A crisis communications plan is a documented system for deciding who speaks, what they say, and how fast, when an event threatens your reputation. A working plan names a response team, sets severity tiers with clear triggers, pre-approves holding statements, and defines the channels and approval flow so the first public response ships in under an hour rather than after a day of internal debate.

Last reviewed: September 2026

Most organizations write a plan once, file it, and never rehearse it. This guide gives you a plan you can operate: severity definitions with concrete triggers, a named response team, a fill-in holding statement template, and a minute-by-minute first-24-hours playbook. It sits inside a broader reputation management strategy and connects to how your wider sales and marketing strategy protects trust over time.

What a crisis communications plan is (and what it is not)

A crisis communications plan is the messaging and decision layer that activates during a reputation event. It covers who is notified, who approves language, which channels carry the message, and how you monitor response. It is not the same as a business continuity or incident-response plan, which handles operational recovery; the two run in parallel and share facts.

The difference matters because the failure mode is almost always speed, not eloquence. A plan that shortens the gap between “something happened” and “we said something verified” beats a beautifully written statement that arrives twelve hours late. Treat the plan as a reflex, not a document.

Severity tiers: define the trigger before the event

Severity tiers rank an event by reach and harm so the right people activate at the right speed. Without tiers, teams either overreact to a single angry review or underreact to a genuine threat. Assign a tier the moment an event is verified, and let the tier dictate who is notified and how fast the first response ships.

Write the trigger examples for your own business before a crisis, using real vulnerabilities. A payments company weighs a data breach differently than a restaurant weighs a health inspection, so borrow the structure, not the examples.

The crisis response team and roles

The response team is a small, named group with one decision-maker and no ambiguity about who approves language. A common structure uses a RACI split (Responsible, Accountable, Consulted, Informed) so that during a Tier 3 event nobody waits for permission that was never assigned. Name backups for every role, because crises do not wait for someone to return from leave.

Keep the roster to five or six people. Large committees slow the approval flow, and speed is the asset you are protecting.

The holding statement: template and approval flow

A holding statement is your first public response: a short message, usually 60 to 100 words, that acknowledges the situation, shows concern, states what you are doing, and says when the next update will come. It buys time to gather facts without going silent. It never speculates about cause, blame, or numbers you have not confirmed.

Draft holding statements for your top three or four foreseeable scenarios in advance and pre-clear the structure with legal, so the only live work is filling in verified facts. Use this template:

• Acknowledge: “We are aware of [event] that occurred at approximately [time] on [date].”
• Show concern: “The safety and trust of [customers/employees/community] is our first priority.”
• State action: “Our team is actively [investigating / working with authorities / verifying details].”
• Set the next update: “We will share verified information here by [time]. For questions, contact [name and channel].”

Approval flow for a holding statement should be two steps at most: comms lead drafts, legal and crisis lead approve in a single thread. Fold long sign-off chains into that one thread ahead of time so a Tier 3 statement clears in minutes.

The first-24-hours playbook

The first 24 hours decide whether you lead the narrative or chase it. The pattern that specialist firms and the Public Relations Society of America converge on is: first statement fast, first substantive update within a few hours, then a predictable rhythm. Run these steps in order:

1. Minutes 0 to 15: Verify the event is real and assign a severity tier. Notify the crisis lead. Do not respond publicly on rumor.
2. Minutes 15 to 30: Activate the tier-appropriate team. Pause all scheduled social posts and ad campaigns so automated content does not run into the crisis.
3. Minutes 30 to 60: Publish the holding statement on your owned channel first (website or newsroom), then mirror it where the conversation is happening. Assign the single spokesperson.
4. Hours 1 to 4: Brief employees before they read it externally. Build a verified fact sheet and a short Q&A so every responder says the same thing.
5. Hours 4 to 12: Issue the first substantive update with confirmed facts and concrete actions. Respond to priority media and high-reach mentions through the spokesperson only.
6. Hours 12 to 24: Set the update cadence (for example, every 12 or 24 hours), keep monitoring sentiment, and log every decision and message for the post-crisis review.

The recurring mistake is going dark between updates. Even “no new verified information; next update at [time]” keeps you in control of the rhythm.

Channel strategy and monitoring

Channel strategy decides where each message lands and in what order, so your owned properties anchor the record. Publish on your website or newsroom first, then push to the channels where your audience and the story already live. A prepared dark site (an unpublished holding page you can switch live) lets you post detail without redesigning under pressure.

Monitoring runs the whole time so you see escalation early. Free tools like Google Alerts catch mentions; paid platforms such as Brandwatch or Meltwater track volume and sentiment at scale. Social channels are also where many crises begin, which is why your social media presence needs listening built in, not bolted on. Set an escalation threshold (for example, mention volume tripling in an hour) that automatically bumps the severity tier.

Post-crisis review: close the loop

A post-crisis review converts the event into a stronger plan. Within one to two weeks of stand-down, the team reviews the timeline, message log, and monitoring data against three questions: how fast did we respond, where did the approval flow stall, and did the audience believe us. Document fixes and update the plan the same week, while memory is fresh.

Track a few measurable signals rather than gut feel: time to first statement, sentiment recovery curve, share of voice versus the negative story, and any change in review scores or inbound volume. These numbers tell you whether the plan worked and feed your longer-term reputation and demand work. If you want that plan built and rehearsed with your team, our fractional CMO services cover the setup and the drills.

Common mistakes that turn an event into a crisis

Most reputation damage comes from process failures, not from the original event. The predictable errors are slow first response, no single spokesperson, speculating before facts are verified, forgetting employees as an audience, and letting scheduled marketing run during the event. Each one is preventable with a plan that is written, assigned, and rehearsed.

Rehearsal is the part almost everyone skips. Run one tabletop exercise a year against a realistic Tier 3 scenario, time your response, and fix whatever broke. A plan you have never tested is a hypothesis, not a capability.

Frequently asked questions

What should be in a crisis communications plan?

A crisis communications plan should include severity tiers with clear triggers, a named response team and roles, pre-approved holding statement templates, a two-step approval flow, a channel strategy that leads with owned properties, monitoring tools and escalation thresholds, and a post-crisis review process. The goal is to ship a verified first response in under an hour.

How fast should you issue a crisis statement?

For a severe (Tier 3) event, aim to publish a holding statement within 30 to 60 minutes, then a first substantive update within four to twelve hours. Speed matters more than polish: acknowledging the situation quickly keeps you leading the narrative. Lower-severity events can follow a slower cadence, often within one to four hours.

What is a holding statement?

A holding statement is a short first public response, usually 60 to 100 words, that acknowledges an event, shows concern, states what you are doing, and says when the next update will come. It never speculates about cause, blame, or unconfirmed numbers. Its job is to buy time to gather facts without going silent.

Who should be on a crisis communications team?

A crisis communications team is usually five or six named people: a crisis lead who makes final decisions, a comms lead who drafts messaging, a legal reviewer for sign-off, a single spokesperson who is the public voice, and a monitor tracking mentions and sentiment. Name a backup for every role so activation never stalls.

What is the difference between a crisis communications plan and a business continuity plan?

A crisis communications plan handles messaging: who speaks, what they say, and through which channels. A business continuity plan handles operational recovery: restoring systems, staffing, and service. The two run in parallel during an event and share verified facts, but they are separate documents with separate owners.

How do you measure whether a crisis response worked?

Track time to first statement, the sentiment recovery curve, your share of voice against the negative story, and any change in review scores or inbound volume. Review these within one to two weeks of stand-down against three questions: how fast you responded, where approval stalled, and whether the audience believed you. Update the plan the same week.