Crisis Response and Communication
Response is where plans meet reality. Core operational concepts: activation and declaration, situation assessment, establishing command and coordination, span of control, a common operating picture, incident action planning, and an operational rhythm (briefings, situation reports, decision logs). Resource management-people, equipment, suppliers, facilities-must be prioritized against objectives, not against whoever calls loudest.
Crisis communication concepts: stakeholder mapping, message maps, holding statements, designated spokespeople, approved channels, rumor monitoring, and accessibility (language, disability, low bandwidth). Core principles: be first, be right, be credible-acknowledge what is known and unknown, state what you are doing, express empathy, and commit to a next-update time. Notify regulators and authorities within legal deadlines and align internal and external messages.
Traps: speculating on cause; “no comment,” which invites worse narratives; over-reassuring before facts are verified; different spokespeople giving different numbers; delaying all communication until the investigation ends; publishing only on a website that crashes; and confusing operational response with communication-fixing the problem does not replace telling stakeholders.
Rule of thumb - first hour: verify and secure, activate, assess, notify, then communicate a holding statement. Commit to a next-update time and keep it even if there is nothing new.
Worked example: A data breach is confirmed at 09:10. By 10:00 the organization states what happened (as known), what is not known, what affected customers should do, and when the next update comes. It does not name a cause. The 14:00 update meets the commitment, building credibility for later bad news.