How to Build a Crisis Communications Strategy from Scratch

When your company ends up on the news for its next (inevitable) data breach, will your company know what to say, who will do the “saying,” and how you plan to follow up with media requests? In other words, has your company learned to build a crisis communications strategy?

If your company is known for being quick to comment on important developments, the long minutes that it takes you to cobble together your response could be the difference between saving face and having the media spin your story in the worst way possible.

Today, the reputational fallout from cybersecurity and other disruptions is inevitable. And what you say and when you say it can impact everything from regulatory investigations and consumer claims to whether people decide to continue doing business with your brand, not to mention other knockoff impacts that can ultimately dig into your shareholder value and bottom line.

Having a crisis communications strategy should be a top priority for every business.

Here’s what you need to know if you’re learning to build a crisis communications strategy from scratch.

What’s the difference between a crisis communications strategy and a crisis communications plan?

There’s a lot of confusion among communications professionals and other stakeholders about what a crisis communications strategy really is. And also how it’s different from (1) the communications that occur during an actual crisis response and (2) the crisis response as a whole.

We think of a crisis communications plan as the “how-to” for communicating during an incident. This often includes things like:

• Who will do the communicating?
• What will they say and to whom?
• How do we write, draft, and manage those communications in advance and then get them approved and vetted within the organization?
• What communications channels are most important?
• How will our pre-approved communications be coordinated among internal and external stakeholders and across various channels?

While the crisis communications plan is centered on managing the organization’s reputation during a crisis–in fact, sometimes the organization’s reputation is the crisis itself—those plans are informed by an overarching crisis communications strategy. The goal of a crisis communications strategy is to create a process and approach for creating your tactically focused communications plans. And that strategy should also ideally align with your organization’s overall crisis management program.

Most crisis communications strategies will encompass things like:

• Developing a process to determine the menu of likely crises for which you need to prepare
• Creating a process and guidelines for preparing crisis messaging in advance
• Integrating your crisis communications strategy with your overall crisis response plans that more broadly address threats to life and safety, protecting critical assets, and quickly resuming operations
• Developing a lifecycle to exercise and improve your crisis communications plans over time.

Simply put, the communications strategy defines your process and approach to protecting the organization’s reputation, while the plan tells you how to do it.

Why a crisis communications plan isn’t enough?

A crisis response involves a lot more than just messaging. There’s an entire crisis response—and the overarching crisis management strategy that informs it—-that must be managed to get the business back up and running, continue operations, and ensure people are safe.  A crisis communication strategy helps ensure that both are coordinated and well-aligned.

For example, in a data breach incident, you not only need to develop messaging to assuage concerned clients and stakeholders. You also need to coordinate the timing and substance of your messaging to account for the bad actors’ demands and the additional damage they could do if you make a misstep. You must also coordinate with regulators and enforcement authorities to meet compliance objectives and prevent future incidents.

This goes far beyond what most communications professionals are prepared or able to do because they don’t have experience in these areas. As a result, having a crisis communications plan but no crisis communications strategy or thought process behind it can leave your organization susceptible to an infinitely higher degree of reputation harm.

4 Must-Haves for Learning to Build a Crisis Communications Strategy

1.   Alignment to the broader crisis management strategy

A lot of organizations mistakenly think that crisis communications and crisis management are one and the same.  But managing a crisis goes far beyond messaging and preserving the company’s reputation. It also involves planning for:

• How do we get our facilities back up and running?
• How do we take care of our team?
• How do we make sure our technology is working?
• How do we manage our compliance obligations?

Your crisis communications are just one small piece of a much larger crisis response that should ideally align with and be informed by a comprehensive crisis management strategy.  This will help ensure that your crisis communications plans well-support your broader crisis management objectives.

2.   Clearly established roles and responsibilities

One of the first steps in setting up any aspect of your resilience program is to clearly define and assign key roles and responsibilities. At a minimum, you should be clear on who owns the program within the organization and what they are expected to do as the program owner. It’s also important that you educate your board of directors about their roles and responsibilities, as well. Their support and prioritization of crisis management activities set the tone for how others in the organization will receive and participate in your program.

Other important roles might include human resources, legal, and communications and marketing, amongst others. Every business will have a different approach depending on its structure, resources, and needs. The important thing is that everyone is on the same page about who is responsible for what and when in executing your strategy and plans.

3.   A process for determining your key reputational risks

We often hear pushback from long-time communications professionals that you can’t write messaging in advance because every potential crisis situation is so different.

That’s simply not true.

Every business has the ability to quickly assess its most likely and most impactful reputational risks and then craft messaging around each potential situation. Creating an overarching crisis management plan can help you in this exercise.

For a technology company, the most likely disruption might involve a cyber attack or a data breach. If that technology involves payment or healthcare information, the fallout from a crisis could be severe. So at the very least, that company should have pre-prepared messaging around these types of incidents.

Every organization should be able to identify the top eight to ten things—whether a data breach, active shooter, weather event, fatality, executive malfeasance, among others—-that have the most potential to cause reputational harm. Your crisis communications strategy should include a plan for identifying these and preparing messaging in advance that can be quickly deployed in response to a crisis.

4.   A rapid response plan

Another common mistake that a lot of companies make is failing to build processes around crisis communications that enable them to move nimbly in response to a crisis.

Endless collaboration and frittering over the details of your communications response wastes precious time. If you don’t respond quickly and confidently, you open the door for the press and social media to spin your story however they want.

You need to have a rapid response plan for both developing your messaging in advance, monitoring what’s being said about your organization, and quickly deploying that messaging when needed.

If you’re starting to build a crisis communications strategy from scratch, Bryghtpath can help. Our free Crisis Communications 101 Course is designed to help people just like you understand everything they need to know to get started with crisis communications.

Want to work with us or learn more about Crisis Communications?

• Our proprietary Resiliency Diagnosis process is the perfect way to advance your program. Our thorough standards-based review culminates in a full report, maturity model scoring, and a clear set of recommendations for improvement.
• Our Crisis Communications services help you rapidly grow and mature your program to ensure your organization is prepared for the storms that lie ahead.
• Our free Crisis Communications 101 Introductory Course may help you with an introduction to the world of crisis communications – and help prepare your organization for your next disruption.
• Learn about our Free Resources, including articles, a resource library, white papers, reports, free introductory courses, webinars, and more.
• Set up an initial call with us to chat further about how we might be able to work together.