A crisis communication plan names who decides, who speaks, what is said first and how fast, before any incident happens. The ten parts below cover the crisis definition matrix, the response team, the first-hour protocol, the stakeholder map, scenario drafts, message discipline, monitoring, review and drills, and a copyable template follows them. Each part is tested against dated cases such as Tylenol in 1982 and United in 2017.

A crisis plan is not a document. It is infrastructure: built before you need it, tested regularly and refined after every real event. For the wider field, read the crisis communications guide.

Part 1: What is the crisis definition matrix?

The crisis definition matrix is a three-tier list that settles which events trigger the plan. Not everything that goes wrong is a crisis, and not everything the operations team calls routine is routine.

  • Tier 1, existential. Death, injury, major financial loss, regulatory violation, executive misconduct, or a cyber breach with material data exposure. Full plan activation.
  • Tier 2, serious. Product recall, discrimination allegation, negative viral moment, activist campaign or litigation. Partial activation.
  • Tier 3, manageable. Customer complaint escalation, a minor negative story or an executive gaffe. Monitor and prepare, and do not overreact.

The point is not the categories. It is forcing the leadership team to have the conversation before the crisis. Add a decision table of if-then questions that settle who speaks, when and what they say for each tier. See how to tell a PR crisis from a mishap for the dividing line.

Part 2: Who belongs on the crisis response team?

The response team is named people, with phone numbers and roles, not titles and not "the marketing team."

  • Crisis lead. Usually the head of communications. Owns the response end to end and can make communications decisions in real time.
  • Executive spokesperson. The face of the response, media-trained and ready for camera.
  • Legal counsel. Reviews every outbound statement and advises on regulatory and litigation risk.
  • Operations lead. Owns the operational response: the recall, the investigation, the fix.
  • HR lead. For any people-related crisis.
  • Digital and social lead. Runs owned channels and monitors the social response.
  • External PR partner. A named firm and lead contact, with the contract already signed.

Every name has a backup, and every phone number is tested in tabletop exercises. A working channel helps: see the crisis communication Slack channel guide.

Part 3: What belongs in the first-hour protocol?

The first-hour protocol is a written sequence with times attached, specific enough to run like a fire drill.

  • Minutes 0 to 15: the crisis lead confirms the event, activates the team and opens the incident log.
  • Minutes 15 to 30: the team convenes and establishes facts, with a 60-second briefing from legal, operations and HR.
  • Minutes 30 to 45: the holding statement is drafted and approved by the executive, legal and the crisis lead.
  • Minutes 45 to 60: the statement goes to media, employees, key customers and regulators as required.

A holding statement is disciplined acknowledgment, not evasion. It confirms the event, says the company takes it seriously, notes that an investigation is underway and promises updates. The crisis statement template gives fill-in wording for five situations, and how to write a crisis statement in seven steps explains the method.

Part 4: Who is on the stakeholder map?

The stakeholder map lists every audience a crisis touches, because missing one expands the crisis.

  • Employees. Usually the first audience. If they hear about it from the news, trust is already damaged.
  • Customers. Especially those directly affected, with personal communication and not corporate blasts.
  • Media. Traditional and trade. Their timeline is faster than yours.
  • Regulators. Where required by law, and often as a matter of goodwill.
  • Investors and the board. Disclosure obligations are strict for public companies.
  • Partners and suppliers. Their exposure to the crisis can become your second crisis.
  • The public on social channels. Owned, paid and third-party voices.

Part 5: What is a dark-site library?

A dark-site library holds pre-drafted materials for each major scenario: a holding statement, a follow-up statement, an executive video script, an employee FAQ and a customer email, all reviewed by legal and refreshed quarterly. At a minimum, draft for these scenarios:

  • Product safety incident or recall, see product recall communications
  • Cyber breach or ransomware, see the 72-hour breach playbook
  • Executive misconduct or departure under investigation
  • Discrimination or harassment allegation
  • Financial restatement or fraud allegation
  • Major outage or service failure
  • Death or serious injury involving a customer or employee
  • Regulatory action or investigation
  • Activist campaign or boycott
  • Environmental incident
  • Political or geopolitical exposure
  • A viral negative moment

Part 6: What is message discipline?

Message discipline means one story, one voice and one set of facts. Every spokesperson, from the executive to front-line staff, works from the same core message, because fragmented messaging is a common cause of a crisis spreading. The message has four parts:

  • The core acknowledgment: what happened, in one sentence.
  • The empathy statement: for the people affected, in human language.
  • The action: what the company is doing now.
  • The commitment: what it will do next.

When the company is at fault, the corporate apology guide shows how to test the wording before it goes out.

Part 7: Which real cases should every team study?

Four cases show the plan's parts under pressure. The first two have verified details, and the last two are summarized from general reporting.

The Tylenol recall (1982): the reference case

Seven people in the Chicago area died after taking cyanide-laced capsules, according to a University of Central Florida study. Johnson & Johnson recalled about 31 million bottles nationwide at an estimated cost of $100 million, even though the contamination was limited to Chicago, according to Everything-PR's account. It acted before any mandate and introduced tamper-resistant packaging.

The United Airlines passenger removal (2017)

United's first statement described "re-accommodating" a passenger who had been removed from a flight, and the language drew heavy criticism. The lesson is to match the register of the moment. The United Airlines 2017 case study has the full timeline.

The BP Deepwater Horizon response (2010)

BP's CEO Tony Hayward's remark that he wanted his life back became a symbol of a tone-deaf response, as widely reported at the time. The lesson is that corporate language during a human tragedy becomes the story.

The Peloton Tread+ response (2021)

Peloton first disputed the Consumer Product Safety Commission's warning, then agreed to a recall weeks later, as widely reported. The lesson is that fighting a regulator in public tends to extend the story.

Part 8: What should monitoring cover?

Monitoring is where response starts, because you cannot respond to what you cannot see. Cover four areas:

  • News media: a media monitoring service such as Meltwater, Cision or LexisNexis.
  • Social media: a listening tool such as Sprinklr, Brandwatch or Talkwalker, including the platforms where your customers complain.
  • Trade publications: coverage specific to your sector.
  • Search results: the first page for your brand name and your CEO's name, checked daily during a crisis. This site's analysis adds a quarterly check of what AI tools say, using Citation Share.

Part 9: How should a post-crisis review work?

A post-crisis review should happen within 30 days of the crisis ending and aim to record what worked, not to assign blame. Reconstruct the timeline, rate how each message landed, analyze coverage and sentiment across earned, owned and social channels, and write specific changes into the plan. The guide to knowing when a crisis is over helps decide when to start.

Part 10: How often should you drill the plan?

You should drill the plan every quarter with a tabletop exercise, because a plan that is not tested gives only the illusion of preparation. Use a fresh, realistic scenario with unannounced timing, require real-time responses with no rewinds, include legal and the executive, and write down the debrief and the plan changes.

What does the copyable plan template look like?

The template compresses the ten parts into one document. Fill each bracket and the plan exists.

CRISIS COMMUNICATION PLAN

1. RISK SCENARIOS [List scenarios ranked by likelihood and severity]

2. RESPONSE TEAM Lead decision-maker: [name, phone, email] Communications lead: [name, phone, email] Legal counsel: [name, phone, email] Operations lead: [name, phone, email] Spokesperson: [name, phone, email] Backup spokesperson: [name, phone, email]

3. NOTIFICATION CHAIN First notified: [role, contact method, time limit] Second notified: [role, contact method, time limit] Third notified: [role, contact method, time limit]

4. HOLDING STATEMENTS Scenario 1: [pre-drafted statement] Scenario 2: [pre-drafted statement] Scenario 3: [pre-drafted statement]

5. APPROVAL PATH Reviewer(s): [names] Maximum review time: [target, such as 60 minutes]

6. CHANNELS AND OWNERS Press: [owner] Social: [owner] Employees: [owner] Customers: [owner] Investors (if applicable): [owner]

7. POST-CRISIS REVIEW Review date: [within 30 days of the crisis ending] Attendees: [team from section 2] Questions: What worked. What was too slow. What statement needed revision. What scenario should be added.

What mistakes weaken a crisis plan?

Writing the plan and never rehearsing it

A plan nobody has read out loud fails at the moment it matters.

Naming a spokesperson without a backup

Crises do not wait for the primary spokesperson's flight to land.

Drafting statements that say little

A statement that only pledges cooperation leaves the harder questions open. Alarum's July 2026 statement pledged cooperation after the FBI seized domains tied to its NetNut subsidiary, and its shares fell from $8.02 on July 1 to $3.08 on July 6, according to securities-law firm notices carried by PR Newswire. The shares fell for reasons beyond the statement, so treat this as a caution and not a proven cause. See 12 PR crisis examples for the case.

Treating one crisis as unrelated to the next

A second crisis is read against the first. Penn State faced the 2012 Sandusky findings and the 2017 Piazza hazing death, and the later case was covered with the earlier one in view, as the Penn State case study explains.

Stopping at the press release

Coverage fades before search results do. This site's analysis is that a modern plan should track search results and AI answers alongside press coverage.

Where can you get help building a crisis communication plan?

Everything-PR's guide to crisis PR and crisis communications covers the discipline from the research side. For worked examples of how responses played out, see the crisis communications case study library. Companies that want an outside partner signed before an incident can review the 5WPR crisis PR practice, and the guide to how to choose a crisis PR firm gives eight questions to ask.

Frequently asked questions

How long should a crisis communication plan be?

Long enough to be complete and short enough to use in real time. Many plans run 25 to 40 pages with scenario drafts and contact lists, but the core response document should fit on a few pages. This is this site's rule of thumb, not a standard.

How often should a crisis plan be updated?

Review it quarterly at minimum, refresh it fully each year, and update it right after any real crisis, executive change or major business change.

Should we hire an outside crisis PR firm before we need one?

Yes. The worst time to find a partner is during a crisis. Signing one in advance lets protocols be aligned and the firm join your planning.

What is the biggest mistake companies make in a crisis?

Waiting to be sure of every fact before saying anything. A disciplined holding statement in the first hour is usually better than a perfect statement hours later, because the public will define the story in the silence.

Who should own the plan?

Communications leadership owns the document, with sign-off and named participation from legal, operations and the executive team. A plan owned by one department alone is one the rest of the company may not follow under pressure.

Originally published October 2020. Updated October 2026. Drafted with AI assistance and checked against a University of Central Florida study, Everything-PR and securities-law firm notices. The BP and Peloton summaries come from general reporting and were not re-checked against primary sources, and the plan structure and timings are this site's working framework. The earlier version's claims about an eighteen-word Alarum statement, a Wells Fargo compounding effect and Target's AI-answer persistence were removed because they could not be confirmed.