Crisis comms: what to do when bad news hits

Activate the incident response before drafting public language. Protect people and operations, contain the harm, preserve evidence, assign an incident lead, and assemble the domain experts, counsel, and communications owner the situation requires. Publish only verified facts, useful instructions, and the time or condition for the next update.

The incident team maintains one fact record

Ready.gov's business preparedness guidance places communications planning alongside emergency response, business continuity, and IT recovery. Use one time-stamped record so every channel draws from the same approved facts:

Protect and contain. The appropriate safety, security, HR, product, or operations lead acts to stop ongoing harm and keep critical services running.
Assign command. Name an incident lead with authority to set priorities. Name a communications lead and backups for both roles.
Record facts. Separate what is confirmed, what is still being investigated, who verified each fact, and what information cannot yet be released.
Check obligations. Counsel and the relevant compliance or domain specialists determine preservation, notification, insurer, regulator, law-enforcement, and contractual requirements.
Map stakeholders. Identify who is affected, what each group needs to know or do, and which channel will reach them.

The FTC's data-breach guide illustrates the sequence for one incident type: secure operations, investigate, fix vulnerabilities, create a communications plan, and determine required notices. Apply guidance written for the specific incident and jurisdiction rather than treating a generic PR checklist as legal advice.

The first update gives people usable facts

A holding statement is useful when facts are incomplete. It should include:

what the organization has verified;
what it is doing to contain or investigate the issue;
who may be affected and what they should do now, if known;
which facts remain unknown;
where questions should go; and
when or under what condition the next update will arrive.

Do not speculate, minimize harm, assign blame before the investigation supports it, or promise a remedy the operating team has not approved. A generic statement that says only "we are investigating" leaves affected people without instructions or an update path.

Every update follows the same approval path

Use a primary spokesperson and a backup, then bring in security, HR, legal, medical, or operational experts when their knowledge is required. Consistent facts matter more than forcing every subject through one person. Track versions, approvals, publication times, stakeholder questions, and corrections. Inform directly affected groups through appropriate channels instead of expecting them to learn material facts from a press report.

After the incident, review the timeline, decisions, missed audiences, access failures, and inaccurate assumptions. Update the plan and run the revised process as an exercise.