How to buy crisis communications support during an incident

During an active incident, add an experienced communications lead to the company's established response team. Outside support should strengthen fact control, stakeholder communication, and decision capacity without taking authority from incident, legal, security, safety, medical, employment, or operational owners. Define access, approvals, evidence, availability, and exit terms before the provider starts work.

Communications belongs inside the existing incident authority

NIST SP 800-61 Revision 3, published in April 2025, treats cybersecurity incident response as part of organization-wide risk management. The FTC's August 2023 data-breach guide similarly describes a cross-functional team that may include forensics, legal, security, IT, operations, HR, communications, investor relations, and management. The incident type determines which specialists belong in the room.

The incident lead owns priorities and operational decisions. Fact owners verify what happened and what remains unknown. Legal and domain specialists determine preservation, notification, safety, and regulatory requirements. The communications lead advises on stakeholders, inquiries, updates, corrections, and evidence of what was communicated.

Provider fit, availability, and controls determine the urgent hire

Require the provider to document:

• recent experience with the incident type, stakeholders, and jurisdictions;
• the named lead, backup coverage, time zones, languages, and accessibility support;
• immediate availability, service levels, after-hours fees, and capacity limits;
• its role under the incident lead and process for working with counsel and specialists;
• conflicts, subcontractors, confidentiality, insurance, and data-handling terms;
• secure communication methods and the minimum systems or facts it needs;
• deliverables, decision logs, version control, retention, and transition duties;
• fees for emergency response, monitoring, travel, and follow-on work.

A provider that begins public work before identifying incident authority, verified facts, affected stakeholders, and specialist owners adds risk. The risk owner should approve access and may deny privileged, personal, technical, or investigative material that the communications team does not need.

The company retains decisions, accounts, and evidence

The company decides which facts are verified, who may speak, which commitments it can make, and which audiences require direct communication. A provider should not guess, minimize harm, assign unsupported blame, or promise an operational remedy.

The approval owner authorizes each public or stakeholder-facing version. The account owner keeps company control of the website, status page, social accounts, distribution tools, and recovery methods while granting role-based access. The asset owner retains the fact record, source documents, approvals, message versions, distribution evidence, inquiries, corrections, and final report.

If the normal communication platform or provider account may be compromised, require an approved alternate channel. Do not share credentials to accelerate access. Record and revoke temporary roles when the engagement or incident ends.

Exercises and records show whether the plan will work

CISA's current StopRansomware Guide recommends maintaining and regularly exercising an incident-response plan and associated communications plan. Require evidence that the company and provider have tested decision authority, contact paths, access, backup channels, unavailable leaders, and specialist escalation for relevant scenarios.

The review should produce named gaps, owners, deadlines, and plan updates. Re-test after major personnel, system, vendor, jurisdiction, or business-model changes. Evaluate accurate escalation and controlled access rather than rewarding the fastest draft.

Specialist requirements can change the buying path

A cyber incident may require forensics, breach counsel, law enforcement coordination, and jurisdiction-specific notification advice. A product-safety, clinical, workplace, financial, or physical emergency requires different qualified owners. Check insurance terms, existing counsel arrangements, regulator instructions, and contracted response vendors before hiring a standalone PR firm.

Skip ordinary vendor selection when immediate harm requires the existing emergency path. Use crisis communications scope to evaluate planned support and decision-rights guidance to assign authority before an incident.