Crisis Communication Plan: A Step-by-Step Template

Most crisis communication plans are written after a crisis has already exposed the gaps in the previous one. The organization survives a difficult episode, someone asks why there was no clear response protocol, and a plan gets drafted. It gets filed somewhere, read by few people, and tested the next time something goes wrong.

This cycle produces plans that exist but don’t function. A crisis communication plan that works has a different design: it is specific enough to be executable under pressure, known to everyone who needs to execute it, and rehearsed often enough that the first hour of a crisis isn’t spent locating the document.

Crisis communication plan: the foundation before the framework

Before building a response framework, three foundation questions need answers:

What are your plausible crises? Every organization has a specific risk profile. A software company’s crisis scenarios look different from a food manufacturer’s or a logistics provider’s. Identify the five to ten scenarios most likely for your organization: a data breach, a product recall, an executive misconduct allegation, an operational failure, a financial irregularity, a major customer complaint going viral. Generic crisis plans are harder to execute than scenario-specific ones.

Who makes decisions under pressure? In a crisis, normal organizational hierarchies can slow down response fatally. The plan needs to name a Crisis Response Team with explicit authority to act: who can approve public statements, who speaks to media, who contacts regulatory bodies, who manages internal communications. These decisions should be made in advance, not during the crisis.

Where are your vulnerabilities? Crisis communications often fail not because the organization did something wrong, but because the organization didn’t know what it knew. A crisis audit – reviewed annually – maps the information flows, supply chains, customer data, and partner relationships that could generate negative exposure. Knowing where the vulnerabilities are makes the first-response faster.

The crisis communication team: roles and responsibilities

Every crisis communication plan needs an identified team with defined roles. Team size varies by organization, but the minimum configuration requires five functions – which may be filled by fewer people in smaller organizations:

Crisis lead – The person with overall decision authority during a crisis. Typically the CEO, COO, or Chief Communications Officer depending on the nature of the crisis. The crisis lead approves all external communications and has authority to override normal approval processes.

Communications lead – The person responsible for drafting and coordinating all external messaging: press statements, social media posts, customer communications, regulatory notifications. Distinct from the crisis lead in larger organizations; the same person in smaller ones.

Legal liaison – A named lawyer or legal team contact who can review statements in real time for liability exposure. The legal review process must be fast enough to work on crisis timelines – not the standard 48-hour review cycle.

Internal communications lead – Responsible for keeping employees, board members, and investors informed. Overlooked in many plans but critical: employees who don’t know what’s happening will find out some other way, usually less accurately.

Monitoring lead – Responsible for tracking what’s being said about the crisis in real time: social media, news publications, analyst reports, customer forums. The monitoring function feeds information to the rest of the team continuously.

Document the team roster with direct phone numbers. During a crisis, the normal org chart doesn’t apply – the crisis team needs to be reachable by everyone who needs them.

The first 30 minutes: what has to happen immediately

The first window of any crisis is when the response framework either activates or fails to activate. The specific actions in the first 30 minutes:

1. Activate the crisis team. A single designated person (crisis lead or their deputy) calls or messages every crisis team member. Not email. Direct contact. The team assembles – physically or on a call – within 30 minutes of the crisis trigger.

2. Assess what is actually known. Do not issue a statement until the facts are understood. “What happened, what is the confirmed situation, what do we know we don’t know yet?” A statement based on incomplete information that has to be retracted is worse than a brief delay.

3. Issue a holding statement. If media inquiries arrive before the facts are clear, a holding statement buys time without creating liability. It acknowledges the situation, confirms that the organization is responding, and gives a specific time by which more information will be available. “We are aware of reports about [X] and are actively investigating. We will provide an update by [specific time].”

4. Establish a monitoring watch. The monitoring lead begins tracking media coverage and social conversation in real time. The first 30 minutes set the tone for what follows.

Message framework: what to say and how to say it

A crisis communication message framework has three layers:

Layer 1: The acknowledgment. What the organization knows happened and the fact that it is responding. This is not an admission of fault – it is acknowledgment that something occurred that requires a response. “We have become aware of [situation]. We take this seriously and are taking immediate action.”

Layer 2: The impact statement. Who is affected, in what way, and what the organization is doing immediately. Be specific about who is affected – vague statements about “some users” or “certain products” generate speculation that fills gaps the organization should be filling.

Layer 3: The commitment. What the organization will do and by when. Not open-ended promises – specific, time-bound commitments. “We will provide a complete update by [time/date]. Affected customers will be contacted directly by [method] within [timeframe].”

Each layer needs to be drafted as the crisis evolves. Acknowledgment often goes in the first hour. Impact follows once facts are clearer. Commitment evolves as actions are taken.

Spokesperson preparation: who speaks and how

Naming a spokesperson is one decision. Preparing them is another, and most organizations spend significantly less time on the second than on the first.

The spokesperson should be:

• The most senior person who can speak to this specific type of crisis with credibility
• Briefed on the exact message framework, with key phrases prepared
• Trained in the question types they’ll face (hostile, speculative, repeated)
• Clear on what they will not answer and why

What spokespersons should never do: speculate about causes before facts are confirmed, assign blame before investigations are complete, minimize the impact on affected parties, or go off-script with personal opinions.

Prepare the spokesperson for the worst-case question. In a product safety crisis: “Were you aware of this risk before the incident?” In a data breach: “How long did customers’ data remain exposed?” In an executive misconduct case: “What did senior leadership know and when?” Preparing answers to these questions in advance is not spin – it is responsible preparation.

Channel management during a crisis

Different audiences need different communications through different channels, on different timelines:

Media – Press statements, direct journalist calls for established relationships, updated statements as facts develop. Never “no comment” – it reads as evasion. “We don’t yet have confirmed information on that specific question; we’ll include it in our next update” is factually defensible and less damaging.

Customers – Direct communication (email, in-app notification, SMS) before or simultaneous with public statements. Customers should not learn about a crisis affecting them from a news article. The content: what happened, how it affects them specifically, what they should do, and what you’re doing.

Employees – Internal communication before external statements where possible. Employees who read about a crisis in the news before hearing from their organization’s leadership lose trust that’s hard to recover. Internal communications should be honest about what’s known and unknown.

Investors and board – Simultaneous with or immediately after the first public statement. Investors need sufficient information to manage their own communications and legal obligations.

Regulators – Depending on the crisis type, regulatory notification may be legally required within specific timeframes. The legal liaison tracks these obligations.

The dark site: a pre-built response hub

A dark site is a web page – typically at a subdomain of your main website – that is built and ready to publish but kept offline until needed. It contains:

• The organization’s initial statement
• Contact information for press, customers, and employees
• FAQs with pre-drafted answers to the most predictable questions
• A timeline that can be updated in real time as facts develop

Building a dark site in the middle of a crisis, while also managing media calls and internal communications, is not feasible. Build it before. Publish it within the first two hours of a significant crisis.

Post-crisis review: the step most plans skip

The crisis communication plan isn’t complete until it includes a post-crisis review protocol. Within two weeks of a crisis resolution:

• What worked well in the response?
• What failed, and why?
• Were the response timelines met?
• Were the right people empowered to act?
• What would we do differently?

The review findings should update the crisis communication plan directly. Crisis plans that aren’t updated after real-world use become progressively less accurate.

The annual crisis drill

A crisis communication plan that is never practiced is a plan that will fail under pressure. Schedule an annual crisis drill: a tabletop exercise where the crisis team works through a simulated scenario in real time.

A basic tabletop drill takes two to three hours. It should simulate the time pressure and information ambiguity of a real crisis, not a clean scenario with all facts provided in advance. The most valuable outcome is not the drill itself – it’s the post-drill discussion: where did the team hesitate, where were the gaps, what decisions were harder than expected?

For the specific scenario of receiving media coverage you didn’t initiate, how to handle negative press coverage provides the tactical playbook. For the first 60 minutes specifically, see the first 60 minutes of a PR crisis.

The irreducible minimum

For organizations that currently have no crisis communication plan, the irreducible minimum is:

1. A named crisis team with direct contact information
2. One pre-approved holding statement adaptable to common scenarios
3. A decision tree for the first 30 minutes
4. A defined media spokesperson

That is not a complete plan. But it is the difference between an organization that has nothing prepared and one that has a framework to activate when the first call from a journalist arrives.