Crisis Communication Plan: How to Write One (With Template)

What is a crisis communication plan?

A crisis communication plan is a written document that decides, before anything goes wrong, who speaks for your organization, who you need to reach, what you will say first and through which channels. It turns the first hours of a crisis from improvisation into a sequence of known steps. A good plan fits on a few pages, names real people with real phone numbers and includes pre-approved holding statements you can adapt in minutes.

The plan is not the same as a broader crisis management plan, which covers operations, safety and continuity. The communication plan is the part that controls what people hear from you. This guide explains what to include, walks through how to write one and gives you a copy-ready crisis communication plan template at the end.

This guide is general information, not legal advice. Media Removal is not a law firm. For decisions about disclosure duties or legal exposure, speak to a licensed attorney where you operate.

Why you need the plan before the crisis

When a crisis starts, the pressure to say something arrives faster than the facts. Without a plan, three things usually go wrong: several people speak at once and contradict each other, the first statement waits for approvals nobody has defined, and key audiences such as employees hear the news from social media instead of from you.

Public guidance points in the same direction. The U.S. government’s Ready.gov guidance on crisis communications plans recommends identifying the audiences you will need to reach, deciding in advance who will speak to the media and preparing that person with talking points, compiling contact information for each audience ahead of time and pre-scripting message templates with blanks to fill in once the facts are known. The CDC’s Crisis and Emergency Risk Communication framework is built on six principles: be first, be right, be credible, express empathy, promote action and show respect, as listed in this CDC CERC resource.

Those principles pull against each other in practice. Being first tempts you to guess; being right tempts you to wait. A written plan resolves that tension in advance: you agree on what can be said immediately (what happened, what you are doing, when you will update) and what must wait for verification.

What to include in a crisis communication plan

Most effective plans share the same core components. Keep each one short enough that someone under stress can use it.

1. Crisis team and roles

Name a small core team: a decision-maker, a communications lead, a legal contact, and the owner of each affected area (operations, IT, HR, customer service). For each role, name a backup. Write down who has final sign-off on public statements and how fast they are expected to respond.

2. Activation criteria and severity levels

Define what counts as a crisis and who can trigger the plan. A simple three-level scale works well: an issue that is contained and handled by one team, an incident that needs the crisis team, and a crisis that threatens safety, legal standing or the organization’s reputation at large.

3. Audiences and stakeholder map

List every group that may need to hear from you: employees, customers, investors or owners, partners and suppliers, regulators, the media and the local community. For each one, note what they will want to know and who in your organization speaks to them.

4. Spokespeople

Choose one primary spokesperson and one alternate. Everyone else should know that media and public questions go to them. Prepare them with talking points and a short brief on what they may and may not say.

5. Holding statements and message templates

Draft short, pre-approved statements for the scenarios you are most likely to face, with blanks for the facts. A holding statement acknowledges the situation, says what you are doing and commits to the next update. It does not speculate on cause or blame.

6. Channels and contact lists

Record where each audience will hear from you (email, intranet, website, social accounts, press list, phone) and keep up-to-date contact lists in a secure place you can reach even if your normal systems are down.

7. Approval workflow

Write the review path for each type of message and the maximum time each step may take. Decide in advance which statements need legal review and which the communications lead can release alone.

8. Monitoring and updates

Assign someone to monitor news, social media, review sites and search results for your name throughout the crisis, and set a cadence for updates, even when there is nothing new to report.

9. Recovery and review

Plan the shift from response to recovery: what you will say once the situation is resolved, how you will rebuild trust and when the team will meet to review what worked.

How to write a crisis communication plan in seven steps

1. Map your likely scenarios. List the five to ten crises most realistic for your organization: a data breach, a product recall, an executive scandal, a viral complaint, false accusations online, a workplace accident, a lawsuit becoming public. You cannot plan for everything, but most crises are variations of a few patterns.
2. Name the team and backups. Put names, titles, mobile numbers and personal email addresses (in case corporate email is unavailable) in one table. Confirm each person has agreed to the role.
3. Build the stakeholder map. For each audience, write their main concern, the channel you will use and the person responsible for reaching them. Employees usually come first: they are also your informal spokespeople.
4. Write holding statements for each scenario. Keep them to three or four sentences. Have the decision-maker and legal contact approve them now, so that in a crisis only the blanks need sign-off.
5. Set the approval path and timing. Agree on the target time for a first public acknowledgment and who can release it. Agree how often you will update and where.
6. Prepare your owned channels. Make sure the team knows who controls the website, each social account and the internal messaging tools, and that access does not depend on one person.
7. Test, then review. Run a tabletop exercise at least once a year: walk the team through a scenario and time each step. Update the plan after every exercise and every real incident.

If you want a shorter tool for the first hours of an incident, pair this plan with our crisis response checklist.

Crisis communication plan template

Copy this template into your own document and replace every item in brackets. Keep the finished version short, store it where the whole team can reach it offline, and review it at least once a year.

Section 1: Purpose and scope

This plan sets out how [Organization name] communicates during a crisis. It applies to [all offices / named business units]. Owner: [Name, title]. Last reviewed: [date].

Section 2: Activation

• Anyone who becomes aware of a potential crisis reports it to [Name, phone] or [backup name, phone].
• The plan is activated by [role] when an event meets Level 2 or Level 3 below.
• Level 1 (issue): contained, handled by the responsible team, logged.
• Level 2 (incident): may become public or affect customers; crisis team convenes within [time].
• Level 3 (crisis): threatens safety, legal standing or reputation; full plan activated immediately.

Section 3: Crisis team

• Decision-maker: [Name, title, mobile, personal email]. Backup: [Name].
• Communications lead: [Name, contact]. Backup: [Name].
• Legal contact: [Name or outside counsel, contact].
• Operations / IT / HR / customer service leads: [Names, contacts].
• Monitoring lead: [Name, contact].

Section 4: Spokespeople

• Primary spokesperson: [Name, title].
• Alternate: [Name, title].
• Rule for all other staff: refer every media or public question to [contact] and do not comment.

Section 5: Stakeholder map

• Employees: main concern [safety, job impact]; channel [intranet, email, team meeting]; owner [Name].
• Customers: main concern [service, data, refunds]; channel [email, website notice, support script]; owner [Name].
• Investors or owners: channel [direct call, formal disclosure]; owner [Name].
• Partners and suppliers: channel [account managers]; owner [Name].
• Regulators: channel [as required by law]; owner [legal contact].
• Media: channel [press statement, website newsroom]; owner [communications lead].

Section 6: Holding statement

We are aware of [brief, factual description of the situation]. Our priority is [the safety of / support for / protecting] [affected group]. We are [action being taken] and are working with [relevant parties, if appropriate]. We will share an update by [time or date] at [channel].

Section 7: Approval workflow

• Holding statements in this plan: release by [communications lead] with notice to [decision-maker].
• New public statements: drafted by [role], reviewed by [legal contact] within [time], approved by [decision-maker] within [time].
• Statements on cause, liability, personal data or financial impact: always reviewed by [legal contact] before release.

Section 8: Channels and access

• Website and newsroom: controlled by [Name, backup].
• Social accounts: [list accounts], controlled by [Name, backup].
• Internal messaging: [tool], controlled by [Name].
• Contact lists stored at: [secure location, offline copy].

Section 9: Monitoring and update cadence

• Monitor [news, social platforms, review sites, search results for our name] every [interval] during Level 2 and Level 3.
• Log every inquiry and every published statement with date, time and author.
• Publish updates every [interval], even if there is no new information.

Section 10: Recovery and review

• Closing statement and recovery message prepared by [role].
• Post-crisis review meeting within [number] days; plan updated by [Name].

Legal points to check before you speak

A crisis statement is a public record. What you say in the first hour can later be quoted by journalists, regulators or the other side in a lawsuit. That is why the plan should name a legal contact and decide which statements they must see. A few rules are worth knowing in advance:

• Data breaches. According to the FTC’s data breach response guide, all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of breaches involving personal information, and these laws typically say what a notice must or must not contain. The FTC also recommends naming one point person for releasing information and avoiding misleading statements about the breach.
• Public companies and cybersecurity incidents. Under the SEC rules adopted in 2023, a material cybersecurity incident is reported on Form 8-K Item 1.05, generally due four business days after the company determines the incident is material, as the SEC announced.
• Selective disclosure. For public companies, Regulation FD requires a covered company that shares material nonpublic information with securities market professionals or with holders of its securities to make that information public, simultaneously if the disclosure was intentional and promptly if it was not, according to the SEC’s adopting release. Briefing a few investors before a public statement can create a problem.
• Preserving evidence. If litigation is likely, relevant emails, messages and posts should be preserved. Federal Rule of Civil Procedure 37(e) allows courts to respond when electronically stored information that should have been preserved is lost because a party failed to take reasonable steps to preserve it, and cannot be restored or replaced, as shown in the text of Rule 37 at Cornell LII. Do not delete posts or messages in a panic without advice.
• Your own words about others. In a dispute, it is tempting to call a critic a liar or a former employee a thief. A false statement of fact about an identifiable person can itself be defamatory. Our guides on defamation laws and libel vs. slander explain the basics.

These points apply in the United States; other countries have their own disclosure and privacy rules. Your attorney can tell you which apply to your situation.

When the crisis plays out online

Many crises today start or grow online: a viral post, a negative news article, a wave of reviews, a Reddit thread or false accusations that rank for your name. Your plan should cover three online-specific tasks.

• Respond where the conversation is. Post your statement on the platforms where the crisis is spreading, not only on your website. For a platform-led crisis, see our guide to social media crisis management.
• Document before you act. Capture screenshots with URLs, dates and account names of harmful or false content. That record supports platform reports and, if needed, legal action. Our guide on how to report defamation on social media explains the reporting routes.
• Watch what search shows. Long after the news cycle ends, a single article or thread can stay on page one for your name. Plan for that phase too: what can be removed at the source, what can be pushed down and what needs new, accurate content to balance it.

If false statements are involved, it can help to know the time limits: see our guide to the defamation statute of limitations. Real-world lessons are collected in our PR crisis examples.

How Media Removal can help

Media Removal works on the online side of a crisis: what people find when they search your name or your company. Through our reputation crisis management service, we assess the scope of the crisis, the platforms involved and how visible it is in search, and then act on the sources that matter most.

• Content removal at the source where there are grounds, through platform reporting, publisher outreach and legal channels. See content removal.
• Suppression of results that cannot be removed, by building accurate, authoritative content. See online reputation management.
• Monitoring so that a resolved crisis does not resurface unnoticed.

We cannot promise that any content will be removed: platforms, publishers and courts make the final decision, and not every request succeeds. After the initial assessment we give you a clear scope and a plan in writing, so you know what is being done and why before any work begins. Every client signs an NDA, and so do we. If you are facing a crisis now, request a quote and we respond the same day. If you are still choosing who to work with, our guide on how to choose a crisis management firm can help.

Frequently asked questions

What is the difference between a crisis communication plan and a crisis management plan?

A crisis management plan covers the whole response: safety, operations, business continuity and decision-making. A crisis communication plan is the part of it that controls who speaks, to which audiences, with what messages and through which channels. Many organizations keep the communication plan as a separate, shorter document so it can be used quickly.

What should a holding statement include?

A holding statement should acknowledge the situation in factual terms, state your priority (for example, the safety of the people affected), say what you are doing now and commit to a time and place for the next update. It should not speculate on cause, assign blame or include facts that have not been verified.

Who should be the spokesperson in a crisis?

Choose one primary spokesperson and one alternate in advance. It is usually a senior leader or a trained communications lead who can speak clearly and calmly. In a serious crisis, it can also matter that the most senior leader speaks publicly at least once. Everyone else should refer questions to the spokesperson.

How often should a crisis communication plan be updated?

Review it at least once a year, after every tabletop exercise and after every real incident. Update contact details whenever someone on the crisis team changes role or leaves the organization.

Does a small business need a crisis communication plan?

Yes. A small business is often more exposed, because a single viral post or negative article can dominate search results for its name. A two- or three-page plan with named roles, contact lists and a few holding statements is enough to start.

Can Media Removal remove negative content during a crisis?

Sometimes. Content can be removed when it breaks a platform’s rules or the law, and platforms, publishers or courts make the final decision. When removal is not possible, the option is to push the results down with accurate content. Media Removal does not guarantee removal and gives you a written plan after the initial assessment.

Sources

• Ready.gov: Crisis Communications Plans
• CDC: CERC in Response to an Opioid Overdose Event (six CERC principles)
• FTC: Data Breach Response, A Guide for Business
• SEC press release 2023-139: cybersecurity disclosure rules
• SEC: Selective Disclosure and Insider Trading (Regulation FD adopting release)
• Cornell LII: Federal Rule of Civil Procedure 37