A crisis statement template is a fill-in draft that states what happened, who is affected, what the company is doing, who is speaking, and when the next update arrives. This page provides five templates: a holding statement, an apology, a data breach notice, a product recall notice, and an executive conduct statement. Fill these templates with verified facts, then have legal counsel review the draft before release.
For public companies, one template runs on a legal clock. The U.S. Securities and Exchange Commission (SEC) requires public companies to file a Form 8-K generally within four business days after determining that a cybersecurity incident is material. This requirement became effective with the SEC's July 26, 2023, rule announcement. A statement drafted before an incident leaves those four days for fact verification instead of wording formulation.
What elements are in every crisis statement?
Every crisis statement carries five essential elements: what happened, who is affected, the company's action, the designated speaker, and the next update's timing.
| Element | Job | Fill-in wording |
|---|---|---|
| What happened | States the event in one plain sentence | On ____ (date), ____ (company) learned that ____ (event). |
| Who is affected | Names the group and the count | This affects ____ (group), about ____ (number) people. |
| Company action | States one action the company controls | We have ____ (action) and will ____ (next action) by ____ (date). |
| Speaker | Names the person with authority to act | ____ (name), ____ (title), is leading the response. |
| Next update | Gives a date, a time, and a channel | We will update ____ (web address) at ____ (time) on ____ (date). |
What should a holding statement say in the first hour?
A holding statement confirms the event, identifies the affected group, and sets the next update time. This statement promises only what the company has verified.
We are aware of ____ (event) affecting ____ (group). We learned of it at ____ (time) on ____ (date). Our team is ____ (action underway). We will share an update by ____ (time) on ____ (date) at ____ (web address). If you are affected, contact ____ (channel).
When drafting a holding statement, omit any information about cause, blame, or numbers the company has not yet confirmed.
Why it works: The timing of an incident becomes a critical question within days of its occurrence. For example, when Wells Fargo CEO John Stumpf testified on September 29, 2016, members of Congress questioned when he informed the board and whether the bank told investors on time, as reported by the Associated Press. A holding statement that clearly states when the company learned of the event can preempt such inquiries.
What does an apology statement need to say?
An apology statement names the harm caused, accepts unconditional ownership, states the specific fix with a target date, and identifies the person delivering the apology.
We got ____ (what the company did or failed to do) wrong. It harmed ____ (group) by ____ (specific harm). We take responsibility. We are ____ (fix), and by ____ (date) we will ____ (result). ____ (name, title) will report progress on ____ (date) at ____ (channel).
Remove any sentence containing "if" or "but" from an apology statement. Further guidance on apologetic responses and PR crises is available in the dedicated guide.
Why it works: In February 2018, Sony Pictures and the "Peter Rabbit" filmmakers issued a joint apology two days after an advocacy group highlighted an allergy scene. The statement directly addressed the objection, saying the film "should not have made light" of the allergy, as reported by the Associated Press on February 12, 2018.
What should a data breach statement include?
A data breach statement describes the data involved, the relevant dates, the number of individuals affected, the protective steps taken, and the contact channel for support. This statement must also align with any required regulatory filings.
On ____ (date), we found that an unauthorized party accessed ____ (systems). The data involved includes ____ (data types) for about ____ (number) ____ (customers or employees). We ____ (containment action) on ____ (date). We are offering ____ (protection) at ____ (web address). Questions: ____ (channel).
Have legal counsel confirm whether a regulatory filing is required and ensure that all numbers in the public statement match those in the filing. The cyber attack crisis PR playbook provides details on managing the first 72 hours.
Why it works: The SEC rule, announced on July 26, 2023, requires a Form 8-K to describe the nature, scope, timing, and material impact of a significant cybersecurity incident. A public statement structured using these same four fields ensures consistency and prevents contradictions with the official filing.
What must a product recall statement contain?
A product recall statement must explicitly use the word "recall," identify the specific product, state the hazard, and explain the remedy. The rule for products regulated by the Consumer Product Safety Commission (CPSC) includes additional requirements.
RECALL: ____ (company) is recalling ____ (product name, models, sizes, date codes), about ____ (number) units sold from ____ (month, year) to ____ (month, year). The hazard: ____ (defect and type of risk). The remedy: ____ (refund, repair or replacement) and how to get it: ____ (steps). Contact: ____ (phone, email, web address).
Include the incident and injury counts that the company has confirmed. The product recalls guide further explains how recall coverage persists in search and AI answers.
Why it works: Federal regulation 16 CFR 1115.27 mandates that a recall notice include the word "recall" in the heading and text, a release date, a product description, the approximate number of units, the hazard, the recalling firm, and the remedy. A template designed with these blanks ensures compliance with these critical requirements.
How should a statement announce executive consequences?
A statement concerning executive conduct should clearly state the board's finding, the consequence imposed, and its effective date. These details allow the audience to verify the board's actions.
The board of ____ (company) has ____ (finding or decision). ____ (name, title) will ____ (consequence) effective ____ (date). The board will ____ (review step) and report by ____ (date) at ____ (channel).
Why it works: On September 29, 2016, Wells Fargo's board stripped CEO John Stumpf of $41 million in stock awards and former retail banking head Carrie Tolstedt of $19 million, making her departure immediate, as reported by the Associated Press. Lawmakers could then cite these specific figures in subsequent hearings, which vague language would not have allowed.
How do you prepare these templates before an incident?
To prepare effectively, store the five templates with the crisis communication plan. Designate one speaker for each template and have legal counsel pre-approve the fixed language.
Conduct an annual drill. During this drill, fill one template within 20 minutes using a hypothetical incident labeled as a drill. Record which blanks the team could not fill, identifying areas for further preparation.
Pair these templates with the overall crisis communication plan and the guide for crafting a crisis statement. Examples showing these templates in use are available in the 12 PR crisis examples.
Last updated: October 6, 2026.