Crisis Communication Plan: A Template and Steps

A crisis communication plan is a written document that assigns roles, pre-drafts holding statements, and sets escalation thresholds so a team can respond within the first 60 minutes of an incident instead of arguing about who approves what. Build it before you need it, store it where people can reach it during an outage, and rehearse it twice a year.

The teams that recover fastest are not the ones with the best writers. They are the ones who decided in advance who speaks, who approves, and how fast. Our work on crisis PR agency starts from the same premise: the plan is the product, and the incident is just a test of it.

Why a plan beats improvisation

The average news cycle around a negative event now moves in hours. Screenshots spread before a company has confirmed the facts internally. A plan cuts the time between the first alert and the first public acknowledgment, which is the single number that shapes how the story reads.

Three costs of having no plan:

Delay. Teams without a named approver lose 3 to 6 hours deciding who signs off. That gap becomes the story.
Contradiction. Two executives post two versions. Reporters quote both.
Silence read as guilt. A company that says nothing for a full day is assumed to be hiding something.

A plan removes those failure modes by making the decisions once, in calm conditions, and writing them down.

The core roles

Assign these before an incident. Name a primary and a backup for each, because crises do not wait for someone to return from vacation.

Role	Owns	Backup required
Incident lead	Declares the crisis level, runs the response	Yes
Approver	Signs off on every external statement	Yes
Spokesperson	The single named voice to press and public	Yes
Legal reviewer	Flags liability and regulatory exposure	Yes
Monitoring lead	Tracks coverage, social, and inbound questions	Yes
Log keeper	Records every decision with a timestamp	No

Keep the list to six roles or fewer. One person can hold two roles in a small company, but the approver and the spokesperson should be different people so review is not skipped under pressure.

The escalation ladder

Not every complaint is a crisis. Define levels so the team does not burn out treating a single angry tweet like a product recall.

Level 1, monitor. A handful of complaints, no media interest. The monitoring lead watches and logs. No public statement.
Level 2, respond. A pattern of complaints or one reporter asking questions. The incident lead is notified. A holding statement is prepared but not yet published.
Level 3, mobilize. Active media coverage, viral spread, or regulatory contact. The full team convenes within 30 minutes. The spokesperson is briefed. A statement goes out.
Level 4, board level. Threat to life, safety, or company survival. Executives and legal join. External counsel and PR support are engaged.

Write the trigger for each level in plain numbers. For example, Level 3 activates at 50 mentions per hour, or any inbound from a national outlet, or any regulator contact. Numbers remove the argument about whether something counts.

Pre-drafted message templates

The fastest statement is one you wrote last quarter. Keep three holding statements ready, each with blanks to fill:

Acknowledgment. We are aware of [issue] affecting [who]. We are investigating and will share an update by [time].
Correction. Earlier reports stated [claim]. The accurate position is [facts]. Here is what we are doing: [actions].
Resolution. The issue affecting [who] has been resolved as of [time]. [Number] customers were affected. Here is how we are preventing a repeat: [steps].

A holding statement buys time without admitting fault or speculating. It confirms you know, you care, and you will report back. Fill the time blank with a real hour, because a promised update that never arrives does more damage than saying nothing.

Mapping your likely scenarios in advance

Generic templates get you started, but the plans that hold up name the specific crises a business is likely to face and draft toward each. Spend an afternoon listing your top five exposures and the first move for each. Common categories:

Operational failure: an outage, a service failure, a supply breakdown that customers feel directly.
Product or safety issue: a defect, a recall, a security vulnerability.
Data breach: exposed customer records, a ransomware event, a leaked database.
People and conduct: an executive departure, a misconduct allegation, a viral staff incident.
External and financial: a lawsuit, a regulatory action, a partner or supplier scandal that touches your brand.

For each, write down who the affected audiences are, which regulator or notification rule applies, and the single first action that proves you are handling it. A data breach, for example, often carries a legal notification clock that a generic template ignores. Naming the scenario surfaces those obligations before the incident, not during it.

The first 60 minutes

The plan should walk a responder through the opening hour without them having to think:

Confirm the facts. What happened, who is affected, is it still happening. Do not draft anything until these three are answered.
Set the level. The incident lead picks 1 to 4 using the written triggers.
Notify the roles. One message to the named people for that level.
Publish the holding statement. Fill the acknowledgment template, get the approver and legal reviewer to sign, post it.
Open the log. The log keeper timestamps every decision from this point forward.

Sixty minutes is the target for a Level 3 acknowledgment. Every hour past that, the volume of speculation roughly doubles.

Where the plan lives

A plan saved on a network drive that goes down during an outage is useless. Store it in at least two places, one of which works when your own systems do not. Print a one-page version with the roles, the phone numbers, and the templates. Put it in a shared cloud folder and a physical binder. Update the contact list every quarter, because the wrong phone number costs you the same 60 minutes a missing plan would.

Choosing your channels before you need them

A plan decides not only what to say but where to say it. Argue that during an incident and you lose the hour. Decide now which channel carries the first word for each scenario:

Owned channels first. Your website, status page, or a pinned post give you the unfiltered version reporters and customers quote from.
Direct notification where required. Affected customers often need an email or in-app notice, not just a public post, and some breaches make that a legal duty.
Press statement for media-level events. A single statement sent to the reporters covering the story, with a named contact, beats scattered replies.
Internal first, always. Staff who learn of a crisis from the news become the leak. Brief them minutes before, or as, you go public.

Write the channel choice into each scenario so the responder posts to the right place without a meeting. A status page nobody set up is a status page you build during the outage, which is the worst possible time.

Rehearsal

A plan that has never been tested is a hypothesis. Run a tabletop exercise twice a year. Pick a scenario, hand it to the team cold, and time how long it takes to reach a published holding statement. The first run usually takes 3 hours. After two rehearsals, teams reach 45 minutes. That improvement is the entire reason the document exists.

Pair the plan with tested crisis communication strategies so the team knows not only who acts but how to shape the message. Study crisis communication examples to see which choices held up and which collapsed under scrutiny.

You may see this topic described with related searches like business crisis management, crisis communication plan template, crisis management certification, crisis management definition, and crisis management software. Those phrases are useful when they clarify what the reader needs next, but they should still point back to one clear plan.

Related searches such as crisis management team, crisis management tools, crisis plan template, and what is crisis management are useful when they clarify what the reader needs next. They should support the same plan rather than pulling the page in several directions at once.

Adapt the plan to your company size

A two-person company and a 2,000-person one need the same decisions made, at very different scale. In a small company, one person may hold several roles, but the approver and the spokesperson should still be different people so review is not skipped under pressure, and the plan can be a two-page document. In a larger organization, the roles split across departments, legal and regulatory review is heavier, and the escalation ladder needs more defined thresholds because more people can trigger or see an incident. Scale the detail to the company, but never skip the core decisions: who declares the crisis, who approves the words, and who speaks.

Common ways a plan fails in practice

A plan can exist and still fail when the incident comes. The recurring reasons:

Stale contacts. The named approver left the company six months ago and no one updated the number, so the 60-minute clock burns on finding a replacement.
No rehearsal. A plan read once and filed is a hypothesis; the first real test takes hours because no one has run the steps.
A working version nobody can find. If the only copy lives on a system that goes down in the outage, the plan is gone when it is needed.
Too long to use. A 15-page document is reference material, not an operating guide. The version people act from must be one page.

Each failure is a maintenance problem, not a writing problem, which is why a quarterly contact audit matters more than a polished document. The best plan is not the most detailed one; it is the one the team can actually execute at 2 a.m. because it is current, findable, and short enough to follow.

Frequently asked questions

How long should a crisis communication plan be?

The full document runs 8 to 15 pages, covering roles, escalation levels, message templates, and current contact lists. The version people actually use during an incident is a single page. If the working version is longer than one page, nobody reads it under pressure, so keep the detailed reference separate from the one-page action card the team reaches for in the moment.

Who should own the plan?

A single named person, usually the head of communications or a senior operator in smaller companies. Ownership means they update the contacts quarterly, schedule the rehearsals, and are accountable for the plan being current. A plan owned by a committee is owned by no one.

How often should we update it?

Review the contact list every quarter and the full plan once a year. Update immediately after any real incident or rehearsal, while the gaps are fresh. Personnel changes are the most common reason a plan fails, so a phone number audit every three months matters more than a full rewrite.

What is the difference between a holding statement and a full response?

A holding statement is a short acknowledgment published within the first hour that confirms you are aware and investigating. A full response comes later, once facts are confirmed, and includes what happened, who was affected, and what you are doing. The holding statement buys you the time to get the full response right.

Does a small business need a plan this formal?

Yes, in a lighter form. A five-person company can compress the whole thing to two pages: who declares a crisis, who approves the statement, two holding templates, and a current contact list. The roles collapse onto fewer people, but the decisions still get made in advance. The alternative is making them for the first time while a story spreads.

What is the most common gap tabletop exercises reveal?

Contact and approval gaps. Teams discover the approver is unreachable, a phone number is stale, or nobody is sure who can authorize a public statement. These are cheap to fix on a calm afternoon and expensive to discover at 2 a.m. That is exactly why the rehearsal exists: to find the gaps before an incident does.