Crisis Communication Guide
Communicate clearly and effectively during crises and incidents.
Usage
- Assess the crisis severity and identify affected stakeholders
- Issue initial acknowledgment within 15-30 minutes (you don't need all answers yet)
- Establish communication cadence and channels for updates
- Coordinate internal and external messaging for consistency
- Conduct post-incident review and share learnings
Examples
- Service outage status page update: "[Investigating] We are aware of issues affecting [service name] starting at [time UTC]. Users may experience [specific symptoms]. Our engineering team is actively investigating. We will provide an update within 30 minutes. Status: [link]"
- Security incident notification: "We detected unauthorized access to [system] on [date]. Immediately upon discovery, we [actions taken: rotated credentials, isolated systems, engaged security team]. Affected data includes [specific scope]. Does NOT include [reassurance]. We are requiring all users to [reset password, enable 2FA]. Full incident report will be published by [date]"
- Internal crisis communication: "Team, here is what we know: [facts only, no speculation]. Here is what we're doing: [action plan with owners]. Here is what we need from you: [specific asks]. Next update at [time]. Questions go to [person], not general Slack channels. Do NOT communicate externally until approved messaging is ready."
Guidelines
- Speed beats completeness in initial response: "We're aware and investigating" within 15 minutes is better than a detailed explanation in 2 hours
- Stick to facts — never speculate about causes, blame, or timeline in public communications
- Over-communicate internally, be measured externally. Your team needs constant updates; the public needs fewer, more polished ones
- Designate ONE spokesperson for external communications — multiple voices create contradictions
- Always include: what happened, what you're doing about it, what the customer should do, when you'll update next
- After the crisis: publish a blameless post-mortem. Transparency builds trust. Hiding failures destroys it