Crisis Communications Plan: Build One Before You Need It

A crisis communications plan is only useful if it actually works when pressure arrives. Many organizations have something that passes for a plan, it lives in a shared folder, the last revision date is three years ago, and nobody on the current communications team has read it all the way through. The difference between organizations that come through a crisis intact and those that spend months rebuilding credibility almost always traces back to what they did before anything went wrong.

‍At Selvam Public Affairs, we've worked alongside organizations across some of the most demanding crisis situations in our firm's experience: regulatory investigations, executive misconduct, data breaches, and operational failures that hit the front page. The pattern is consistent. Organizations that manage well had done the preparation work in advance. The ones that struggled were improvising.

‍This guide walks through how to build a crisis communications plan that actually holds under pressure. Five core areas: what goes into the plan, who owns the roles, what you say in the first 24 hours, how you reach each audience, and how you test it before reality forces you to find out if it works. ‍

Why most crisis plans don't hold under real pressure

‍Many organizations that get blindsided by a crisis had something that looked like a plan. It just wasn't a plan they could use when the pressure arrived. The spokesperson listed in it left the company eighteen months ago. The contact numbers are outdated. The activation criteria are so vague that nobody can agree whether the situation even qualifies. A document that exists is not the same as a framework that's operational.

The difference between having a plan and having a plan that works

This gap is one of the most common things we see, and organizations almost always discover it at the worst possible moment: when a reporter calls with a twenty-minute deadline, when an incident goes public before management has the facts, or when employees learn about the crisis on social media before leadership sends a single word internally. At that point, the plan sitting in the folder is useless. The team is starting from scratch while the clock runs.‍ ‍

What being caught flat-footed actually costs

The costs are concrete. Reputational damage that takes years to reverse. Regulatory exposure when mandatory disclosure windows get missed. Erosion of employee trust that no all-hands meeting can quickly repair. And the compounding effect: a bad 48 hours that becomes a months-long credibility problem because the initial response was confused, slow, or inconsistent. None of this is theoretical. These are the consequences organizations face when preparation is treated as optional.‍ ‍

The core components every crisis communications plan must include

Before you can build a plan, you need to know what goes in it. The structure is simpler than most organizations assume. Five things, done thoroughly: purpose and scope, stakeholder mapping, contact infrastructure, pre-cleared messages, and review protocols. Think of this as your emergency communications plan, the foundation that makes everything else executable.

Purpose, scope, and activation criteria

Define what the plan covers and what it doesn't. A plan that tries to cover everything covers nothing well. More importantly, define your activation criteria clearly. Without a specific trigger, your team will debate whether the situation qualifies as a crisis instead of activating the plan and responding. Set thresholds based on public exposure, operational impact, and incident severity. When those thresholds are met, the plan activates. No committee vote required.

Stakeholder mapping: who needs to know, and in what order

Identify every audience that needs to hear from you during a crisis: employees, customers, regulators, investors, board members, partners, and media. Then map the sequence. The order matters as much as the list. Employees should hear from leadership before they hear from the news. Regulators with mandatory notification windows need to be on a separate track with timed alerts. Customers need to know what affects them, not everything you know. Getting the sequence right is one of the most important things the plan can do.

Contact lists, backup channels, and information flow

The operational infrastructure of a plan is unglamorous but critical. Up-to-date contact directories. After-hours numbers for legal, communications, and executive leadership. Backup spokespersons for every primary. Protocols for what happens when primary systems are down, not a remote possibility in a cyber incident. If your plan only works when everything else is working, it isn't really a plan. Infrastructure sets the stage; the people who activate it determine whether it holds.

Who speaks in your crisis communications plan, roles and approval

This is where most plans are the weakest. The roles, authority, and approval chain are often left vague, and vague doesn't hold under pressure.

Designating a spokesperson before the cameras arrive

The right spokesperson is designated and prepared before an incident occurs, not chosen in the middle of one. The criteria are straightforward: media training, organizational authority, composure under pressure, and actual availability when a crisis hits. The CEO is not always the right choice. Sometimes it's a senior operations leader or a dedicated communications officer. What matters is that the decision is made in advance and the person is ready.

The approval chain that must move fast

A standard workflow looks like this: communications drafts the message using facts from operations, legal reviews for risk and clears the language, the crisis lead gives final approval, and the spokesperson delivers. Target a rapid approval cycle, for initial holding statements, aim for under an hour and practice that timeline in exercises. Build the workflow assuming everyone is stressed, some people are unavailable, and the first draft will need at least one revision. Then practice it.

Setting a clear no-comment-without-clearance rule

Unauthorized comments from well-meaning employees are one of the most common ways a crisis escalates. Someone posts a personal take on LinkedIn. A frontline manager tells a customer more than they should. A well-intentioned team member speculates with a reporter. Brief all staff on what to say when they're asked: "We're aware of the situation and our leadership team is handling it. I'll direct you to our official contact." Then give them the contact. That's it. Simple and enforceable.

First 24 hours in your crisis communications plan

The first 24 hours of a crisis are the most critical and the most likely to go wrong. Facts are incomplete, pressure is highest, and every audience wants an answer you may not have yet.

The holding statement formula that buys you time

A strong holding statement has five elements: acknowledge the incident, state only confirmed facts, describe the immediate action underway, express care where people are affected, and commit to a specific next update with a time and channel. That structure works even when you know very little. A crisis messaging template for this scenario might read: "We are aware of an incident involving [description]. We are actively investigating and taking immediate steps to address it. We will provide an update by [time] on [channel]." That statement buys you time, signals competence, and keeps audiences from filling the silence with speculation.

Scenario-specific message sets to pre-clear now

Every organization should have pre-cleared language for its highest-probability crisis scenarios, at minimum, a data breach or cyber incident, an operational disruption or service outage, a safety incident or workplace injury, and a leadership or governance issue. Pre-cleared language removes the legal review delay during a real crisis. Your legal team has already approved the framework; communications just fills in the confirmed facts. The time saved between a response that lands in the first hour versus one that drags into the afternoon is the difference between getting ahead of the story and chasing it. ‍

The update cadence and why missing it kills your credibility‍ ‍

When you commit to an update at a specific time, you must deliver it, even if the update is "we don't have new information yet, but we're still working on it." Audiences are far more forgiving of slow information than they are of silence. A practical 24-hour crisis checklist for communications cadence: initial holding statement, first factual update within a few hours, second update as facts develop, and a close-of-day summary with next steps. Miss one of those windows and you lose the credibility you were building.

Getting the right message to the right audience on time

Channel selection is a strategic decision, not a "use everything" decision. The goal is the right message reaching the right audience through the channel they actually use, in the right sequence. ‍

Internal staff first: the rule that protects trust‍ ‍

Employees should hear about a crisis from leadership before they see it anywhere else. Use SMS or mobile push for immediate alerts when speed is critical, for urgent employee alerts, direct mobile notification consistently outperforms email for open rate and response time. Follow with email for detailed official guidance. Pin authoritative updates to your intranet or employee app. For frontline or deskless workers without regular computer access, manager briefings and phone cascades are the primary channel. The sequence across all of these should happen before any external statement goes out, except when public safety or regulatory timelines require otherwise. ‍

External audiences: customers, media, and key stakeholders‍ ‍

For customers, use direct email for personalized updates, website banners or status pages for broad service issues, and social media for fast public acknowledgment when an issue is widely visible. For media, a press release or formal statement is the right tool for most situations; a press conference is appropriate for high-impact crises that require live explanation. For regulators, investors, and key partners, use direct formal notices and executive briefings, generic social posts don't serve those relationships. A one-page crisis notification matrix mapping each audience to their primary channel, secondary channel, timing, message owner, and message purpose is one of the most useful tools your crisis comms plan can include. ‍

How to test your plan before reality does it for you‍ ‍

A plan that has never been tested is a document, not a capability. Testing reveals the gaps your drafting process missed: the approval chain that stalls because two people have overlapping authority, the contact list with three outdated numbers, the spokesperson who freezes when asked a hard question. You need to find those gaps before a crisis does.

Running a tabletop exercise without over-engineering it‍ ‍

A basic tabletop exercise doesn't need to be a multi-day production. A focused 90-minute session with three to six people who carry crisis communications responsibility will reveal most of your plan's gaps. A facilitator introduces a realistic scenario, the group works through the plan step by step, and a scribe documents where the process breaks down and what decisions get stuck. After the session, you fix what broke. Run one every year at minimum, and after any significant incident.

Legal and regulatory checkpoints before you finalize

U.S. organizations need to map their sector-specific disclosure obligations directly into the plan. Public companies face SEC Form 8-K filing requirements for material cybersecurity incidents, generally within four business days of a materiality determination, per SEC cybersecurity disclosure rules. State data breach notification laws impose their own timelines, which vary by state. Healthcare organizations have HIPAA notification requirements. These aren't optional considerations; they're legal obligations with consequences for missing them. Pre-mapping these timelines into your crisis workflow ensures your communications team and legal counsel are working from the same clock.

Working with a firm that activates plans under real pressure

Selvam Public Affairs works with organizations to go beyond plan creation. We stress-test crisis communications plans in realistic scenarios, identify gaps in the approval chain, and activate communications in actual high-pressure situations. The difference between a plan that looks complete in a shared folder and one that functions when the clock is running is usually discovered in a tabletop, not in a real crisis. That's the outcome we work toward with every client we support.‍

Build it now, not after

Many organizations delay building a crisis communications plan for the same reason: they assume a crisis won't happen to them. That assumption is precisely what makes the situation worse when one does. ‍

The plan you build today, before any pressure arrives, is the difference between an organization that weathers a crisis and one that gets defined by it. Clear roles, pre-cleared messages, a mapped stakeholder list, a tested approval chain: none of that is complicated. It just has to exist and be operational before you need it. ‍

The organizations that come through crises well aren't necessarily better at managing the crisis itself. They're better at preparation. They made the decisions, designated the roles, and cleared the language in advance. When the moment arrived, they activated. Everything else followed.

Take one step this week. Pull out whatever passes for your current plan, find the first thing that wouldn't work under real pressure, and fix it. Then fix the next thing. Start your crisis communications plan review today, the work builds from there.