Crisis Communications Plan: How to Prepare and Respond When Problems Happen
A crisis rarely gives you much time to decide what to say. A cyberattack, workplace accident, product problem, service outage, natural disaster, or public controversy can quickly leave employees, customers, and the media looking for answers.
A crisis communications plan gives your organization a clear way to respond. It defines who communicates, how information is verified, which channels are used, and how stakeholders are kept informed. Good planning helps you communicate quickly without sacrificing accuracy or trust.
What Is a Crisis Communications Plan?
A crisis communications plan is a documented process for managing communication during a serious event that could affect an organization, its employees, customers, operations, or reputation.
It explains how information will be gathered, confirmed, approved, and shared. It also identifies who has responsibility for communicating with different audiences. The CDC’s Crisis and Emergency Risk Communication guidance provides additional principles for communicating clearly when people are facing uncertainty and risk.
Crises can include:
- Workplace accidents or safety incidents
- Cyberattacks and data breaches
- Product recalls
- Major service outages
- Natural disasters
- Legal or regulatory problems
- Executive controversies
- Negative media attention
- Social media crises
- Security threats
- Supply-chain disruptions
Normal public relations often focuses on building relationships and reputation over time. Crisis communication is more immediate. Decisions may need to be made quickly while facts are still developing.
That is why the communication process should be established before an emergency happens.
Why a Crisis Communications Plan Matters
During a crisis, people want reliable information. If your organization stays silent or different departments give different answers, rumors and confusion can quickly take over.
A clear plan helps your team respond faster because key responsibilities have already been assigned. Staff know who can approve statements, who talks to the media, and where information should be published.
It also helps protect employees, customers, and other stakeholders. Some situations require people to act immediately, such as changing a password after a data breach, avoiding a recalled product, or following evacuation instructions. OSHA provides broader workplace emergency preparedness guidance covering how employers can organize their response to emergencies.
Good communication also supports trust. You may not have every answer immediately, but acknowledging the problem, sharing confirmed facts, and explaining what happens next shows that the situation is being taken seriously.
Key Components of a Crisis Communications Plan
A useful plan does not try to predict every possible problem. Instead, it gives your team a structure that can work across different types of crises.
Crisis Communication Team
Identify the people who will manage communication during an emergency.
Depending on your organization, the team could include:
- Communications or public relations staff
- Senior management
- Legal advisers
- Human resources
- Operations staff
- IT or cybersecurity personnel
- Customer service representatives
- A designated spokesperson
Responsibilities should be specific. One person might gather and verify information while another prepares public statements. Legal staff may review sensitive claims, and senior leadership may approve major announcements.
Include backup contacts as well. A crisis does not guarantee that every key person will be available.
Crisis Levels and Response Procedures
Not every problem requires the entire crisis team.
Creating response levels helps you match the response to the seriousness of the situation.
For example:
Level 1 — Minor incident: A limited issue that can usually be handled by the department involved with little or no public communication.
Level 2 — Significant incident: A problem affecting customers, employees, or operations that requires communications staff and senior managers to become involved.
Level 3 — Major crisis: A serious event involving major safety, legal, operational, or reputational risks. Senior leadership, communications, legal teams, and other specialists may need to respond immediately.
When deciding the level, consider:
- Safety risks
- Number of people affected
- Operational disruption
- Legal consequences
- Media attention
- Financial impact
- Reputational damage
Clear levels make it easier for employees to recognize when the crisis plan should be activated.
Stakeholders and Contact Information
Your organization should know who may need information during a crisis.
Important audiences can include:
- Employees
- Customers
- Suppliers
- Business partners
- Government agencies
- Emergency services
- Investors
- Contractors
- Community organizations
- Journalists
Keep contact information current and accessible to authorized team members.
Do not treat employees as an afterthought. When possible, staff should receive accurate information directly from the organization rather than learning important details from social media or news reports.
Communication Channels
Decide in advance where crisis information will be shared.
Common channels include:
- Company website
- Text alerts
- Social media
- Press releases
- Internal messaging platforms
- Customer support channels
- Phone notifications
- Media briefings
Choose channels based on the audience and urgency of the message. FEMA’s guidance on communicating in an emergency also covers alerts, warnings, evacuation information, response updates, and the different communication tools available during emergencies.
For a major public crisis, your website can act as a central source for confirmed updates. Social media, email, and other channels can then direct people back to that information.
You should also consider what happens if your normal communication systems stop working. A cyberattack or power outage, for example, may make certain tools unavailable.
Key Messages and Holding Statements
You do not need every answer before acknowledging a crisis.
A holding statement is a short initial message used while the organization gathers more information.
It can include:
- What has been confirmed
- Who may be affected
- Immediate actions being taken
- Safety instructions
- Where additional updates will appear
- When the next update is expected
Avoid guessing about causes, responsibility, injuries, financial losses, or timelines.
Saying that information is still being verified is better than publishing details that later prove incorrect.
Templates can save time, but every message should be adapted to the actual situation. If people have been hurt, inconvenienced, or put at risk, generic corporate language can sound careless.
Spokesperson Guidelines
Only authorized spokespersons should provide official public comments during a crisis.
A spokesperson should be prepared to:
- Explain confirmed facts clearly
- Avoid speculation
- Answer difficult questions calmly
- Acknowledge information that is still unknown
- Correct significant misinformation
- Avoid defensive language
- Stay consistent with official updates
Other employees should know where to direct media questions instead of trying to answer them independently.
Approval Process
Speed matters during a crisis, but so does accuracy.
Decide beforehand who can approve:
- Internal announcements
- Customer notices
- Social media updates
- Media statements
- Press releases
Avoid an approval process with so many layers that even a basic update takes hours.
The goal is to have enough review to prevent mistakes without creating unnecessary delays.
How to Create a Crisis Communications Plan
Once you know what the plan needs to contain, you can build a practical process around the risks your organization actually faces.
Identify Likely Crisis Scenarios
Start with realistic threats rather than trying to imagine every possible disaster.
A technology company may prepare for data breaches and service outages. A manufacturer may focus on workplace accidents, equipment failures, supply problems, and product recalls. A school may prepare for severe weather, security incidents, and health emergencies.
For cybersecurity incidents in particular, CISA’s ransomware and incident-response guidance recommends maintaining an incident response process that includes communication and notification procedures.
Group similar risks together when the communication response would be largely the same.
For each major scenario, consider:
- Who could be affected?
- Who needs to know first?
- What information would they need?
- Which communication channels would work best?
- Which departments would need to respond?
This makes the plan more useful than a long list of hypothetical emergencies.
Assign Clear Responsibilities
Document who is responsible for each part of the response.
At minimum, identify:
- Crisis communication lead
- Primary spokesperson
- Backup spokesperson
- Person responsible for verifying facts
- Internal communication lead
- External communication lead
- Approval authority
- Social media or website manager
Avoid vague instructions such as “management will handle communication.”
During a fast-moving event, employees should be able to look at the plan and immediately understand who needs to do what.
Prepare Communication Templates
Templates give your team a useful starting point when time is limited.
You might prepare templates for:
- Initial holding statements
- Employee notifications
- Customer alerts
- Website notices
- Social media updates
- Media statements
Do not write scripts for situations that have not happened. Instead, create flexible formats with spaces for details such as the incident, affected locations, known impact, actions being taken, and next update.
Keep Contact Information Accessible
Maintain contact information for the people and organizations you may need during an emergency.
That can include company leaders, crisis team members, emergency responders, legal advisers, insurers, vendors, regulators, facility managers, and media contacts.
Do not rely on a single online system to store everything. If that system becomes unavailable during the crisis, the contact list will not be useful when you need it most.
Monitor Reactions and Misinformation
You also need to watch how the situation is being discussed.
Monitor:
- News coverage
- Social media
- Customer questions
- Employee concerns
- Rumors
- Incorrect information
Monitoring helps you see where confusion is developing.
You do not need to respond to every criticism or online comment. Focus on misinformation that could affect safety, create unnecessary panic, or seriously distort what happened.
Plan Ongoing Updates
Do not disappear after releasing the first statement.
Tell stakeholders when they can expect another update and continue communicating as the situation develops.
If there is no major new information, you can still say that the investigation or response is continuing.
For example:
“We are continuing to investigate the incident and will provide our next update at 3 p.m.”
A specific update time reduces repeated questions and shows that communication has not stopped.
What to Communicate During a Crisis
Most effective crisis messages answer a small number of practical questions.
Include the following whenever the information is available:
- What happened? Describe the incident using confirmed facts.
- Who is affected? Identify affected people, locations, products, or services when possible.
- What is known? Clearly state the information that has been verified.
- What is still unknown? Be open about details that are still being investigated.
- What is being done? Explain how your organization is responding.
- What should people do? Give clear instructions if employees, customers, or the public need to take action.
- Where can people get updates? Direct them to one reliable source of official information.
- When is the next update? Give a time when possible.
Keep urgent instructions easy to find. Safety information should never be buried beneath several paragraphs of background explanation.
Common Crisis Communication Mistakes
Even a manageable incident can become harder to control when communication is handled poorly.
Responding Too Slowly
Waiting for every detail before saying anything can create an information vacuum.
When official information is missing, people often turn to rumors, social media posts, or incomplete news reports.
A short acknowledgement is often better than silence.
Speculating About Unknown Facts
Early information changes frequently.
Do not guess about what caused the incident, who is responsible, how much damage occurred, or when everything will return to normal.
Communicate what has been confirmed and label uncertain information appropriately.
Giving Conflicting Messages
Different departments should not provide different versions of the same event.
Key facts and public messages should come through the crisis communication process so employees, customers, and the media receive consistent information.
Ignoring Employees
Employees are one of your most important audiences.
They may need safety instructions, work updates, guidance for handling customer questions, or information about what they can discuss publicly.
Keeping employees informed also reduces internal rumors.
Arguing With People Online
A crisis can generate anger and criticism.
Trying to win arguments in comment sections usually adds another problem instead of solving the original one.
Correct important misinformation, answer legitimate questions when appropriate, and direct people toward official updates.
Hiding Important Information
Trying to conceal relevant facts can cause more reputational damage if those facts later become public.
Transparency does not mean publishing confidential, private, or legally protected information. It means being truthful about what you can share and avoiding misleading statements.
Sounding Cold or Defensive
People may be frightened, angry, inconvenienced, injured, or worried about their personal information.
Your communication should recognize that impact.
Clear facts are essential, but the message should still sound like it was written for real people rather than copied from a corporate template.
Final Takeaway
A good crisis communications plan answers four basic questions before an emergency begins: Who communicates? What needs to be verified? How will messages be approved? Where will updates appear?
When those decisions have already been made, your organization can focus on the crisis itself instead of inventing a communication process under pressure. Share confirmed facts, give people useful instructions, acknowledge what you still do not know, and keep communicating as the situation develops.
