Last time, taking the law that comes into force in October 2026 as a starting point, we looked at why crisis communications struggles to move up the priority list. This time we finally get to the big picture: what exactly do you need to put in place?
When people hear "crisis communications," many picture how to run a press conference. In reality, the press conference is just one scene in a much larger story. What matters more is everything before and after it: the unglamorous but essential work of aligning views inside the company and making one decision after another.
Looking back on building a crisis communications manual at my previous job, I find that crisis communications breaks down into eight major decision points.
Crisis Communications Is Made Up of Eight Decision Points
In a crisis, these eight decision points are what matter for communications.
1. Define the purpose
Establish a shared understanding in advance of what you are preparing for and what outcome you want to create
2. Identify likely crises
List in advance the crises that could hit your company
3. Initial response
What to do in the first tens of minutes to few hours after an incident, and through which channels and people information is shared internally
4. Decide whether to disclose
Determine whether this is a matter that should be made public at all
5. Internal communication
Before going public, decide who inside the company to inform, what to tell them, and how
6. External disclosure
What exactly is communicated, through which channels, and by whom
7. Press conference
Whether to hold one, and if so, how to run it
8. Post-disclosure follow-up
Don't stop at the announcement; decide how you will rebuild trust afterward
Looking at this list, many people assume crisis communications is mainly about steps 4 to 7, the disclosure part. But once you actually start building your preparedness, steps 1 to 3 are the hard ones. Just getting the right people aligned on what crisis communications should be, including a shared level of understanding and mindset, is a real effort. Jumping straight to a "public statement template" without first articulating your likely crises simply does not work. Keep in mind that the act of preparing to prepare is itself a process that makes the company stronger.
Within this sequence, steps 3 (initial response) through 6 (external disclosure) in particular are where the team handling the situation on the ground (a technical response team if the crisis involves engineering, or legal, HR, and similar teams if it does not) and the PR team must work almost in parallel, looking at the same set of facts. No matter how precise the on-the-ground response is, trust cannot be protected unless it is translated into words the outside world can hear. Conversely, polished messaging that is not backed by substantive action will be seen through immediately.
I will go into the details of each step, such as how to build the manual and how to spell out concrete decision criteria, in the installments that follow. For now, it is enough to hold these eight points in your head as a map.
Crises Fall into Two Types: Those Involving Engineering and Those That Don't
When you think about step 2, identifying likely crises, there is one major fork to recognize from the start. Broadly speaking, crises come in two types.
- Crises involving engineering: system outages, service disruptions, security incidents, unauthorized access, data breaches, production line stoppages, hardware defects, and the like
- Crises not involving engineering: harassment and labor disputes, compliance violations, misconduct by executives or employees, disputes with business partners, business impact from natural disasters, and so on
The framework of eight decision points applies equally to both. The basic shape of preparedness, defining the purpose, identifying likely crises, deciding the initial response, does not change with the type of crisis.
That said, I imagine many of you reading this work close to engineering-related crises every day. The legal change we covered last time is only one of several triggers nudging companies toward preparing for engineering-related crises, and crisis communications itself is by no means limited to technical crises. But since we are here, this time I would like to dig a little deeper into engineering-related crises, the kind most directly connected to your work.
Patterns That Drive Public Outcry in Engineering-Related Crises
Whether you need a press conference is decided not by technical difficulty but by whether the public demands accountability. For engineering-related crises, how likely public opinion is to flare up can be organized along roughly the following lines.
- How many people are affected, and their level of technical literacy: an issue that stays contained among engineers and operators draws very different attention from one that directly affects ordinary consumers
- Whether the information is tied to individuals: a leak of personal data feeds directly into public anxiety, often out of proportion to its technical severity
- Whether it is perceived as deliberate: the same outage draws a very different public reaction depending on whether it looks like something close to force majeure or like human error or wrongdoing
- Doubts about the organization's own conduct: often it is not the incident itself but distrust of how it was handled, "were they hiding it?" or "why did it take so long?", that keeps the backlash going
Map the system outages, security incidents, production line stoppages, or product defects that could happen at your company against these four factors, and it becomes clear which risks to prepare for first.
Self-Check: Where Is Your Company Weak?
Try this quick self-check based on the eight points. It works regardless of the type of crisis.
- How many people in your company understand the purpose of crisis communications for your organization and can explain it in their own words?
- Have you ever drawn up a concrete list of the crises that could hit your company, covering both technical and non-technical scenarios?
- In the first 30 minutes of a crisis, is it already decided what information goes to whom, through which channels, and what happens next?
- Are there clear criteria for deciding what to disclose externally and what to keep internal, and is it clear who has the authority to make that call?
- Is there a mechanism to ensure information reaches employees before it is announced publicly?
- Are templates for press releases and public notices prepared in advance?
- Are there clear criteria for deciding whether to hold a press conference, and is it clear who has the authority to decide?
- Is it decided who owns the response after the announcement, including follow-up?
Any item you couldn't check off is a gap in your organization's preparedness. You don't need to close them all at once. A realistic approach is to start with the crisis most likely to hit your company and put each item into words, one at a time.
Coming Up Next
These eight decision points may look independent, but they are closely linked. In the next installment, I'll cover the practical work of writing manuals and designing drills that turn these eight points into a system that makes your company stronger. I'll share the lessons that only become visible once you actually do the work.