Crisis Management Plan: What to Include and How to Build One

What is a crisis management plan?

A crisis management plan is a written document that tells an organization who decides, who speaks, and what happens first when an event threatens its people, operations, or reputation. It sets the triggers that activate the plan, names the crisis team and its authority, lists the audiences to inform, and stores pre-approved messages and contact details so nobody has to improvise under pressure. A good plan turns the first hours of a crisis from a scramble into a sequence of decisions that were already thought through.

The plan does not predict every crisis. It gives you a structure that works for most of them: a product failure, a data breach, an allegation against an executive, or a post that goes viral and starts to rank for your name.

Crisis management plan, crisis response plan and crisis communication plan

These three terms are often used as if they meant the same thing. In practice they are layers of one system:

• Crisis management plan: the umbrella document. It covers governance, roles, decision rights, risk scenarios, legal checkpoints, recovery, and review.
• Crisis response plan: the operational part. It sets out the concrete steps for the first hours and days, often as a checklist, so the team can act before all the facts are known. Our crisis response checklist is a working version of this layer.
• Crisis communication plan: the part that governs what you say, to whom, through which channel, and who approves it. We cover it in depth in our guide to the crisis communication plan.

International guidance treats crisis management as a strategic capability led by top management. ISO 22361:2022, the ISO guideline on crisis management, is written for leaders with strategic responsibility for that capability and covers crisis leadership, decision-making, communication, and learning from crises. For the wider picture of how these pieces fit, see our overview of crisis management.

What a crisis management plan should include

Plans differ by size and sector, but the strong ones share the same core elements:

1. Scope and activation triggers. A short definition of what counts as a crisis for your organization, and who can activate the plan. Without this, teams lose time debating whether the situation is serious enough.
2. Severity levels. Two or three tiers, for example an issue handled by one department, an incident that needs the crisis team, and a crisis that needs the board or owner. Each tier says who is informed and how quickly.
3. The crisis team and decision rights. Named people, with deputies, for leadership, legal, communications, operations, HR, IT and security, and customer support. Write down who has the final word on public statements.
4. Audiences and contact lists. The Ready.gov guidance on crisis communications lists employees, customers, suppliers, management, and government officials and regulators as audiences to plan for. It recommends compiling contact information for each audience in advance, keeping it accessible during an incident, and updating and securing the lists regularly.
5. A designated spokesperson. Ready.gov advises deciding in advance who will speak to the media and preparing that person with talking points. Everyone else should know to route questions to that person.
6. Pre-approved message templates. Holding statements with blanks to fill in once facts are confirmed. Ready.gov notes that messages can be scripted as templates, approved by management, and stored where the team can edit and release them quickly.
7. Monitoring. Who watches news, social media, review sites, forums, and search results for your name or brand, and how alerts reach the team outside office hours.
8. Legal and regulatory checkpoints. The notices you may owe to regulators, customers, insurers, or partners, and who confirms them with counsel.
9. Documentation. A single incident log with times, decisions, and evidence. It supports later reviews, insurance claims, platform reports, and any legal action.
10. Recovery and review. How the organization returns to normal, rebuilds trust, and updates the plan afterward.

How to build a crisis management plan in seven steps

1. Map your realistic scenarios. List the events most likely to hurt you: operational failures, cyber incidents, workplace misconduct, product or service failures, legal action, and online attacks such as a defamatory article, a coordinated review campaign, or a viral video. For each, note who is affected and what is at stake.
2. Set severity levels and triggers. Decide what moves an event from one tier to the next. Keep the criteria simple enough to apply at night, on a phone.
3. Name the team and the chain of command. Give every role a deputy. Confirm who can approve a public statement when the chief executive is unreachable.
4. Map audiences and channels. Match each audience to the person best placed to inform it and to the channels you will use: email, intranet, website notice, social accounts, press statement, or direct calls to key clients.
5. Draft holding statements now. Write short templates for your top scenarios. A holding statement confirms you are aware, says what you are doing, and promises an update at a stated time. It does not speculate or assign blame.
6. Build in legal checkpoints. Some crises carry hard deadlines. Under rules announced by the U.S. Securities and Exchange Commission in 2023, public companies must disclose a cybersecurity incident they determine to be material on Form 8-K, generally within four business days of that determination. For breaches of personal information, the Federal Trade Commission notes that all states, the District of Columbia, Puerto Rico, and the Virgin Islands have laws requiring notification of security breaches involving personal information. Your counsel should confirm which obligations apply to you; this guide is general information, not legal advice.
7. Test the plan and train the team. Run tabletop exercises in which the team works through a realistic scenario around a table. The Cybersecurity and Infrastructure Security Agency publishes tabletop exercise packages with template scenarios and discussion questions that organizations can adapt. Ready.gov also describes training, testing, and exercises as essential parts of business preparedness. Fix every gap the exercise reveals.

The crisis response plan: what to do in the first hours

When the plan is activated, the response follows a predictable order. The aim is to be fast without being wrong.

1. Confirm the facts. Establish what happened, who is affected, and what is still unknown. Separate verified facts from claims circulating online.
2. Convene the team and open the incident log. Record every decision with a time stamp.
3. Preserve evidence. Capture screenshots with URLs and dates of harmful posts, articles, and comments before they are edited or deleted. This record matters if you later report content to a platform or speak to a lawyer about a claim.
4. Issue a holding statement. Acknowledge the situation, show concern for anyone affected, and commit to an update.
5. Inform internal audiences first, or at the same time. Employees should not learn about a crisis from the news.
6. Monitor and adjust. Track where the story is spreading, which search results and posts are gaining visibility, and which questions keep coming up.

A useful test for every message comes from the Crisis and Emergency Risk Communication (CERC) program of the U.S. Centers for Disease Control and Prevention. Its six principles are be first, be right, be credible, express empathy, promote action, and show respect. CERC also suggests that accurate messages can include what is known, what is not known, and what is being done to fill the gaps. That framing works well for organizations that need to speak before an investigation is complete.

Online reputation crises need their own playbook

Many crises today start or grow online. A single post, review thread, or article can rank on page one for your name within days, and it can stay there long after the event is over. Your plan should cover the online side explicitly:

• Search results. Check what appears when people search your name, your brand, and your executives. Those results shape first impressions for clients, investors, and employers.
• Social platforms. Each platform has its own reporting rules. Content that breaks those rules can sometimes be reported and removed. Our guide on how to report defamation on social media explains the usual routes, and our guide to social media crisis management covers the response side.
• False statements. If content contains false statements of fact that harm your reputation, it may be defamatory. The rules vary by jurisdiction; start with our overview of defamation laws, the difference between libel and slander, and what counts as defamation per se. State pages, such as defamation law in California, summarize local rules.
• Legal deadlines. Defamation claims must be filed within a limited time, and the period varies by state. See our guide to the defamation statute of limitations and, if you are considering a claim, how to sue for defamation.
• Attacks on people. When a crisis turns into harassment or the exposure of employees’ personal details, other laws may apply. See our guides to online harassment laws, cyberstalking laws, and whether doxxing is illegal.

Common mistakes that make a crisis worse

• Silence or “no comment.” When you say nothing, others fill the gap, and the first version of the story often becomes the one people remember.
• Speculating before the facts are confirmed. A correction later costs more credibility than a careful holding statement now.
• Arguing with critics in public. Replies made in anger are screenshotted and shared, and they can rank alongside the original story.
• Threatening to sue over protected speech. Honest criticism and opinion are often protected. According to the Reporters Committee for Freedom of the Press, 40 states and the District of Columbia had anti-SLAPP laws as of March 2026, and these laws typically let defendants who win an anti-SLAPP motion recover attorney’s fees and costs. Read our guide to anti-SLAPP laws and speak to a lawyer before sending a demand letter.
• Inconsistent messages. Different answers from different people suggest the organization is not in control. One spokesperson and one approved message prevent this.
• A plan nobody has read. A plan that has never been tested tends to fail on contact details, approvals, and access to accounts.

For real-world cases of what went right and wrong, see our collection of PR crisis examples.

Keeping the plan current

A crisis management plan is a living document. Review it on a fixed schedule, such as once a year, and every time something important changes: a new executive, a new product, a new market, a merger, or a new platform where your audience gathers. After every real incident or exercise, hold a short review: what worked, what slowed the team down, and what the plan should say next time. Update contact lists and account access at the same time, because those details go out of date first.

If you decide to bring in outside support, agree on the scope and the team before you need it. Our guide on how to choose a crisis management firm lists the questions to ask.

How Media Removal can help

Media Removal is not a law firm and does not give legal advice. We work on what people find about you online. When negative content, viral attacks, or coordinated narratives hit your name or brand, our reputation crisis management team evaluates the scope of the crisis, the platforms involved, and search visibility, so the right priorities are handled first. After the initial assessment we give you a clear scope and a plan in writing.

Where content can come down, our content removal team uses the pathway that fits each case: direct outreach to the publisher, platform-specific reporting, DMCA notices, GDPR requests, or defamation claims. Whether something is removed depends on the platform’s rules and, where a court is involved, on the court. When removal is not possible, online reputation management can push negative results down and build accurate information on page one.

Every client signs an NDA, and so do we. In a crisis, we respond the same day. If you want an honest view of what can be done in your situation, you can request a quote.

Frequently asked questions

What are the key elements of a crisis management plan?

A crisis management plan usually includes activation triggers and severity levels, a named crisis team with deputies and clear decision rights, audience and contact lists, a designated spokesperson, pre-approved holding statements, a monitoring process, legal and regulatory checkpoints, an incident log, and a process for recovery and review.

What is the difference between a crisis management plan and a crisis response plan?

The crisis management plan is the umbrella document that covers governance, roles, scenarios, legal checkpoints, and recovery. The crisis response plan is the operational part inside it: the concrete steps the team takes in the first hours and days after the plan is activated.

Who should be on a crisis management team?

Most teams include a leader with authority to decide, plus people responsible for legal, communications, operations, HR, IT and security, and customer support. Each role should have a deputy, and the plan should state who approves public statements when the leader is unavailable.

How often should a crisis management plan be updated?

Review it on a fixed schedule, such as once a year, and after any real incident, exercise, or major change in leadership, products, or markets. Contact lists and account access go out of date fastest, so check them at every review.

Can negative content be removed during a reputation crisis?

Sometimes. Content that breaks a platform’s rules, infringes copyright, or contains false statements of fact may be removable through platform reporting, legal notices, or a court order. The platform or the court makes the final decision, and no one can promise removal in every case. When removal is not possible, suppression can reduce how visible the content is in search results.

Should a lawyer be involved in a crisis management plan?

In most cases it helps. A lawyer can confirm notification duties, review public statements that could create liability, and advise on possible claims such as defamation and on the risk of anti-SLAPP motions. This guide is general information and is not legal advice.

Sources

• Ready.gov: Crisis Communications Plans
• Ready.gov: Training and Testing for businesses
• CDC: CERC Introduction (Crisis and Emergency Risk Communication)
• U.S. SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (2023)
• Federal Trade Commission: Data Breach Response, A Guide for Business
• CISA: Tabletop Exercise Packages
• Reporters Committee for Freedom of the Press: Anti-SLAPP Legal Guide
• ISO 22361:2022 Security and resilience, Crisis management, Guidelines (catalog listing)