Crisis Communication Plan: Template and Step-by-Step Example

Crisis communication plan vs crisis management plan

The two documents work together but answer different questions. A crisis management plan covers operations: how you stop the outage, recall the product or contain the breach. A crisis communication plan covers people: how you keep employees, customers, the press and regulators informed while that work happens.

Not every problem is a crisis. An issue is a negative event you can handle in the normal course of business. It becomes a crisis when it threatens safety, trust, revenue or legal standing and needs fast decisions from leadership. Three severity levels stop the team from overreacting or underreacting.

Write one or two concrete examples next to each level in your own plan. Without examples, people argue about the level while the clock runs.

• Level 1, issue: limited impact, handled by the usual team, logged and watched. Example: a few angry posts about a late delivery.
• Level 2, serious incident: visible to many customers or the media, possible financial or legal impact. The crisis team meets within the hour. Example: a four-hour service outage.
• Level 3, crisis: risk to safety, personal data, regulatory standing or company reputation. Full activation, CEO informed immediately. Example: confirmed customer data breach.

Who sits on the crisis team

Keep the team small enough to meet in minutes. Every role needs an owner and a named backup, because crises rarely happen when everyone is at their desk.

Put the list on one page with mobile numbers and a backup channel in case company email or chat is down.

• Crisis lead: declares the severity level, chairs the calls and decides when the team disagrees.
• Spokesperson: the only voice to the media. Usually the CEO for Level 3, the head of communications for Level 2.
• Communications lead: drafts every message, runs the crisis log and keeps channels in sync.
• Legal counsel: reviews statements, tracks notification duties and advises on liability.
• HR lead: handles employee messages and any staff involved in the event.
• IT or security lead: supplies technical facts and confirms what is known and unknown.
• Operations lead: reports on the fix and the recovery time.
• Customer support lead: briefs agents with a script and reports what customers are asking.

Crisis communication plan template: what to include

A complete template has the same core sections in any industry. Use these headings and fill them in for your company.

The activation checklist matters most, because it is what people actually read under stress. Keep it to ten lines: confirm the facts, declare the level, call the crisis lead, open the crisis log, open the team call, pause scheduled marketing posts, brief support, publish the holding statement, notify employees, set the time of the next update.

• Purpose and scope: what the plan covers and when it applies.
• Severity levels: examples for each level and who can declare it.
• Crisis team roster: owners, backups and contact details.
• Escalation tree and approval flow: with time limits for each sign-off.
• Audience map: each audience, its channel, its owner.
• Scenario list: a short playbook for each scenario.
• Message kit: holding statements, internal note, social replies, press release outline, audience FAQ.
• Fact sheet template: what happened, when, who is affected, what you are doing, when the next update comes.
• Monitoring setup: alerts and the person on watch outside office hours.
• Activation checklist and crisis log template.
• Debrief template and review calendar.

Crisis communication plan example: a data breach timeline

Here is how the plan runs for a Level 3 scenario. Your security team confirms that an attacker accessed customer email addresses.

The same pattern works for an outage or a recall. Acknowledge the event fast, give a time for the next update, keep that promise, and say what you do not know yet.

• First 60 minutes: The security lead alerts the crisis lead, who declares Level 3. The team call opens, the crisis log starts and all scheduled social posts are paused. Legal checks notification duties. The communications lead adapts the holding statement. Keep the line about secured systems only if the security team has confirmed it. If they have not, cut it, because a claim made too early can turn out to be false. The statement reads: "We are investigating a security incident that may affect some customer accounts. We have secured our systems and are working with specialists. We will share an update by 6 pm today." Employees get a short internal note asking them not to comment publicly and to send media requests to the spokesperson.
• First 24 hours: Support agents receive a script and the audience FAQ. Affected customers get a direct email explaining what data was involved and what they should do. The spokesperson answers media with the approved fact sheet. Social replies point to one update page, so the team does not argue in the comments. The team publishes updates at the times it promised, even when there is little new to say.
• First 72 hours: Regulators are notified as legal requires. Leadership calls investors and key partners. The communications lead tracks the questions that keep coming back and adds answers to the update page.
• First week: Leadership explains the root cause and the changes made to prevent a repeat. The team moves from crisis mode to normal updates, then schedules the debrief.

Testing and keeping the plan current

A plan nobody has rehearsed fails on the first call. Run a tabletop exercise twice a year. Give the team a scenario, add new facts every 15 minutes and time each decision. Train spokespeople with mock interviews on hard questions, including "Why did you not tell customers sooner?"

Review the full plan at least once a year, and every quarter if you work in a high-risk sector such as finance, health or critical infrastructure. Check the contact directory every quarter, since people change roles and phone numbers more often than plans change. After each real crisis, score the response on four points: speed, accuracy, transparency and empathy. Note the time from detection to the first public statement, and compare it from one exercise to the next.