The fire starts in a battery-charging bay at 5:50 a.m. By 6:15, a neighbor has posted a video of black smoke over the warehouse roof. By 6:40, a local reporter has called the main switchboard, which forwards to a voicemail box nobody checks before nine. The night-shift workers' families have seen the video too, and they are calling the people they know at the company, who know nothing.
Nothing in that sequence is unusual. The first hour of a crisis is decided by what was written, approved and assigned before it began. A crisis communications plan exists to make that hour boring.
What follows is organized around the questions the plan has to answer at 6:40 a.m., not around the chapters of a typical template.
Who hears it first?
Employees. Then the families of anyone hurt. Then everyone else.
That order is partly ethical and partly practical. Employees are an organization's most credible messengers and its leakiest; anything they learn from social media before they hear it from you will be repeated, with your silence as the headline. Your obligations to them are also the most concrete, a point covered in our briefing on duty of care and business continuity. After 9/11, some Lower Manhattan firms spent days establishing who was safe, and the history of continuity planning is full of organizations that learned late how much depends on reaching staff at home.
A workable sequence, with rough targets:
| Audience | Target time | Channel | Owner |
|---|---|---|---|
| Affected and on-site employees | Immediately | Mass notification, supervisors | Incident lead, HR |
| Families of injured or missing staff | Before any public mention | In person or by phone, never by text | HR plus a senior leader |
| All employees | Within 60 minutes | Mass notification, intranet, email | Internal communications |
| Media and public | Within 60 minutes (holding statement) | Website, dark site, direct to reporters | Communications lead |
| Regulators | Per rule or contract; earlier if in doubt | Named contact, by phone then in writing | Compliance |
| Key customers and partners | Within a few hours | Account owner, by phone | Sales or account management |
| Lenders, investors, insurers | Same day | Direct call | Finance, legal |
The times are targets and vary by industry. What matters is that each row has an owner before the event, holding a contact list that works when the corporate network does not.
What do you say before you know anything?
You issue a holding statement: a short, factual message that acknowledges the situation, says what is being done, and commits to a time for the next update. It buys time for facts without leaving a vacuum for others to fill.
Draft them in advance, clear them with legal, and store them somewhere reachable offline; during an incident, the team fills in the brackets. Below are three generic templates for an invented company, a regional distributor.
Template 1: Incident at a facility
At approximately [time] today, [a fire / an incident] occurred at our [location] distribution center. Emergency services [responded / are on site] and [the situation is contained / are working to contain it]. Our first concern is the safety of our employees and neighbors, and we are working to account for everyone who was on site. We will not speculate on the cause while the situation is being assessed. We will share an update by [time] at [web address].
Template 2: Systems disruption
[Company] is experiencing a disruption to some of its systems that is affecting [orders / deliveries / our customer portal]. We acted to contain the issue as soon as we identified it, and we are working with outside specialists to restore service. In the meantime, our teams are [taking orders by phone / prioritizing deliveries to critical customers]. We will provide our next update by [time]. Customers with urgent needs should contact their account representative.
Template 3: Customer service disruption
Because of [severe weather / a supplier disruption / a transportation problem], some deliveries scheduled for [dates] will be delayed. We know many of you depend on these shipments, and we are [rerouting through our other facilities / prioritizing healthcare and food-service accounts]. Your account representative will contact you by [time] with the status of your orders. We will post updates at [web address] every [interval] until service returns to normal.
Notice what the templates leave out: cause, blame, damage estimates, and any number likely to change. Template 2 also avoids the words "cyberattack" and "ransomware" until counsel has approved them. Each statement ends with a specific time for the next update, which matters more than it looks. A promised update delivered on time, even one that says little, does more for credibility than a detailed statement that arrives late.
Who signs off, and how fast?
Approval chains are where crisis statements go to die. The usual failure: a draft circulates by email to eight people, three suggest edits, two are unreachable, and the statement goes out four hours late with a sentence nobody likes.
Four design choices prevent most of that:
- Pre-clear the templates. If legal has already approved the holding statements, the in-incident review covers only the bracketed facts. That takes minutes.
- Name a small approval group. Three people is enough for most organizations: the communications lead, legal, and the incident lead or a designated executive. Each has two named alternates.
- Put a clock on it. Set a fixed review window, such as 20 minutes for a holding statement. If an approver has not responded, the alternate decides. Some plans go further and treat silence after the window as approval for pre-cleared templates.
- Separate risk review from wordsmithing. Legal reviews for liability and accuracy. Style edits wait for the next update.
Organizations that use the Incident Command System give this job to the public information officer, who sits on the command staff; larger events may stand up a joint information center with partner agencies. Either way, the communications team needs a direct line to whoever runs your emergency operations center, so statements reflect current facts rather than what was true an hour ago.
Who stands in front of the camera?
Not automatically the CEO. A spokesperson needs to stay calm under hostile questions, be credible on the subject, remain available for the duration, and be trained. Pick a primary and at least two alternates, because incidents happen during vacations and the first spokesperson will need sleep by hour sixteen.
Seniority does start to matter as an incident grows. A facility manager can handle the first statement about a contained fire. If people are seriously hurt or the problem is company-wide, the public expects to hear from the top, and a junior spokesperson reads as hiding.
Training should be practical: on-camera mock interviews with a hostile questioner, and rehearsing how to say "I don't know yet, and here is when we will" without sounding evasive. Subject-matter experts such as the plant engineer or the CISO can answer technical questions alongside the spokesperson, but they need the same preparation.
What are people saying without you?
Social media monitoring in a crisis has two jobs: spotting the incident early and checking whether your messages are landing. Set up alerts in advance for the company name, facility addresses, product names and senior executives' names. Assign someone to watch them, with a clear path to escalate.
Correct factual errors once, briefly, and link to your official update. Do not argue with individual posters, and do not delete critical comments on your own channels unless they break posted rules (threats, personal data). Brief employees on what they may share, and remind them that a personal post about a workplace incident will be quoted as if it came from the company.
Where do people go to read it?
A dark site is a prepared, unpublished web page or microsite that can go live within minutes. It holds the holding statement, timestamped updates, an FAQ, and a way for media to reach the communications team. Build it before you need it and host it separately from your main website, because if the incident is a cyberattack or a hosting failure, the main site may be the first thing to go. The CrowdStrike Falcon outage of 19 July 2024 was a reminder that an organization can lose its own systems quickly, through no fault of its own, and still be expected to explain itself by mid-morning.
Test it twice a year: can two different people activate it from home, without help from IT?
Who else needs a call?
Regulators generally prefer to hear about a problem from you before they read about it. Many sectors have hard deadlines. Publicly traded companies, for example, must disclose material cybersecurity incidents on SEC Form 8-K within four business days of determining materiality, and state breach-notification laws add their own clocks. The plan should list every notification obligation that could apply, who owns each one, and what triggers it. Build that list with legal and compliance, not from memory.
Key customers deserve a call from someone they know, not a press release. Give account owners a short script and a list of what they may and may not say, and route the hard questions (credits, liability, contract terms) to a single point.
Words that make it worse
A short list for spokespeople, and for anyone else who might be quoted:
- "No comment." It sounds like guilt. Say what you can, and when you will say more.
- Speculation about cause. Early theories are often wrong, and the retraction becomes the second story.
- Blame. Pointing at a vendor, contractor or employee in the first hours starts a public fight you cannot win, even if you turn out to be right.
- Names or numbers of casualties before families are notified and authorities confirm.
- "Everything is under control" when it is not. One visible contradiction costs all future credibility.
- Recovery promises you cannot keep. "We expect to restore service by Friday" becomes Friday's headline.
- "We take this very seriously." It has been said so often it reads as boilerplate. Show it with specifics instead.
- Anything "off the record." Assume every word is on it.
Expressing concern for the people affected is not an admission of liability, and legal teams that strip all empathy from statements do the company no favors. Keep cause and fault out of it until the facts are established.
The 3 a.m. test
A crisis communications plan is ready when someone woken at 3 a.m. can answer these questions without opening email:
- Who is the communications lead tonight, and who backs them up?
- Where are the holding statements, and can I reach them if the network is down?
- Who are the three approvers and their alternates, and what is the review window?
- How do we reach every employee in the next 30 minutes?
- Who calls the families, and who goes with them?
- Who is tonight's spokesperson?
- Who can activate the dark site from home?
- Which regulators and customers need a call, and who makes each one?
- Who is watching social media, and who do they tell?
Any answer that starts with "I'd have to check" is the next thing to fix. FEMA's Ready Business program has a short guide to crisis communications plans that works as a structural checklist. The answers above are the part only you can write.
