Free Crisis Communication Plan Templates (6 Versions)
Six free crisis communication plan templates for small business: the plan, an escalation tree, holding statements, an internal sequence, and a media kit.
Six crisis communication plan templates for a small business with no communications team: the core plan with activation levels, an escalation tree and contact roster, a pack of first-hour holding statements, the employees-first internal sequence, a spokesperson and media kit, and a four-tab incident log. Editable Word and Excel files, no email form in the way.
A pipe let go above our office on a Sunday night. By six the next morning I had a landlord on the phone, water through two ceilings, and a team about to drive to a building they could not get into. What I did not have was a list of who to call, in what order, or one sentence I could send before I knew anything.
That is what a crisis communication plan is for, and not the corporate binder version. The useful version is a couple of pages that answer four questions while you are standing in the mess: who decides this is a crisis, who speaks for the company, who hears it first, and what we say in the hour before we have facts.
There are six templates here rather than one, because the plan, the call tree, the first-hour statements, the internal announcement, and the spokesperson brief get used at different minutes by different people. Five download as editable Word documents and one as a four-tab spreadsheet, free, with no email form.
TL;DR
A crisis communication plan is the set of decisions you make in advance about who can declare a crisis, who speaks for the company, which audiences hear what in which order, and what gets said before the facts are in. Employees first, a three-sentence holding statement inside the first hour, a named backup for every role, and a log kept as it happens. Six free templates below. No signup.
What a Crisis Communication Plan Is
A crisis communication plan is a written, pre-approved set of decisions about how a company communicates during an incident: who can declare one, who speaks, which audiences are told in what order, and what gets said before anyone knows the full picture. Everything in it is a decision you would otherwise be making badly, at six in the morning, with your phone buzzing.
It is not a public relations strategy, and it is not the same document as your standing communication policy. The policy governs a normal week. The plan governs the day the normal week stops, and its value is measured in how few choices it leaves you to make while everyone is watching you make them.
What Federal Guidance Says to Decide in Advance
The federal preparedness guidance for businesses is unglamorous and correct: identify the audiences who will want information and how you will reach each of them, and determine in advance who will speak to the media and prepare that spokesperson with talking points. It also recommends giving whoever answers the phone a script and a set of frequently asked questions, so the answers people hear match. Every one of those is a decision you can make on a quiet afternoon.
The Crises a Small Business Faces
Most small business crises are not scandals. They are an injury, a system or data incident, an unplanned closure, a threat, a sudden departure, or a public complaint that spreads faster than your reply. Each has an audience that will find out from somebody, and a clock you do not control.
What happens
Who hears first
The clock you do not control
Where small teams lose it
Serious injury or accident
People on site, then the family contact
OSHA reporting: 8 hours for a fatality, 24 hours for a hospitalization, amputation, or loss of an eye
Nobody has the reporting number, and the plan is inside the closed building
Data or system incident
Employees, then affected customers
State notification deadlines, which differ by state
Customers are emailed first, so staff cannot answer the phone
Unplanned closure
Every employee, including people with no company email
The start of the next shift
The message reaches desk staff and misses the field crew
Threat or violence at work
Everyone on site, immediately
Law enforcement first, then the message
Waiting for complete facts before saying anything at all
Sudden leadership departure
The team, before the rumor does
The moment a second person knows
Silence, which the group chat fills in for you
A public complaint that spreads
The team, then the customer
The first reply window, usually hours
An unapproved reply from whoever saw it first
Two of those rows carry legal deadlines rather than reputational ones, and they run whether or not your message is ready. Put them in the plan itself so that the person holding it does not have to remember them at seven in the morning.
The Reporting Clocks Run Without You
Federal rules require an employer to report a work-related fatality to OSHA within 8 hours, and an in-patient hospitalization, an amputation, or the loss of an eye within 24 hours. Reports go to the nearest OSHA area office, to the toll-free line at 1-800-321-OSHA (1-800-321-6742), or through the online form. A serious injury also needs an incident report written while memories are fresh. State breach notification laws set their own clocks for personal data, and they vary by state. This is general information, not legal advice.
What Every Plan Includes
Sixteen decisions, sorting into four groups: the trigger, the people, the words, and the close-out. A plan missing an entire group tends to fail in a predictable way, and the group people skip is usually the last one.
The trigger
What counts as a crisis here, in plain words
Severity levels with an owner for each
The two people who can declare one
How fast the plan has to be running
The people
A crisis team with a named backup per role
The order audiences are told in
Cell numbers, verified, on paper
Counsel, insurer, landlord, and agency contacts
The words
A holding statement for each likely scenario
One spokesperson and one backup
The channel used when the usual one is down
The time of the next update, promised in writing
The close-out
A timestamped log kept during the incident
A debrief inside a week
Fixes with an owner and a due date
A re-dated plan and a re-verified roster
Two items get left out more than anything else. A named backup for every single role, because the person listed may be the person involved. And the fallback channel, because a closed building or a system outage takes down the place where you kept the plan.
Still Using Spreadsheets for Onboarding?
Automate documents, training assignments, task management, and track onboarding progress in real time.
Start with the core plan, then add the two documents that get used under pressure: the escalation tree and the holding statements. The others fill in as you have time, and the log is the one you open during an incident rather than before it.
Crisis Communication Plan
The core document
The whole plan in one file: activation levels and who can declare them, the crisis team with a backup for every role, the audience order, the first-hour rule, approval, the regulatory clocks, and a first-24-hours timeline. The version to start from.
Escalation Tree and Roster
Who calls whom
The call tree with severity levels, a five-minute rule before moving to the backup, an internal roster with cell and alternate numbers, and an external roster covering counsel, insurer, landlord, and the OSHA reporting line. Built to be printed.
Holding Statements Pack
The first hour
Fill-in first messages for five situations: injury, a data or system incident, an unplanned closure, a threat, and a leadership departure or allegation. Plus the update that goes out when there is nothing new, and the never-say list.
Internal Announcement Sequence
Employees first
The employees-first order: the all-staff message, a channel and owner for every group that has no company email, one page of manager talking points, an employee FAQ starter, and the follow-up checklist.
Spokesperson and Media Kit
One voice
Designation with two levels of backup, an inquiry intake script for whoever picks up the phone, three key messages, bridging lines, on-the-record rules, and what to do on social channels during an incident.
Crisis Communication Log
Spreadsheet, four tabs
The record you will want afterward: a timestamped incident timeline, a notifications tab showing who was told and whether it was confirmed, an inquiry log, and debrief actions with owners and dates. Pre-filled with a worked example.
If You Only Do One Thing This Week
Fill in the escalation tree and print it. Real cell numbers, a backup for every role, and one copy that does not live in the office or in your email. That single page is what you actually reach for in the first ten minutes, and it is the piece that most often turns out to be missing. The holding statements are the natural second job, because writing a careful sentence is much harder on the morning you need it than on a quiet afternoon.
6 Free Crisis Communication Plan Templates
Download all six together as a zip file, or copy an individual template. Five are editable Word documents and one is an Excel workbook with four tabs. Fill in the brackets, delete the scenarios that do not apply to your business, and add the ones that do.
Download All 6 Crisis Communication Templates
The core plan, escalation tree, holding statements, internal sequence, spokesperson kit, and the incident log. Five DOCX files and one XLSX, in a single zip.
Template 1: Crisis Communication Plan (Core)
The whole plan in one document: activation levels and who can declare them, the crisis team with a backup per role, the audience order, the first-hour rule, approval, the regulatory clocks, and a first-24-hours timeline.
Crisis Communication Plan (Core)
CRISIS COMMUNICATION PLAN
[Company Name]
Effective date: _ Next review: _ (within 12 months)
Plan owner: _ Version: [ ]
Keep a printed copy at [location] and a copy on the phone of everyone named
below. A plan that exists only in email is unavailable during an email outage.
1. WHEN THIS PLAN ACTIVATES
Level 1, monitor: [something went wrong, it is contained, nobody outside the
company is affected]. Owner: [name]. Action: log it, no company-wide message.
Level 2, activate: [an incident affecting employees, customers, or the
premises, or anything a regulator, an insurer, or a reporter might ask about].
Owner: [name]. Action: this plan runs in full.
Level 3, severe: [injury, a threat to safety, or an incident with legal or
regulatory exposure]. Owner: [name]. Action: this plan runs in full, counsel is
called early, and no external statement goes out without review.
Who can declare Level 2 or Level 3: [name], or if unreachable within [15]
minutes, [backup name]. Nobody has to wait for permission to raise it.
2. THE CRISIS TEAM
Role | Name | Backup | Cell
Incident lead | [ ] | [ ] | [ ]
Spokesperson | [ ] | [ ] | [ ]
Internal messages | [ ] | [ ] | [ ]
Log keeper | [ ] | [ ] | [ ]
Operations or IT | [ ] | [ ] | [ ]
Every role has a named backup, because the person listed may be the person
involved, on a plane, or asleep.
3. WHO WE TELL, AND IN WHAT ORDER
1. Anyone in immediate danger or directly affected. Immediately.
2. All employees, including people who are not at a desk. Within [60] minutes.
3. Customers, clients, or families affected. Within [ ] hours.
4. Suppliers, landlord, insurer, counsel, payroll and banking contacts. Same day.
5. Public channels and media, if the story is already outside. When approved.
Nobody outside the company hears it before the team, unless a safety or legal
deadline forces a different order.
4. WHAT WE SAY FIRST
Three sentences, sent inside the first hour, before the facts are complete:
•What we know for certain right now.
•What we are doing about it.
•When the next update comes, and who it comes from.
We do not speculate on cause, name individuals, estimate damage or numbers, or
say "no comment." If we do not know, we say we do not know and give the time of
the next update.
5. CHANNELS
Primary internal channel: [ ] If that channel is down: [ ]
People without company email: [ ] Owner for that group: [ ]
Customers: [ ] Public: [ ]
Offline fallback: a printed roster of cell numbers held by [name] and [name].
6. APPROVAL
Internal messages: approved by [name].
Anything external: approved by [name], and by counsel at Level 3.
Approval target: [15] minutes. A message that waits for a committee is late.
7. LEGAL AND REGULATORY CLOCKS
These deadlines run whether or not the message is ready. Confirm what applies to
you with counsel and fill in your own.
•Work-related fatality: report to OSHA within 8 hours.
•In-patient hospitalization, amputation, or loss of an eye: within 24 hours.
•Reporting routes: the nearest OSHA area office, the toll-free line
1-800-321-OSHA (1-800-321-6742), or the online form on the OSHA website.
•Personal data incident: state notification deadlines apply and differ by
state. Ours: [ ].
•Insurance carrier notice: [ ]. Counsel: [ ]. Bank or payment processor: [ ].
8. THE FIRST 24 HOURS
0 to 15 minutes | Confirm safety, start the log, declare the level.
15 to 60 minutes | Escalation tree runs. Holding statement to all employees.
1 to 4 hours | Affected customers or families. Manager talking points out.
4 to 12 hours | Second update, even if the only news is that there is none.
12 to 24 hours | Written summary to employees. Media handled by [spokesperson].
9. AFTER
•[ ] Every message, call, and decision logged with a timestamp
•[ ] Debrief held within [5] business days
•[ ] What went wrong written down, not only what went well
•[ ] Plan, roster, and holding statements updated and re-dated
Plan owner signature: __ Date: _
DISCLAIMER: This is a sample template for general information only. It is not
legal advice and not a guarantee of compliance. Reporting deadlines, breach
notification rules, and employee rights differ by state and by situation. Have
this reviewed by qualified US counsel and adapted to your business.
Template 2: Escalation Tree and Contact Roster
The call tree with severity levels and a five-minute rule before moving to the backup, an internal roster with alternate numbers, and an external roster covering counsel, the insurer, the landlord, and the reporting line. Print this one.
Escalation Tree and Contact Roster
CRISIS ESCALATION TREE AND CONTACT ROSTER
[Company Name]
Last verified: _ Verify every [6] months and after any hire or exit.
Print this. Keep one copy at [location] and one off site with [name]. Phone
numbers, not chat handles: at 2 a.m. a message is not a contact method.
1. SEVERITY LEVELS
Level | What it looks like | Who is called | How fast
1 | [contained, nobody outside affected] | [supervisor] | Same day
2 | [employees, customers, or premises hit] | [owner, then team] | [15] min
Customers who must hear from a person, not a message: [ ]
5. WHEN A NAME IS UNREACHABLE
After [5] minutes, go to the backup. After the backup, go up, not sideways. Log
the attempt with a time. An unreachable person is a fact for the log, not a
reason to stop the tree.
6. VERIFICATION
•[ ] Every number dialed and confirmed within the last [6] months
•[ ] New hires added, departures removed
•[ ] Printed copies replaced with the current version
•[ ] One unannounced test call run per [year]
Verified by: __ Date: _
DISCLAIMER: This is a sample template for general information only and is not
legal advice. Keep personal cell numbers to the people who need them and store
this roster the way you store other personal data.
Template 3: Holding Statements Pack
Fill-in first messages for five situations: injury, a data or system incident, an unplanned closure, a threat, and a leadership departure or serious allegation. Plus the update that goes out when there is nothing new, and the never-say list.
Holding Statements Pack (First-Hour Messages)
HOLDING STATEMENTS: FIRST-HOUR MESSAGES
[Company Name]
A holding statement is what you send before you have the facts. Three sentences:
what is confirmed, what you are doing, when the next update comes. Fill these in
now, while nothing is happening, and edit the details on the day.
1. SERIOUS INJURY OR ACCIDENT AT WORK
Internal: "There was an incident at [location] at about [time]. [Confirmed
facts only: emergency services are on site, one person is being treated.] Our
focus is the people involved, and I will update everyone by [time]. Please do
not share names or details until families have been reached."
External, if asked: "We can confirm an incident at [location] this [morning].
Emergency services responded and we are cooperating fully. Our concern right now
is the people involved and their families, and we will say more when we can."
Do not: name the person, describe injuries, or discuss cause or fault.
2. DATA, SYSTEM, OR SECURITY INCIDENT
Internal: "We identified a problem with [system] at [time] and took it offline
while we check what was affected. [What this means for your work today.] I will
update you by [time], and please route any customer questions to [name] rather
than answering them yourself."
External, if asked: "We became aware of an issue affecting [system] on [date]
and took immediate steps to secure it. We are working with [our security
advisers] to determine exactly what was affected, and we will notify anyone
affected directly. The next update will be [when]."
Do not: guess how many records, guess the cause, or promise that nothing was
taken before anyone has looked.
3. UNPLANNED CLOSURE: WEATHER, UTILITY, OR BUILDING
Internal: "[Location] is closed [today / until further notice] because of
[reason]. Do not travel to the site. [What to do instead: work from home, report
to [alternate site], stand by.] Pay for scheduled hours is [being handled as
follows]. Next update at [time]."
External: "Our [location] is closed [today] because of [reason]. [What it means
for customers: appointments moved, orders delayed, phone lines redirected to
[number].] We expect to update you by [time]."
Do not: promise a reopening date the landlord or the utility has not given you.
4. THREAT, VIOLENCE, OR AN UNSAFE SITUATION
Immediate: "[Instruction first: leave the building by [exit], stay where you
are, do not come to [site].] Emergency services [have been called / are on
site]. Reply to this message so we know you are safe. Next update in [15]
minutes."
Follow-up: "Everyone has been accounted for as of [time]. [What is happening
now.] Support is available through [contact], and I will speak with each team
today. The next update is at [time]."
Do not: send the instruction after the explanation. Instruction first, always.
5. LEADERSHIP DEPARTURE OR A SERIOUS ALLEGATION
Internal: "[Name] is no longer with [Company Name] as of [date]. [Who is
covering the work, and who to go to in the meantime.] There are limits on what
I can share about an individual, and I will not speculate. I will hold time at
[time] to answer what I can."
External, if asked: "[Name] is no longer with the company. [Who now handles the
relationship.] We do not comment on personnel matters beyond that."
Do not: characterize the reason, hint at it, or let a week pass in silence.
6. THE SECOND UPDATE, WHEN THERE IS NOTHING NEW
"Update as promised at [time]. [What has changed, or: nothing has changed since
the last message.] The next update will be at [time]." An update with no news is
still an update, and it keeps the story yours.
WHAT WE NEVER SAY
•"No comment."
•Any estimate of cost, count, or cause before it is verified.
•The name of an employee, a customer, or a family member.
•"Nothing like this has ever happened here."
•A resolution time that depends on someone else.
DISCLAIMER: This is a sample template for general information only and is not
legal advice. Where an incident involves injury, personal data, or possible
legal exposure, have counsel review the wording before it goes out.
Template 4: Internal Announcement Sequence
The employees-first order: the all-staff message, a channel and an owner for every group with no company email, one page of manager talking points, an employee FAQ starter, and the follow-up checklist.
Internal Announcement Sequence (Employees First)
INTERNAL ANNOUNCEMENT SEQUENCE
[Company Name]
Owner: _ Target: everyone told within [60] minutes.
Employees hear it from you before they hear it from a customer, a neighbor, or
a group chat. This document is the order that makes that happen.
1. THE ALL-STAFF MESSAGE
Subject: [Plain description of what happened. Not "important announcement."]
•What happened, confirmed facts only.
•What it means for you today: your shift, your site, your systems, your pay.
•What we are doing about it right now.
•What we need from you, and what we are asking you not to do yet.
•When the next update comes, and from whom.
•Who to ask if you are worried: [name, cell].
Signed by a person, with their name. Not "Management."
Template 5: Spokesperson Brief and Media Response Kit
Designation with two levels of backup, an intake script for whoever picks up the phone, three key messages, bridging lines, on-the-record rules, and what to do on your social channels during an incident.
Spokesperson Brief and Media Response Kit
SPOKESPERSON BRIEF AND MEDIA RESPONSE KIT
[Company Name]
1. DESIGNATION
Spokesperson: __ Cell: _
Backup: __ Cell: _
If the incident involves the people above: __
Authority: may confirm [ ]. May not discuss cause, fault, personnel matters,
numbers, or anything under investigation without [counsel].
2. INQUIRY INTAKE, FOR WHOEVER TAKES THE CALL
Take these details and nothing else:
•Name, outlet or company, phone, email.
•Their deadline, exactly.
•What they asked, in their words.
•What they say they already know.
•Then: "Thank you. [Spokesperson] will call you back before [time]."
Do not answer the question, confirm anything, or say "no comment."
3. THREE KEY MESSAGES
One sentence each, written before you pick up the phone:
•Concern: [what this means for the people affected].
•Action: [what the company has already done].
•Next: [what happens next, and when you will know more].
4. BRIDGING LINES
•"What I can confirm right now is [ ]."
•"That is what the [investigation / assessment] will determine, and I am not
going to guess at it."
•"I do not have that yet. I will have more at [time], and I will call you."
•"I can tell you what we did in the first hour."
5. RULES
•Everything is on the record.
•Never say "no comment." Say what you can, say what you cannot, say when.
•Never repeat a hostile phrase in your answer. It becomes the quote.
•Return the call before the deadline, even when the answer is "nothing yet."
•One voice. Every inquiry goes to the spokesperson, including the friendly ones.
6. SOCIAL CHANNELS
Who may post during an incident: [ ] Approved by: [ ]
•Reply once, publicly, with the same three sentences.
•Move the conversation to [email or phone] after the first reply.
•Do not argue, and do not delete comments unless they violate [policy].
•Screenshot anything you would want later, before it disappears.
7. AFTER EVERY CALL
Log who called, what they asked, and what you said. The second call usually asks
the same question, and the answer has to match.
Spokesperson signature: __ Date: _
DISCLAIMER: This is a sample template for general information only and is not
legal advice. Statements about an injury, a data incident, or an allegation
involving an individual carry legal risk. Have counsel review before speaking.
Template 6: Crisis Communication Log (Spreadsheet)
Four tabs: a timestamped incident timeline, a notifications tab recording who was told and whether it was confirmed, an inquiry log, and debrief actions with owners and due dates. Pre-filled with a worked example you can clear.
Crisis Communication Log
A
B
C
D
E
F
1
Time
What happened or was decided
Who
How we know
Action taken
Notes
2
06:10
Landlord reported water coming through the second floor
M. Alvarez
Landlord phone call
Drove to the site to confirm
Building access restricted
3
06:40
Office confirmed unusable, power to the floor cut
M. Alvarez
On site
Declared Level 2
4
06:45
Escalation tree started
M. Alvarez
Three of four leads reached in nine minutes
One lead unreachable, backup called
5
07:05
Holding message sent to all staff
M. Alvarez
Remote work today, update promised at noon
Text list used for the field crew
6
08:30
Insurer notified and claim opened
D. Okafor
Carrier claims line
Claim number recorded
7
12:00
Second update sent as promised
M. Alvarez
No new facts, next update set for 5 p.m.
8
17:00
Reopening date confirmed for Thursday
Landlord
Landlord email
Update sent to staff, then customers
9
10
The First Hour, in Order
Employees first, then the people directly affected, then customers and partners, then anything public. The order matters more than the wording, because the fastest way to lose a team is to let them learn about their own company from a client who got the email at nine.
0 to 15 min
Safety, then the log
Confirm nobody is in danger and that emergency services have been called if they are needed. Start the log with a real clock time. Declare the level out loud so everyone knows the plan is running.
15 to 30 min
The tree, by phone
The escalation tree runs on calls, not posts. Every name confirms they reached the next name. If someone does not pick up inside five minutes, the backup gets called and the attempt goes in the log.
30 to 60 min
Employees, all of them
The holding statement goes to the whole team, including the people who have no company email and the ones on leave. Three sentences, signed by a person, with a promised time for the next update.
1 to 4 hours
The people directly affected
Customers with something at stake today, families where an injury is involved, the landlord, the insurer, counsel. Managers get their one page so the answers coming from the floor match the answers coming from you.
By end of day
The update you promised
Send it at the time you said, even when the only news is that there is none. The moment you miss a promised update is the moment people start believing the version they heard somewhere else.
Notice what is not in that sequence: waiting until you understand what happened. You will not understand it inside an hour, and the audience is not asking you to. They are asking whether anyone is hurt, whether they should come to work, and whether somebody is in charge.
That is what makes the three-sentence rule work. Confirmed facts, current action, next update time. The only promise you make is the one you fully control, which is when you will speak again. Miss that time and every message after it gets read as spin.
Do not say
Say instead
"No comment."
"Here is what I can confirm, and I will have more at 4 p.m."
A cause, before anyone has looked at it
What is confirmed, and what is still being checked
The name of the employee involved
The roles involved, with names kept out of it
"Nothing like this has ever happened here."
"We are treating it seriously, and here is the next step."
A resolution date that depends on a landlord or a vendor
The time of your next update, which depends only on you
The customer email, sent before staff are told
The all-staff message, then the customer calls, same hour
One structural detail is worth copying from the templates. When the message contains an instruction, the instruction goes first and the explanation second. People stop reading, and the sentence that keeps somebody out of a flooded building is not the one that explains the plumbing.
One Spokesperson, No Gag Rule
Name one spokesperson and one backup, and route outside inquiries to them. What you cannot do is tell employees they may not discuss the incident, or their working conditions, with each other, with a government agency, or publicly. That distinction is where most crisis templates quietly create a legal problem.
Who Speaks for the Company Is Not Who May Speak
The National Labor Relations Act protects employees who act together to raise concerns about wages, hours, and working conditions, including when they take those concerns outside the company, and it covers most private employers whether or not anyone is in a union (National Labor Relations Board, concerted activity). A rule saying that only the spokesperson speaks for the company is fine. A rule saying that employees may not discuss the incident is not. This is general information, not legal advice.
The practical wording is in the internal sequence template. Employees are told they can say they are not the person who speaks for the company and pass the contact along, and the message states plainly that nothing in it limits their rights. It takes one extra sentence and removes the risk entirely.
The other half of the spokesperson question is the backup, and it is not a formality. The designated speaker is unavailable exactly when the crisis involves them: an accident on the way to work, a health emergency, or an allegation about leadership. Write down a second and a third name, and give both of them the same brief.
Without a Communications Team
Every crisis communication plan written for a large company assumes a communications function, a legal department, and a rehearsed team. At fifteen or twenty people you have an owner with a phone. Three things go wrong, and they are the same three every time.
The plan is stored in the thing that is broken
A closed building and a system outage are both crises that take the plan down with them. Contact numbers sit in an email account nobody can reach, or in a phone directory that lives on the office network. Print the roster. Put a copy in someone’s car. It feels excessive right up until the morning you are standing in a parking lot trying to remember a cell number.
The one person who decides is the one person involved
At fifteen people the owner is the incident lead, the spokesperson, and usually the person with the landlord’s number. That works until the crisis is a car accident on the way to work, or an allegation about the owner. Every role in these templates has a backup for exactly that reason, and the backup needs to know they are the backup before anything happens.
Waiting for facts is the mistake that costs the most
The instinct is to say nothing until you know everything, which in practice means saying nothing for six hours while your team assembles a version from rumor. A holding statement is not a statement of fact, it is a statement of process: here is what is confirmed, here is what we are doing, here is when I will tell you more. That is available in the first ten minutes, and it is what buys the time to find out the rest.
The fix is smaller than the problem suggests. One printed page with the tree, five pre-written statements, and a rule that employees hear it first.
Plan vs Policy vs Emergency Action Plan
Four documents get treated as one, and then somebody produces an evacuation map and calls the crisis covered. They answer different questions and get opened at different moments.
Document
Answers
Written for
When you open it
Crisis communication plan
Who decides, who speaks, who hears what and in what order
The owner and the crisis team
In the first hour of an incident
Communication policy
The standing rules for everyday channels, tone, and response times
Every employee, signed at onboarding
Never, if it is doing its job
Emergency action plan
How people report an emergency, get out, and are accounted for
Everyone in the workplace
During the physical emergency itself
Business continuity plan
How the work keeps running while the site or the system is down
Operations
After the first hour, for days or weeks
The emergency action plan is the one with a federal rule attached, and it is worth knowing the shape of it before you assume your crisis plan covers the ground.
The OSHA Emergency Action Plan Requirement
Where the federal standard applies, an emergency action plan must be in writing, kept in the workplace, and available to employees, although an employer with 10 or fewer employees may communicate it orally. It has to cover reporting an emergency, evacuation and exit routes, employees who stay to run critical operations, accounting for everyone afterward, rescue and medical duties, and the name or job title of whoever can answer questions about it. That is a safety document. Keep it alongside your safety policy and your crisis communication plan, not merged into either.
Activate, Log, and Debrief
A plan is only worth the minutes it saves on the day, and those minutes come from four habits: naming who can activate it, running the hour in order, logging as it happens, and debriefing while people still remember. The log is the one people skip and later wish they had.
Name who can call it
Two people, by name, who can declare a crisis and start the plan without checking with anyone. A plan that needs a meeting before it activates does not activate.
Run the hour in order
Safety, log, tree, employees, affected parties, public. Skipping ahead to the customer email is what makes staff learn about their own company from a client.
Log while it happens
Times, decisions, who was told, what was said. Nobody reconstructs this accurately a week later, and the insurer, counsel, or agency will ask for exactly this.
Debrief and re-date
Inside a week, write down what went wrong as well as what worked, assign the fixes, then update the plan, the roster, and the statements and re-date them.
Keep the roster current, because it decays quietly. Every hire and every departure changes it, and a tree with three dead numbers is worse than no tree, since you find out which ones are dead at the moment you are relying on them. Verify the numbers on a schedule, and run one unannounced test call a year.
That upkeep is the part FirstHR helps with: employee profiles hold the current contacts and emergency contact details, the org chart shows who reports to whom when you are building the tree, document management stores the signed plan where you can find it, and the debrief fixes become assigned tasks with owners and due dates instead of notes from a meeting. FirstHR is an onboarding and HR platform, not a payroll provider, not a law firm, and not an emergency notification service, so pair it with counsel and with whatever mass-alerting you use. Applicant tracking is coming soon to FirstHR.
Key Takeaways
A crisis communication plan decides in advance who can declare a crisis, who speaks, who hears what, and in what order.
Employees hear it first, inside the first hour, including the people who have no company email and the ones on leave.
A holding statement is three sentences: what is confirmed, what you are doing, and when the next update comes.
Every role needs a named backup, because the person listed may be the person involved in the incident.
Print the escalation tree and keep a copy off site, because a closed building or a system outage takes down wherever you stored the plan.
Route media inquiries to one spokesperson, but never write a rule barring employees from discussing their working conditions.
Reporting deadlines run whether or not your message is ready, so keep them inside the plan. This is general information, not legal advice.
Frequently Asked Questions
What is a crisis communication plan?
A crisis communication plan is a written set of decisions made in advance about how a company communicates during an incident: who can declare a crisis, who speaks for the business, which audiences are told in what order, and what gets said before all the facts are known. It is not a public relations strategy and it is not the evacuation plan. Its whole purpose is to move hard decisions out of the worst hour of the year and into a calm afternoon, so that during the incident you are following a list rather than inventing one. For a small business the useful version is short: activation levels, a crisis team with a backup for every role, an audience order that puts employees first, pre-written holding statements, and a log.
What should a crisis communication plan include?
Sixteen decisions, in four groups. The trigger: what counts as a crisis here in plain words, severity levels with an owner for each, the two people who can declare one, and how fast the plan has to be running. The people: a crisis team with a named backup per role, the order audiences hear it in, verified cell numbers on paper, and the outside contacts for counsel, the insurer, the landlord, and any agency. The words: a holding statement for each likely scenario, one spokesperson and one backup, the channel used when the usual one is down, and a promised time for the next update. The close-out: a timestamped log kept during the incident, a debrief inside a week, fixes with owners and due dates, and a re-dated plan with a re-verified roster. The two most often missing are the backup for every role and the fallback channel, and both fail at the same moment.
Who should be the spokesperson at a small business?
The owner or the most senior person on site, with a named backup who knows they are the backup. Federal emergency planning guidance for businesses is direct about deciding who will speak to the media in advance and preparing that person with talking points, rather than sorting it out while the phone rings. In a company without a communications team that person is almost always the founder, which is fine, because credibility beats polish. What matters more is the second and third name on the list. If the incident involves the owner, is an accident on the way to work, or an allegation about leadership, the designated spokesperson is unavailable exactly when the company needs one. Write down both backups and give them the same brief.
What is a holding statement?
A holding statement is the short message you send in the first hour, before the facts are complete. Three sentences: what is confirmed right now, what the company is doing about it, and when the next update comes and from whom. It is a statement about process, not about cause, which is what makes it safe to send early. A good holding statement never speculates on cause, never names an individual, never estimates counts or costs, and never says no comment. The single promise it makes is the time of the next update, because that is the one thing entirely within your control. Write one for each likely scenario in advance, since composing a careful sentence is hard on the worst morning of the year.
Should employees or customers be told first?
Employees, in almost every case. The fastest way to lose your team is to let them find out about their own company from a customer, a neighbor, or a group chat, and once that happens the information they repeat comes from rumor rather than from you. Employees are also the people who have to answer the phone, so telling them last guarantees inconsistent answers going out for hours. The practical order is anyone in immediate danger first, then all employees inside the first hour, then customers or families directly affected, then suppliers and partners, then anything public. The exception is a safety or legal deadline that forces a different sequence, which is why the reporting clocks belong in the plan itself.
How is a crisis communication plan different from an emergency action plan?
They answer different questions and both are worth having. An emergency action plan is the OSHA document about physical safety: how people report an emergency, how they get out of the building, who stays behind to shut down critical operations, and how everyone is accounted for afterward. Under the federal standard it must be in writing and kept in the workplace, although an employer with 10 or fewer employees may communicate it orally. A crisis communication plan starts roughly where that ends: once people are safe, who decides this is a crisis, who speaks, who hears what, and in what order. A business continuity plan is a third document, covering how the work keeps running while the site or the system is down.
Can you tell employees not to talk about an incident?
Not broadly, no, and this is the trap in most crisis communication templates. Routing media inquiries to one spokesperson is legitimate, and so is asking people not to share names or unconfirmed details while families are being reached. What federal labor law does not allow is a rule that stops employees from discussing their pay, hours, or working conditions with each other, with a government agency, or publicly. The National Labor Relations Board treats employees acting together to raise concerns about working conditions as protected activity, and it covers most private employers whether or not anyone is in a union. Write the instruction as who speaks for the company, never as what employees may discuss, and have counsel review the wording.
Are these crisis communication plan templates free to download?
Yes. All six download free with no email form and no account: five as editable Word documents and one as an Excel workbook with four tabs. Taking all six at once gives you a single zip file with each template as its own file. Free does not mean finished, though. Fill in the brackets, put real cell numbers in the roster, delete the scenarios that do not apply to your business, and add the ones that do. Then print the escalation tree, because a closed building or a system outage takes down the place where you stored the plan, and those are the days you need it.
