# Crisis Communications Plan: [Organisation name]

> How an organisation communicates when something goes wrong in public:
> the scenarios it prepares for, severity levels, the crisis
> communications team, approvals, spokespeople, pre-approved holding
> statements, stakeholder and channel order, monitoring and the review
> afterwards. Based on common corporate communications practice, with
> regulatory notification clocks cited from EU and US sources as dated
> examples. Replace every `[bracketed]` value and every row marked
> *Example*. This is a documentation format, not legal advice: check the
> current official text and ask a qualified professional.

<!--
Guidance: How to use this template
- This plan covers communications. Operational response lives in the
  incident, continuity and security plans; link them in section 1 so
  the two teams start together.
- Prepare holding statements (section 6) in calm times and get them
  pre-approved; in a crisis the first public word usually needs to go
  out within an hour or two.
- Rehearse at least once a year with a realistic scenario.
- Common pitfall: saying more than you know. Holding statements state
  facts, show care and promise an update time; they do not guess causes.
- The worked example is Larkspan, a fictional software company. All
  names and details are invented.
-->

## Document control

<!-- Guidance: Keep a printed or offline copy with contact numbers; systems may be down during the crisis. -->

| Field | Value |
|---|---|
| Document ID | [CCP-YYYY-01] |
| Version | [1.0] |
| Status | [Draft / Approved / Superseded] |
| Owner | [@head-of-communications] |
| Approvers | [@ceo], [@general-counsel] |
| Last updated | YYYY-MM-DD |
| Last exercise | YYYY-MM-DD |
| Next review | YYYY-MM-DD |
| Classification | [Confidential] |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@owner] | Approved plan |
| [1.1] *(Example)* | YYYY-MM-DD | [@owner] | Added scenario SCN-04 after the annual exercise |

## 1. Scope and linked plans

<!-- Guidance: Say what counts as a crisis for communications and which operational plans run alongside. -->

A communications crisis is any event that threatens trust in the
organisation among customers, staff, regulators, investors or the
public and that needs coordinated external or internal messaging.

Linked plans: [*Example:* `compliance/incident-response-plan` (security
incidents), `compliance/business-continuity` (outages and site loss),
`ops/incident-commander-handbook` (technical incident command),
`compliance/personal-data-breach-assessment` (data breach decisions)].

## 2. Scenarios

<!-- Guidance: List the realistic scenarios for your organisation, with the likely first signal and the holding statement that fits. Base the list on your risk register, not on headlines. -->

| Scenario ID | Scenario | Likely first signal | Holding statement | Linked plan |
|---|---|---|---|---|
| SCN-01 *(Example)* | Service outage over 4 hours | Monitoring alert, customer posts | HS-01 | Business continuity |
| SCN-02 *(Example)* | Personal data breach | Security team alert, researcher report | HS-02 | Incident response |
| SCN-03 *(Example)* | Executive misconduct allegation | Journalist enquiry | HS-03 | Board protocol |
| SCN-04 *(Example)* | Product error causing customer financial loss | Support ticket spike | HS-01 adapted | Incident response |
| [SCN-05] | [scenario] | [signal] | [HS-ID] | [plan] |

## 3. Severity levels

<!-- Guidance: Agree levels and who can declare each. Levels decide who joins and how fast the first statement goes out. -->

| Level | Description *(Example)* | Who declares | First external statement within | Team |
|---|---|---|---|---|
| Level 1, Major | Wide public or media attention, regulator interest or safety risk | Head of communications or CEO | 1 hour of declaration | Full crisis team |
| Level 2, Significant | Many customers affected or trade media interest | Head of communications | 4 hours | Core team |
| Level 3, Contained | Few customers, no media interest | Communications on duty | Direct to those affected, same day | Communications on duty |

## 4. Crisis communications team and approvals

<!-- Guidance: Name a deputy for every role. Approval must be fast: agree in advance that the head of communications plus legal can release a holding statement, and the CEO approves anything beyond it. -->

| Role | Name | Deputy | Responsibilities |
|---|---|---|---|
| Crisis communications lead | [@head-of-comms] | [@deputy] | Runs the team, owns the message log |
| Executive decision-maker | [@ceo] | [@coo] | Approves Level 1 statements |
| Legal | [@general-counsel] | [@counsel] | Reviews statements; owns regulatory notifications |
| Incident liaison | [@incident-commander] | [@deputy] | Supplies confirmed facts from the operational response |
| Customer communications | [@cx-lead] | [@deputy] | Status page, customer emails, support macros |
| Internal communications | [@internal-comms] | [@deputy] | Staff briefings |
| Social and monitoring | [@social-lead] | [@deputy] | Monitoring, replies, escalation |

Approval matrix *(Example)*:

| Content | Drafts | Approves |
|---|---|---|
| Pre-approved holding statement | Crisis communications lead | Crisis communications lead and legal |
| Updated statement with new facts | Crisis communications lead | Legal and executive decision-maker |
| Regulator notification | Legal | Executive decision-maker |
| Staff message | Internal communications | Crisis communications lead |

## 5. Spokespeople

<!-- Guidance: Name who speaks for which level and topic, and who must not speak. Make sure every spokesperson has had media training. -->

| Spokesperson | Speaks on | Levels | Media trained |
|---|---|---|---|
| [@ceo] | Level 1, all topics | 1 | [YYYY-MM-DD] |
| [@cto] | Technical causes, once confirmed | 1, 2 | [YYYY-MM-DD] |
| [@head-of-comms] | Holding statements, media enquiries | 1, 2, 3 | [YYYY-MM-DD] |

Everyone else directs enquiries to [press@example.com] and does not
comment, including on personal social accounts.

## 6. Holding statements

<!-- Guidance: Short, factual, caring, and with a time for the next update. Fill the brackets at the time; do not change the structure without approval. -->

**HS-01, service disruption *(Example)*:**

> We are aware that some customers cannot [use service] since
> [time, time zone]. Our team is working to restore it, and we are
> sorry for the disruption. We will post the next update at
> [status page URL] by [time].

**HS-02, suspected data incident *(Example)*:**

> On [date] we identified [a security incident affecting some of our
> systems]. We acted to contain it and are investigating with
> [independent specialists]. We will contact anyone affected directly.
> Our next update will be at [time or date].

**HS-03, allegation about a person *(Example)*:**

> We are aware of the report concerning [role]. We take it seriously
> and are looking into it [with independent support]. We will not
> comment further while that process is under way.

Do not: speculate about causes, blame suppliers or individuals, give
numbers that are not confirmed, or say "no comment". When facts are
confirmed and a fuller announcement is needed, draft it with
`marketing/press-release`; for planned service work use
`ops/maintenance-notice` instead of this plan.

## 7. Stakeholders, order and channels

<!-- Guidance: Agree who hears first. People affected and staff should not learn about a crisis from the news. -->

| Order | Stakeholder | Channel | Owner |
|---|---|---|---|
| 1 | Directly affected customers | Email, in-app notice, status page | [@cx-lead] |
| 2 | Staff | Internal chat and all-staff email | [@internal-comms] |
| 3 | Regulators, where required | Per legal (section 8) | [@general-counsel] |
| 4 | Board and investors | Call and written briefing | [@ceo] |
| 5 | Media and public | Statement on website, social posts, press office | [@head-of-comms] |
| 6 | Partners and suppliers | Account managers | [@partnerships] |

```mermaid
flowchart TD
  A[Signal detected] --> B{Communications crisis?}
  B -->|No| C[Normal handling and log]
  B -->|Yes| D[Declare level]
  D --> E[Assemble team]
  E --> F[Confirm facts with incident liaison]
  F --> G[Issue holding statement]
  G --> H[Notify stakeholders in agreed order]
  H --> I[Monitor and update at promised times]
  I --> F
  I --> J[Close and review]
```

## 8. Regulatory and legal clocks

<!-- Guidance: Communications must not get ahead of, or contradict, mandatory notifications. Legal owns this list; communications needs to know the clocks. These are examples, not a complete list. -->

| Ref | Jurisdiction | Rule *(as of October 2026)* | Clock | Official source |
|---|---|---|---|---|
| REG-01 | EU, and UK under UK GDPR | GDPR Article 33: notify the supervisory authority of a personal data breach unless unlikely to result in risk; Article 34 covers telling individuals when risk is high | Without undue delay and, where feasible, within 72 hours of becoming aware | https://eur-lex.europa.eu/eli/reg/2016/679/oj |
| REG-02 | US, SEC registrants | Form 8-K Item 1.05, material cybersecurity incidents (SEC rules adopted 2023-07-26) | Generally four business days after determining the incident is material | https://www.sec.gov/newsroom/press-releases/2023-139 |
| [REG-03] | [jurisdiction] | [rule] | [clock] | [URL] |

Questions for legal at the start of every Level 1 or 2 crisis: Which
notifications apply, and when does each clock start? Must regulators or
exchanges hear before the public statement? Is any information subject
to legal privilege or an embargo?

## 9. Monitoring and message log

<!-- Guidance: Track what is said about you and everything you say. The log is evidence later. -->

| Time | Channel | What was said or published | By | Approved by |
|---|---|---|---|---|
| *Example:* 09:40 | Status page | HS-01 published | [@cx-lead] | [@head-of-comms], [@legal] |
| [time] | [channel] | [content] | [@name] | [@approver] |

Monitor: [*Example:* social mentions, news alerts, support ticket
themes, employee review sites], with a summary to the team every
[*Example:* two hours] during Level 1.

## 10. After the crisis

<!-- Guidance: Review within two weeks and update this plan. Thank the people who handled it. -->

| Question | Answer |
|---|---|
| Did the first statement go out within the target for the level? | [answer] |
| Were affected people and staff told before the media reported it? | [answer] |
| Were any statements corrected later? Why? | [answer] |
| What changes to scenarios, statements or contacts follow? | [answer] |

## Standard and licence note

Based on common corporate crisis communications practice, with
regulatory clocks cited from public law and regulator releases as dated
examples (EU GDPR Articles 33 and 34; US SEC Form 8-K Item 1.05). The
structure, text and fictional example are original. Check the current
official text and the rules of every jurisdiction where you operate;
this is not legal advice. Template licence: MIT.