Crisis Communications Plan Template

Scenarios, severity levels, crisis team and approval matrix, spokespeople, holding statements, stakeholder order, regulatory clocks, message log, review

PemasaranStandarCommon practice; clocks cite GDPR Art. 33 and SEC Form 8-K Item 1.05crisis communications planDiperbarui 29 Okt 2026

Buka di editorUnduh .md

Cara menggunakan: Use it when preparing how the organisation will speak in a crisis. Fill the team, approvals and holding statements in calm times and rehearse yearly. The main pitfall is saying more than you know in the first statement.

Pratinjau

Crisis Communications Plan: [Organisation name]

How an organisation communicates when something goes wrong in public: the scenarios it prepares for, severity levels, the crisis communications team, approvals, spokespeople, pre-approved holding statements, stakeholder and channel order, monitoring and the review afterwards. Based on common corporate communications practice, with regulatory notification clocks cited from EU and US sources as dated examples. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: check the current official text and ask a qualified professional.

Document control

Field	Value
Document ID	[CCP-YYYY-01]
Version	[1.0]
Status	[Draft / Approved / Superseded]
Owner	[@head-of-communications]
Approvers	[@ceo], [@general-counsel]
Last updated	YYYY-MM-DD
Last exercise	YYYY-MM-DD
Next review	YYYY-MM-DD
Classification	[Confidential]

Revision history

Version	Date	Author	Change
1.0	YYYY-MM-DD	[@owner]	Approved plan
[1.1] (Example)	YYYY-MM-DD	[@owner]	Added scenario SCN-04 after the annual exercise

1. Scope and linked plans

A communications crisis is any event that threatens trust in the organisation among customers, staff, regulators, investors or the public and that needs coordinated external or internal messaging.

Linked plans: [Example: compliance/incident-response-plan (security incidents), compliance/business-continuity (outages and site loss), ops/incident-commander-handbook (technical incident command), compliance/personal-data-breach-assessment (data breach decisions)].

2. Scenarios

Scenario ID	Scenario	Likely first signal	Holding statement	Linked plan
SCN-01 (Example)	Service outage over 4 hours	Monitoring alert, customer posts	HS-01	Business continuity
SCN-02 (Example)	Personal data breach	Security team alert, researcher report	HS-02	Incident response
SCN-03 (Example)	Executive misconduct allegation	Journalist enquiry	HS-03	Board protocol
SCN-04 (Example)	Product error causing customer financial loss	Support ticket spike	HS-01 adapted	Incident response
[SCN-05]	[scenario]	[signal]	[HS-ID]	[plan]

3. Severity levels

Level	Description (Example)	Who declares	First external statement within	Team
Level 1, Major	Wide public or media attention, regulator interest or safety risk	Head of communications or CEO	1 hour of declaration	Full crisis team
Level 2, Significant	Many customers affected or trade media interest	Head of communications	4 hours	Core team
Level 3, Contained	Few customers, no media interest	Communications on duty	Direct to those affected, same day	Communications on duty

4. Crisis communications team and approvals

Role	Name	Deputy	Responsibilities
Crisis communications lead	[@head-of-comms]	[@deputy]	Runs the team, owns the message log
Executive decision-maker	[@ceo]	[@coo]	Approves Level 1 statements
Legal	[@general-counsel]	[@counsel]	Reviews statements; owns regulatory notifications
Incident liaison	[@incident-commander]	[@deputy]	Supplies confirmed facts from the operational response
Customer communications	[@cx-lead]	[@deputy]	Status page, customer emails, support macros
Internal communications	[@internal-comms]	[@deputy]	Staff briefings
Social and monitoring	[@social-lead]	[@deputy]	Monitoring, replies, escalation

Approval matrix (Example):

Content	Drafts	Approves
Pre-approved holding statement	Crisis communications lead	Crisis communications lead and legal
Updated statement with new facts	Crisis communications lead	Legal and executive decision-maker
Regulator notification	Legal	Executive decision-maker
Staff message	Internal communications	Crisis communications lead

5. Spokespeople

Spokesperson	Speaks on	Levels	Media trained
[@ceo]	Level 1, all topics	1	[YYYY-MM-DD]
[@cto]	Technical causes, once confirmed	1, 2	[YYYY-MM-DD]
[@head-of-comms]	Holding statements, media enquiries	1, 2, 3	[YYYY-MM-DD]

Everyone else directs enquiries to [press@example.com] and does not comment, including on personal social accounts.

6. Holding statements

HS-01, service disruption (Example):

We are aware that some customers cannot [use service] since [time, time zone]. Our team is working to restore it, and we are sorry for the disruption. We will post the next update at [status page URL] by [time].

HS-02, suspected data incident (Example):

On [date] we identified [a security incident affecting some of our systems]. We acted to contain it and are investigating with [independent specialists]. We will contact anyone affected directly. Our next update will be at [time or date].

HS-03, allegation about a person (Example):

We are aware of the report concerning [role]. We take it seriously and are looking into it [with independent support]. We will not comment further while that process is under way.

Do not: speculate about causes, blame suppliers or individuals, give numbers that are not confirmed, or say "no comment". When facts are confirmed and a fuller announcement is needed, draft it with marketing/press-release; for planned service work use ops/maintenance-notice instead of this plan.

7. Stakeholders, order and channels

Order	Stakeholder	Channel	Owner
1	Directly affected customers	Email, in-app notice, status page	[@cx-lead]
2	Staff	Internal chat and all-staff email	[@internal-comms]
3	Regulators, where required	Per legal (section 8)	[@general-counsel]
4	Board and investors	Call and written briefing	[@ceo]
5	Media and public	Statement on website, social posts, press office	[@head-of-comms]
6	Partners and suppliers	Account managers	[@partnerships]

8. Regulatory and legal clocks

Ref	Jurisdiction	Rule (as of October 2026)	Clock	Official source
REG-01	EU, and UK under UK GDPR	GDPR Article 33: notify the supervisory authority of a personal data breach unless unlikely to result in risk; Article 34 covers telling individuals when risk is high	Without undue delay and, where feasible, within 72 hours of becoming aware	https://eur-lex.europa.eu/eli/reg/2016/679/oj
REG-02	US, SEC registrants	Form 8-K Item 1.05, material cybersecurity incidents (SEC rules adopted 2023-07-26)	Generally four business days after determining the incident is material	https://www.sec.gov/newsroom/press-releases/2023-139
[REG-03]	[jurisdiction]	[rule]	[clock]	[URL]

Questions for legal at the start of every Level 1 or 2 crisis: Which notifications apply, and when does each clock start? Must regulators or exchanges hear before the public statement? Is any information subject to legal privilege or an embargo?

9. Monitoring and message log

Time	Channel	What was said or published	By	Approved by
Example: 09:40	Status page	HS-01 published	[@cx-lead]	[@head-of-comms], [@legal]
[time]	[channel]	[content]	[@name]	[@approver]

Monitor: [Example: social mentions, news alerts, support ticket themes, employee review sites], with a summary to the team every [Example: two hours] during Level 1.

10. After the crisis

Question	Answer
Did the first statement go out within the target for the level?	[answer]
Were affected people and staff told before the media reported it?	[answer]
Were any statements corrected later? Why?	[answer]
What changes to scenarios, statements or contacts follow?	[answer]

Standard and licence note

Based on common corporate crisis communications practice, with regulatory clocks cited from public law and regulator releases as dated examples (EU GDPR Articles 33 and 34; US SEC Form 8-K Item 1.05). The structure, text and fictional example are original. Check the current official text and the rules of every jurisdiction where you operate; this is not legal advice. Template licence: MIT.

Templat terkait

Pemasaran