The worst time to build a crisis communication plan is during a crisis. Obvious — and yet most companies do it anyway.

Research from the Institute for Crisis Management backs this up: most organizations hit by a major reputational crisis had no formal plan in place when it happened. They scrambled. They improvised. And the improvising usually made things worse.

I’ve watched this play out from both sides. The difference between a brand that handles a crisis well and one that doesn’t was never the severity of what happened — it was whether the framework existed before it happened. Brands with a plan respond within hours, keep the narrative, and recover in weeks. Brands without one take days to respond, lose control of the story, and spend months cleaning up.

A crisis communication plan isn’t a document you write once and file away — it’s a working system: roles, protocols, pre-drafted templates, escalation paths, monitoring triggers. That system is what lets your team move fast when the stakes are real and the pressure is highest.

Here’s how to build one.

What Counts as a Crisis

Not every bad review or angry tweet is a crisis. Treating them like one wastes resources, creates panic, and trains your team to tune out real alarms once everything feels like an emergency.

A situation is a crisis when it hits at least two of these four criteria:

Immediate threat to reputation. The event could fundamentally change how customers, partners, investors, or employees see your brand. A product defect that causes harm, executive misconduct, a data breach exposing customer information.

Spreading fast. Multiple outlets are picking it up, or it’s going viral on social. The speed of spread determines whether you have hours or days to respond — in most modern crises, it’s hours.

Needs a cross-functional response. One department can’t handle it alone. It needs communications, legal, customer service, operations, and leadership working together.

Potential for lasting damage. Left unaddressed, it could mean lost revenue, regulatory action, employee attrition, or permanent brand damage.

A negative product review is not a crisis. A viral thread from a former employee detailing a toxic workplace — with screenshots — is. Knowing the difference prevents both overreaction and underreaction.

Crisis Categories

Most organizational crises fall into one of six categories. Your plan should have a pre-built response template for each:

1. Product/service failure — Defects, outages, safety issues, recalls
2. Data/privacy breach — Unauthorized access to customer or employee data
3. Leadership/personnel — Executive misconduct, discrimination claims, high-profile departures
4. Financial — Layoffs, missed earnings, fraud allegations, regulatory fines
5. External attack — Misinformation campaigns, competitor attacks, activist targeting
6. Operational — Supply chain disruption, workplace accidents, environmental incidents

Phase 1: Pre-Crisis Preparation

Build the plan when nothing’s on fire. Every piece you put in place now is one less thing you’ll have to figure out later, under pressure, with incomplete information.

Assemble the Crisis Response Team

Define who’s on the team, what each person’s role is, and how they’ll be reached when a crisis breaks. The team should include:

Crisis Lead — The single decision-maker during a crisis. Usually the CEO or COO for major crises, the VP of Communications for smaller ones. Final say on messaging, timing, and escalation.

Communications Lead — Drafts and approves every external statement, press response, and social media post. Works the messaging strategy with the crisis lead.

Legal Counsel — Reviews every public statement for legal exposure. Has veto power on risky language, but can’t be allowed to sit on it indefinitely. Cap review time at 30-60 minutes in the plan.

Social Media Lead — Monitors channels in real time, manages community responses, flags emerging issues. Needs to be active where the crisis is unfolding within minutes, not hours.

Customer Service Lead — Handles inbound customer questions. Needs talking points and an FAQ aligned with the public messaging before the first ticket comes in.

Subject Matter Expert — Changes with the crisis type. Product issue: head of engineering or product. Data breach: your CISO or head of security.

Document everyone’s contact info somewhere offline-accessible. Your Slack, email, and intranet may be down or overloaded during a crisis. Every team member should have the crisis contact sheet on their phone.

Create the Escalation Matrix

Not every negative event needs the full crisis team. Build a three-level escalation matrix:

Level 1 — Routine issue: Customer service and communications handle it. No executive involvement needed. Examples: a negative review, a minor complaint going semi-viral, a low-stakes journalist inquiry.

Level 2 — Emerging situation: Communications lead and the relevant department head activate. Crisis lead is informed but not yet engaged. Examples: a product issue affecting a small group of customers, negative press gaining traction, an employee misconduct allegation.

Level 3 — Full crisis: The entire crisis team activates, crisis lead takes command. Examples: a data breach, a product recall, an executive scandal, a viral reputational attack, a regulatory investigation.

Define the triggers that move you from Level 1 to 2, and from 2 to 3, before you need them. For example: media pickup crosses five outlets, social mentions on the topic cross 500 in an hour, stock price drops more than 5%, or a Tier 1 publication reaches out for comment.

Pre-Draft Your Templates

You won’t have time to write from scratch once a crisis hits — every minute spent wordsmithing is a minute the narrative moves without you. Pre-draft a template for each crisis category so you’re editing, not writing.

Holding statement — Goes out within the first 60 minutes. Acknowledges the situation, says you’re investigating, commits to an update. Buys time without committing to anything you might have to walk back.

Structure: “We are aware of [situation description]. We are actively investigating and will provide a full update within [timeframe]. [Affected stakeholder group] can contact [specific channel] for immediate assistance.”

Full response — Goes out once you have the facts: what happened, what caused it, what you’re doing about it, what affected stakeholders should do. Show appropriate concern without accepting liability — let legal calibrate the wording.

Media statement — Shorter than the full response, built for journalist inquiries. Key facts, a quote from the crisis lead or CEO, contact info for follow-up.

Social media templates — Short-form versions of the above, per platform: initial acknowledgment, update with new information, resolution announcement, and a response for individual customer complaints.

Internal memo — Your employees should hear about the crisis from you before they hear about it from the media. Covers what happened, what the company is doing, what staff should and shouldn’t say publicly, and who fields press inquiries.

Phase 2: The Response Framework

The first 60 minutes decide whether you control the narrative or it controls you. When the crisis hits, the plan shifts from preparation to execution.

The First 60 Minutes

Minutes 0-15: Assess and activate. Whoever spots the crisis triggers the escalation matrix. The crisis lead is notified and pulls the team together — in person, by phone, or through the pre-designated channel. Goal: figure out what happened, who’s affected, how fast it’s spreading.

Minutes 15-30: Holding statement. The communications lead adapts the pre-drafted holding statement and gets crisis-lead sign-off. If legal review is needed, use the pre-approved holding statement while the full one gets checked. Publish it on your website, your social channels, and wherever the crisis is being discussed.

Minutes 30-60: Gather information. The subject matter expert compiles facts. Legal reviews exposure. Customer service preps interim talking points for the volume that’s coming. The communications lead starts drafting the full response.

This timeline is aggressive on purpose. Edelman and others have shown, repeatedly, that organizations that respond within the first hour recover their reputation far faster than those that take 24-48 hours. Speed here doesn’t mean recklessness — it means the templates, the team, and the protocols are ready so speed is possible without guessing.

The Holding Statement: Your Most Important Tool

The holding statement is the most important document in your crisis arsenal. It does three things:

1. Shows you’re aware and engaged. Silence during a crisis reads as ignorance or indifference — both are worse than saying something imperfect.
2. Buys time for a complete response. You can’t say what you don’t know yet. It sets the expectation that more is coming, without locking you into premature commitments.
3. Makes you the reference point. Once you’ve put out the first statement, media and social users have something to cite. Say nothing, and they cite each other — and the narrative spirals.

A good holding statement is factual, empathetic without being defensive, and specific about what comes next. A bad one is vague, corporate-sounding, or promises something the company might not be able to deliver.

Message Framework: The 4A Model

For the full crisis response, use a four-part framework that covers everything stakeholders need to hear:

Acknowledge — State plainly what happened. No minimizing, no deflecting, no passive voice. “A data breach occurred” is clearer and more trustworthy than “An incident may have impacted some user data.” People can smell hedging, and it erodes trust faster than the crisis itself.

Apologize (when appropriate) — If you’re at fault, say so. A sincere apology that takes responsibility is the fastest path to de-escalation. A conditional apology (“we’re sorry if anyone was affected”) is worse than none — it signals you don’t take the situation seriously. Legal will push back on direct apologies; negotiate this during plan creation, before you need it.

Act — State specifically what you’re doing about it. Concrete: “We’ve engaged a third-party cybersecurity firm to investigate the breach and are rolling out two-factor authentication across all accounts this week.” Vague commitments (“we’re taking steps to ensure this doesn’t happen again”) read as corporate filler.

Advance — Set the timeline for updates and next steps. “We will share the results of our investigation within 24 hours.” Then hit that deadline. Every missed update costs you the trust you’re trying to rebuild.

“The companies that survive crises aren’t the ones that never make mistakes. They’re the ones that respond fast, take responsibility, and show stakeholders exactly what they’re doing to fix the problem. Speed, transparency, and accountability — in that order.”

— Salva Jovells, Presslei

Phase 3: Social Media During a Crisis

Most modern crises accelerate on social media, and it’s where most response plans fail most spectacularly. The dynamics are different from traditional media, so the tactics have to be too.

The Speed Imperative

On social media, the gap between a crisis emerging and the narrative being set is measured in minutes, not hours. A post goes viral, screenshots circulate, commentary piles up. By the time a corporate comms team has drafted, reviewed, and approved a response through normal channels, the story has already been told thousands of times without their input.

Your social media lead needs pre-authorization to post the holding statement across every channel the moment the crisis is confirmed — no waiting for the full response chain. This only works because the templates were already approved by legal and leadership back when things were calm.

What to Post and When

First post (within 30 minutes): The adapted holding statement. Keep it short. Acknowledge, commit to an update, pin it to the top of your profile.

Follow-up posts (every 2-4 hours during an active crisis): Share new information as it becomes available. Each post should add something new — repeating the same holding statement signals you’re not making progress.

Individual responses: For customers directly affected, respond individually with specific guidance and route them to your support channel. Don’t engage trolls or arguments — it amplifies the negative conversation without helping anyone actually affected.

Post-resolution post: A clear summary of what happened, what was done, and what changed as a result. This becomes the reference point for anyone who finds the story later.

What Not to Do

Don’t delete posts or comments. Deleting negative comments during a crisis speeds it up, not down. Screenshots circulate, and the deletion becomes its own story. The only exception is content that violates platform terms (threats, abuse, doxxing) — remove those and document why.

Don’t go dark on unrelated content. Pause all scheduled social posts during a Level 3 crisis. A promotional post next to a data-breach apology reads as tone-deaf and gets screenshotted as proof you don’t care. Pause everything, handle the crisis, resume normal posting once it’s actually resolved.

Don’t argue with the narrative. If incorrect information is circulating, correct it once with a factual statement. Don’t go back and forth. Repeated corrections look defensive and keep the negative narrative alive. State the facts, link to your official statement, move on.

Phase 4: Working with Journalists During a Crisis

Journalists will contact you during a crisis. How you handle those inquiries shapes the narrative. They’re not the enemy — they’re going to write the story whether you participate or not. Your only choice is whether it includes your perspective, or just the perspectives of critics, affected customers, and competitors.

Responding to Media Inquiries

Respond to every inquiry. “No comment” is never an acceptable crisis response — it reads as an admission of guilt or indifference. If you don’t have full information yet, say so: “We’re actively investigating and will provide a full statement within [timeframe]. Here’s what we can confirm so far.”

Be proactive, not just reactive. Don’t wait for journalists to contact you. Once the holding statement is published, have the communications lead reach out to the journalists who cover your industry — the ones you’ve already built relationships with through your regular PR work. Offer a briefing, an interview with the crisis lead, or early access to the full statement. Journalists who get proactive outreach during a crisis are significantly more likely to write balanced coverage.

This is where your ongoing media list and journalist relationships pay dividends beyond normal campaign cycles. A journalist who knows you, trusts your information, and has had a positive prior experience with your team is far more likely to give you the benefit of the doubt during a crisis than one who’s never heard from you.

Designate a single spokesperson. Multiple people speaking to media creates inconsistency, and inconsistency during a crisis reads as dishonesty or incompetence. The crisis lead or a designated senior spokesperson handles all media; everyone else redirects inquiries to that person.

Phase 5: Internal Communication

Your employees are stakeholders too — often the most exposed ones. They field questions from friends and family, watch the fallout unfold from their personal social accounts, and their morale and retention are directly on the line.

The Internal-Before-External Rule

Employees should hear about the crisis from the company before they hear about it from the media or social media. Your internal communication goes out at the same time as, or slightly before, your public holding statement.

The internal message should include:

1. What happened — The same facts you’re sharing publicly, plus internal context if it helps
2. What the company is doing — The response plan and timeline
3. What employees should do — Specific guidance on handling questions from customers, media, or personal contacts
4. What employees should not do — No posting about the crisis on personal social media, no speculating publicly, no talking to journalists without authorization
5. Who to contact — An internal point of contact for employee questions and concerns

Skip this and you get two problems: employees feel disrespected — they found out from social media instead of their own CEO — and they become a leak risk, because nobody told them what the official position is.

Phase 6: Post-Crisis Recovery

The response doesn’t end when the situation is resolved. Recovery — which can run weeks to months — decides whether the crisis leaves a permanent scar or becomes a footnote.

The Post-Crisis Review

Within two weeks of resolution, run a thorough review with the full crisis team:

• Timeline reconstruction: What happened, when, and how was it handled? Build a minute-by-minute timeline.
• Response assessment: What went well? What was too slow? Where did the plan fail?
• Communication audit: Review every public statement, social post, and media interaction. Were they consistent, timely, on message?
• Stakeholder impact: How did customers, partners, investors, and employees react? What feedback came in?
• Plan updates: Update the crisis communication plan based on what you learned. Every crisis teaches you something the plan didn’t account for.

Reputation Rebuilding

After a major crisis, proactive reputation rebuilding through earned media is the fastest path back. This is where reactive PR shifts back to proactive mode:

Tell the resolution story. The crisis was news. The resolution is news too. Pitch how you identified the problem, what you changed, and what safeguards are now in place. Journalists who covered the crisis negatively will often cover the resolution — if you pitch it right.

Use data to rebuild trust. If the crisis involved a product or service failure, publish the data behind the fix. “We identified the root cause within 48 hours and cut the failure rate from X to Y” is a powerful narrative. Turn your recovery data into a PR story that demonstrates transparency and accountability.

Re-engage with key journalists. The journalists who covered the crisis are your most important contacts for the recovery narrative. Reach out personally, offer a post-mortem interview with the CEO, and bring concrete evidence of what changed. Building this into your media outreach strategy makes sure recovery coverage reaches the same audiences that saw the crisis coverage.

Setting Up Crisis Monitoring

You can’t respond to what you don’t see. Crisis monitoring is the early warning system that buys you the precious minutes between a crisis emerging and it going mainstream.

Monitoring Tools and Triggers

Set up automated monitoring across these channels:

Brand mentions: Google Alerts (free), Mention, or Brandwatch for real-time brand name monitoring. Include common misspellings, executive names, and product names. Our Google Alerts setup guide covers the configuration in detail.

Social listening: Monitor Twitter/X, LinkedIn, Reddit, and industry-specific forums for spikes in brand mentions, negative sentiment, or keywords tied to your crisis categories. Tools like Brandwatch and Sprout Social provide real-time alerting.

Review platforms: Monitor Trustpilot, G2, Capterra, and industry-specific review sites for sudden increases in negative reviews — an early indicator of a product issue that hasn’t gone mainstream yet.

Competitor monitoring: Watch how competitors handle their crises. It’s free lessons in what works and what doesn’t, and it flags industry-wide issues that could hit you next.

Define alert thresholds that trigger escalation: mention volume exceeds 2x normal rate, sentiment score drops below a threshold, a Tier 1 publication runs a negative story, or a social post about your brand crosses a certain engagement level.

The Crisis Communication Plan Document

Everything above should live in a single, accessible document. Here’s the structure to use:

Section 1: Crisis Definition and Severity Levels — What qualifies as a crisis, the three-level escalation framework, and triggers for each level.

Section 2: Crisis Response Team — Names, roles, contact information (personal cell phones, not just work email), and backup contacts for each role.

Section 3: Escalation Matrix — Who activates, who’s notified at each level, and the decision authority chain.

Section 4: Response Templates — Pre-drafted holding statements, full responses, media statements, social media posts, and internal communications for each crisis category.

Section 5: Channel Protocols — How each channel (website, social, email, phone, internal) is used during a crisis, who owns it, and posting protocols.

Section 6: Media Contacts — Key journalists who cover your industry, their contact information, and notes on prior relationship. Overlaps with your regular media list but should be accessible independently.

Section 7: Monitoring Setup — Tools, alert thresholds, and escalation triggers.

Section 8: Post-Crisis Review Template — The review framework and questions for the post-crisis assessment.

Store this document somewhere accessible even if your primary systems go down: a shared Google Drive folder, a printed copy in each crisis team member’s desk, a PDF on each team member’s phone. During a data breach or system outage, your intranet may be unavailable — the plan still needs to be reachable.

Salva Jovells is the founder of Presslei, a reactive PR agency that builds earned media authority through journalist relationships, not paid placements. Read our reactive PR guide to understand how proactive media relationships protect your brand during both good times and bad, or see our newsjacking playbook for turning breaking news into earned coverage.

About the Author

Salvador Jovells

Founder of Presslei. 12+ years in ecommerce SEO across international markets. After a decade of link buying for Hockerty and Sumissura, I reverse-engineered 5,272 earned media placements and founded a reactive PR agency that builds authority through data-driven stories journalists actually want to publish. Based in Zurich.