> Prepare factual rebuttal with evidence
| PARTIAL/UNCERTAIN --> Acknowledge concern, announce investigation, do NOT deny
|
+--> Is media coverage active?
| YES --> Activate Communications Lead
| | +--> Prepare holding statement (within 1 hour)
| | +--> Designate single spokesperson
| | +--> Monitor media and social channels continuously
| NO --> Prepare reactive statement, monitor for escalation
|
+--> Does it involve executive misconduct?
| YES --> Legal privilege immediately; board notification;
| | outside counsel leads investigation; consider executive leave
| NO --> Standard investigation protocol
|
+--> Social media velocity?
Trending --> Activate social media war room (see Section 6)
Contained --> Standard monitoring cadence
3C. Cyber Crisis (Data Breach, Ransomware, System Compromise)
START: Cyber incident confirmed
|
+--> Invoke incident response plan (link to cyber-risk-assessment skill)
+--> Contain: Isolate affected systems (DO NOT power off -- preserve forensics)
|
+--> Is personal data affected?
| YES --> Start breach notification clock
| | +--> GDPR: 72 hours to supervisory authority
| | +--> US state laws: Varies (30-90 days; check specific state)
| | +--> HIPAA: 60 days to HHS, affected individuals, media if > 500
| | +--> Engage breach counsel and forensic firm
| NO --> Assess operational and IP impact
|
+--> Is it ransomware?
| YES --> DO NOT pay without legal, insurance, and law enforcement consultation
| | +--> Engage law enforcement (FBI IC3, local field office)
| | +--> Activate offline backups
| | +--> Check cyber insurance policy for ransom coverage
| NO --> Standard containment and eradication
|
+--> Business impact?
Critical systems down --> Activate BCP/DR; CMT Level 4+
Non-critical systems --> Targeted remediation; Level 2-3
START: Financial crisis indicator
|
+--> Going concern risk?
| YES --> Level 5: Board emergency session; engage restructuring advisor
| NO --> Assess severity
|
+--> Covenant breach?
| YES --> Immediate lender notification (most agreements require prompt notice)
| | +--> Engage financial advisor for waiver negotiation
| | +--> Prepare covenant compliance remediation plan
| NO --> Proceed to liquidity assessment
|
+--> Financial restatement required?
| YES --> Audit committee notification; SEC 8-K filing; investor communication
| | +--> Engage restatement counsel and forensic accountants
| NO --> Standard financial remediation
|
+--> Stock exchange disclosure required?
YES --> Draft 8-K/6-K with legal counsel within required timeframe
NO --> Internal remediation with board reporting
3E. Legal Crisis (Litigation, Regulatory Action, Government Investigation)
START: Legal crisis identified
|
+--> Government investigation / subpoena?
| YES --> IMMEDIATELY invoke legal privilege on ALL related communications
| | +--> Engage outside counsel with relevant expertise
| | +--> Implement litigation hold (preserve ALL documents, emails, data)
| | +--> DO NOT conduct internal interviews without counsel present
| | +--> Board notification (audit committee)
| NO --> Standard legal assessment
|
+--> Class action or mass litigation?
| YES --> Assess insurance coverage; engage mass tort counsel;
| | prepare investor communication; assess disclosure obligation
| NO --> Individual matter management
|
+--> Regulatory enforcement action?
YES --> Cooperate unless counsel advises otherwise
| +--> Assess self-disclosure benefit (DOJ cooperation credit, SEC whistleblower)
| +--> Prepare remediation narrative
NO --> Monitor and prepare defensive position
3F. Natural Disaster / Physical Crisis
START: Physical threat detected
|
+--> Is there immediate danger to life?
| YES --> Evacuate. Call emergency services. Account for all personnel.
| | NOTHING else matters until people are safe.
| NO --> Assess facility and asset impact
|
+--> Facility accessible?
| YES --> Damage assessment; secure affected areas
| NO --> Activate alternate work locations; remote work protocol
|
+--> Duration estimate?
< 3 days --> Temporary measures; employee communication
3-14 days --> BCP activation; customer notification
> 14 days --> Full relocation; insurance claim; regulatory notification if applicable
4. First 24 Hours Playbook (Golden Hour Protocol)
Hour 0-1: Detection and Initial Response
Action
Owner
Deliverable
Confirm the incident is real (not rumor/false alarm)
Subject: Important Update -- [Brief Description of Situation]
Team,
We are aware of [brief, factual description of what happened]. We are actively
managing the situation with the following steps:
1. [Immediate action taken]
2. [What we are doing to resolve]
3. [What employees should/should not do]
Your safety and well-being are our top priority. [If physical safety: follow
evacuation/safety procedures. If cyber: change passwords, be alert for phishing.]
We will provide updates every [frequency]. Direct questions to [designated contact].
Please do NOT speak to media, post on social media about this incident, or
share information outside the company. Direct all media inquiries to [name/number].
[Signature -- CEO or appropriate senior leader]
5B. Customer Communication (Level 3+)
Subject: [Company Name] -- Important Notice Regarding [Issue]
Dear [Customer],
We are writing to inform you of [factual description]. We take this matter
very seriously.
What happened: [Clear, factual explanation -- no speculation]
What we are doing: [Specific remediation steps]
What this means for you: [Direct impact assessment]
What you should do: [Specific, actionable steps for the customer]
[If data breach: We are offering [credit monitoring / identity protection]
at no cost. Enroll at [link] or call [number].]
We sincerely apologize for [the inconvenience / concern this may cause].
For questions, contact [dedicated support line/email].
[Signature -- CEO or relevant executive]
5C. Media Statement (Holding Statement -- Level 3+)
[Company Name] is aware of [brief description]. We are taking this matter
seriously and are actively [investigating / responding / working to resolve
the situation].
[The safety of our people / the security of our customers' data / the
continuity of our operations] is our highest priority.
We are working with [relevant authorities / external experts / law enforcement]
and will provide updates as more information becomes available.
Media contact: [Name], [Phone], [Email]
5D. Regulator Notification (Template)
[Date]
[Regulatory Body Name]
[Address]
Re: [Notification Type] -- [Company Name] -- [Reference Number if applicable]
Dear [Title/Name],
Pursuant to [specific regulation/statute requiring notification], we are
notifying [regulatory body] of [description of incident/event].
Date of discovery: [Date]
Nature of incident: [Brief factual description]
Scope of impact: [Number of individuals/entities affected]
Immediate actions taken: [Containment measures]
Ongoing investigation: [Status and expected timeline]
Point of contact: [Name, title, phone, email]
We will provide supplemental information as our investigation progresses.
Respectfully,
[Name, Title]
5E. Investor/Board Communication (Level 4+)
[Confidential -- Board / Investor Communication]
Subject: [Incident Type] -- Board Briefing [Date/Time]
Situation Summary:
[2-3 sentence factual summary]
Current Status: [Contained / Active / Escalating]
Financial Impact Assessment: [Estimated range or "under assessment"]
Regulatory Exposure: [Notification obligations and status]
Legal Exposure: [Litigation risk assessment -- privileged]
Reputational Impact: [Media coverage assessment]
Insurance Coverage: [Applicable policies and status of claim]
Actions Taken:
1. [Action and owner]
2. [Action and owner]
Board Action Required:
- [Approval / oversight / decision needed]
Next Update: [Date/time]
6. Social Media Response Protocol
Monitoring and Escalation
Metric
Threshold
Action
Mentions per hour
> 50
Alert Communications Lead
Mentions per hour
> 500
Activate social media war room
Sentiment score
< -0.5 (negative)
Prepare proactive response
Influencer amplification
> 100K follower account posts
Direct engagement consideration
Hashtag trending
Appears in trending topics
Full war room; executive approval on all posts
Response Decision Matrix
Post Type
Response
Timing
Factual question
Answer with approved facts
Within 1 hour
Misinformation
Correct with facts (no arguing)
Within 30 minutes
Emotional/angry customer
Empathize, move to DM, resolve
Within 1 hour
Troll/bad faith actor
Do not engage
N/A
Media journalist post
Redirect to media contact
Within 30 minutes
Employee post (policy violation)
Internal HR follow-up (NOT public correction)
Within 2 hours
Golden Rules for Crisis Social Media
NEVER delete posts or comments (it will be screenshot and amplified).
NEVER argue, be defensive, or blame others.
ONE consistent voice -- all posts approved by Communications Lead.
Acknowledge the situation even if you cannot share details.
Provide a single link for updates (crisis landing page).
Pause all scheduled marketing/promotional posts immediately.
7. Business Continuity Activation Triggers
Trigger
BCP Component Activated
RTO Target
Primary facility inaccessible > 4 hours
Alternate work location plan
8 hours
Core IT system down > RTO threshold
IT disaster recovery plan
Per system classification
Key vendor failure (no service delivery)
Vendor contingency / alternate vendor
24 hours
Workforce unavailable > 30%
Remote work / cross-training activation
4 hours
Pandemic / public health emergency
Pandemic response plan
24 hours
Payment systems failure
Manual payment processing
4 hours
Regulatory shutdown order
Legal response + appeal + temporary cessation
Immediate compliance
8. Post-Crisis After-Action Review
Conduct within 2-4 weeks of crisis resolution while memory is fresh.
After-Action Review Structure
Phase
Activities
Output
Data Gathering (Week 1)
Collect all crisis logs, communications, decisions, timelines
Specific remediation being offered to affected parties
Information required by law or regulation to be disclosed
What NOT to Say
Speculation about cause, scope, or blame before investigation is complete
Admission of legal liability (distinguish "responsibility" from "liability")
Number of affected individuals before count is confirmed
Specific dollar amounts of damages or losses
Anything that contradicts or could contradict regulatory filings
Details that could compromise an ongoing investigation
Information protected by attorney-client privilege
Legal Privilege Preservation
Action
Purpose
Label all crisis communications "Privileged and Confidential -- Attorney Work Product"
Preserve attorney-client privilege
Route all investigation communications through counsel
Maintain privilege
Conduct internal investigation under legal direction
Create privileged work product
Separate business remediation (not privileged) from legal investigation (privileged)
Avoid inadvertent waiver
Do NOT forward privileged communications to third parties without counsel approval
Prevent waiver
Output Template
## Crisis Management Plan: [Organization]### Document Control
| Field | Detail |
|---|---|
| Version | [#] |
| Approved By | [CEO / Board] |
| Last Updated | [Date] |
| Next Review | [Date -- annual minimum] |
| Distribution | [Confidential -- CMT members, General Counsel, Board] |
### Crisis Classification Framework
[Severity levels 1-5 with escalation triggers]
### Crisis Management Team
[Roles, contact info, backup assignments]
### Decision Trees
[Crisis-type-specific decision trees]
### Golden Hour Protocol
[First 24 hours playbook]
### Communication Templates
[Pre-approved templates for each stakeholder group]
### Business Continuity Activation Triggers
[Trigger-response matrix]
### Reputation Recovery Roadmap
[Post-crisis recovery phases]
### Legal Coordination Protocol
[What to say / not say; privilege preservation]
### Exercise Schedule
[Annual tabletop and simulation calendar]
### Appendices- A: CMT contact list (wallet card format)
- B: External advisor contact list (counsel, PR firm, forensics, insurance broker)
- C: Regulatory notification requirements by jurisdiction
- D: Insurance policy summary (coverage, limits, deductibles, notification requirements)
- E: Pre-approved holding statements by crisis type
Quality Checks
Crisis classification framework has 5 distinct severity levels with specific, measurable escalation triggers between each level.
CMT roles are defined with primary and backup assignments -- no single points of failure.
Decision trees exist for all 6 crisis types (operational, reputational, cyber, financial, legal, natural disaster) and use branching logic, not linear checklists.
Golden hour protocol covers the first 24 hours in specific time blocks with named owners and defined deliverables.
Stakeholder communication templates exist for all key audiences (employees, customers, media, regulators, investors/board).
Social media response protocol includes monitoring thresholds, response decision matrix, and explicit "do not" rules.
Business continuity activation triggers link to specific BCP components with RTO targets.
After-action review methodology includes root cause analysis (5 Whys or equivalent), not just "lessons learned."
Tabletop exercise design includes injects, evaluation criteria, and scoring -- not just a discussion guide.
