How to Build a Small Business Crisis Communication Plan
A crisis rarely waits for the right person to finish a meeting, find a password or approve a polished statement. A cyber incident, severe-weather closure, product problem, workplace emergency or major supplier outage can create questions from employees and customers within minutes.
A small business does not need a corporate communications department to respond responsibly. It needs a short, tested plan that says who communicates, which facts can be shared, how messages are approved, where updates appear and what happens if the normal tools are unavailable.
Ready.gov describes crisis communications as an important part of business preparedness. Its guidance recommends identifying internal and external audiences, creating contact information, establishing procedures and coordinating messages with the broader continuity plan. The CDC’s Crisis and Emergency Risk Communication material adds an essential principle: people process information differently under stress, so communication should be timely, credible, clear and actionable.
What a Crisis Communication Plan Covers
A crisis communication plan is not the same as an emergency response plan. The emergency plan focuses on protecting people and stabilizing operations. The communication plan focuses on getting accurate instructions and updates to the people affected.
It should connect with business continuity, cybersecurity incident response and leadership decision-making. For example, an IT team may isolate a compromised system while the communication owner prepares messages for employees and customers. Neither activity replaces the other.
At minimum, the plan should answer seven questions:
• What types of incidents activate the plan?
• Who can declare a communication response?
• Who owns the facts, the message and final approval?
• Which audiences need information?
• Which channels will be used if primary systems fail?
• How often will updates be issued?
• Where will decisions, versions and corrections be logged?
The CLEAR Framework
Use this original CLEAR framework to keep the plan simple enough to use.
Confirm: Verify the incident, its scope and the immediate safety instructions. Separate known facts from assumptions.
Lead: Name one communication lead and one backup. Assign subject-matter owners for operations, technology, safety, privacy and customer service.
Explain: Issue a short holding statement. Say what happened at the level that can be confirmed, what people should do and what is still being investigated.
Act: Deliver the message through the channels each audience actually uses. Monitor questions, misinformation and failed delivery.
Review: Set the next update time, correct errors openly and hold a post-incident review.
The framework creates a sequence. Teams should not publish unverified details merely to appear fast, but they also should not wait for complete certainty before giving essential safety or service instructions.
Step-by-Step Planning Process
Identify Scenarios and Audiences
Start with a small scenario list rather than trying to predict every possible crisis. Useful categories include physical emergencies, weather disruptions, cyber incidents, loss of a critical supplier, extended service outages and a serious allegation that affects trust.
For each scenario, list audiences in priority order. Employees and people in immediate danger come first. Customers, suppliers, landlords, regulators, insurers, media and the wider public may follow depending on the event.
Create an audience map with four fields: what this group needs to know, what action it should take, which channel reaches it and who owns the relationship. An employee may need evacuation or remote-work instructions. A customer may need to know whether a service is available and whether any data may be affected. A supplier may need a revised delivery point.
Do not promise legal notifications through a generic template. Privacy, workplace and consumer-notification duties vary by location and incident. Get qualified advice where required.
Assign Roles and Approval Authority
Small teams often fail because everyone assumes the owner will handle every decision. Write down primary and backup roles.
The incident lead coordinates the overall response. The communication lead drafts and distributes messages. A fact owner verifies operational details. A technical or safety specialist checks instructions. An approver authorizes release. A monitoring owner tracks questions and corrections.
Define an emergency approval rule. For example, the communication lead may publish pre-approved safety instructions immediately, while customer-impact or legal statements require the incident lead plus the relevant specialist.
Keep the chain short. If five people must approve a two-sentence closure notice, the plan is unlikely to work under pressure.
Build Message Templates
A holding statement buys time without pretending the organization has every answer. Use this structure:
“We are responding to [confirmed incident or disruption]. Our current priority is [safety, service restoration or investigation]. At this time, we have confirmed [verified facts]. [Audience] should [specific action]. We are still investigating [known uncertainty]. The next update will be posted at [channel] by [time].”
Prepare separate versions for employees, customers, the website, social channels and direct partner messages. The facts should remain consistent, but the action requested may differ.
Avoid speculation, blame and absolute assurances. “No data was affected” is unsafe if the investigation is incomplete. A more accurate statement is: “We have not confirmed whether customer data was affected; the investigation is continuing.”
Prepare Backup Channels
A cyber incident may disable email. A power outage may affect the office network. A damaged phone may contain the only administrator login. List at least one backup route for every important audience.
Possible channels include a status page hosted separately from the main website, SMS, a phone tree, a recorded hotline, an alternate email account and a pre-authorized social account. Store critical contact lists securely in both accessible digital form and a controlled offline copy.
Backups must respect privacy. Do not expose employee personal numbers to a public group or place sensitive incident data in an unsecured messaging channel.
Set the Update Rhythm
People fill an information vacuum with guesses. The first message should include a time for the next update, even if that update will only say the investigation continues.
Choose an initial rhythm by severity. A fast-moving safety event may require updates every 15 to 30 minutes. A significant outage may use hourly updates. A slower recovery may move to daily summaries.
Update timing is a commitment. If the team cannot provide new facts, it can still confirm what remains unchanged, repeat the current action and give a revised next-update time.
Copyable Crisis Communication Plan Template
Plan owner:
Backup owner:
Last reviewed:
Next exercise date:
Activation scenarios:
1.
2.
3.
Incident lead:
Communication lead:
Fact owners:
Final approver:
Emergency publishing authority:
Audience | Need | Channel | Owner | Backup channel
Employees |
Customers |
Suppliers |
Regulators or authorities |
Media or public |
Primary status location:
Backup status location:
Employee alert method:
Customer support script location:
Secure contact-list location:
First-message template:
We are responding to ____. Our priority is ____. We have confirmed ____. Please ____. We are investigating ____. The next update will appear at ____ by ____.
Correction template:
Our earlier update stated ____. That information was incomplete or incorrect. The confirmed position is ____. We have updated our records and will provide the next update by ____.
Closure template:
The incident that began at ____ has been ____. Normal service will resume at ____. Customers or employees who experienced ____ should ____. We will review the response and share any necessary follow-up.
Decision log fields:
Time, source of fact, decision, approver, message version, channels used and correction required.
Run a 45-Minute Tabletop Exercise
CISA provides tabletop exercise resources because discussion-based exercises reveal gaps before a real incident. A small business can run a simple version in 45 minutes.
Minutes 0–5: Present a scenario. Example: the online ordering system is unavailable and the team suspects unauthorized access.
Minutes 5–15: Ask who activates the plan, who verifies facts and which audiences need an immediate message.
Minutes 15–25: Draft the first employee and customer updates. Confirm that the statements distinguish facts from uncertainty.
Minutes 25–35: Remove a normal tool from the exercise. Assume email or the website is unavailable and use the backup channel.
Minutes 35–45: List the gaps. Assign an owner and deadline for each fix.
Score the exercise across six items: contact list worked, backup owner was available, facts were verified, first message was actionable, backup channel worked and decisions were logged. One point per item creates a practical readiness score from zero to six. A low score is not a failure; it identifies what to repair.
Common Mistakes
Waiting for complete certainty is the first mistake. Teams can communicate confirmed safety instructions and acknowledge uncertainty without speculating.
Using one message for every audience is another. Employees, customers and suppliers usually need different actions.
Overpromising creates avoidable damage. Do not guarantee a restoration time, deny an unconfirmed breach or describe an event as minor before the facts support that wording.
Ignoring accessibility and language needs can exclude affected people. Use plain language, short sentences, readable formatting and translated or alternate formats where the audience requires them.
Failing to record versions makes corrections difficult. Keep a decision and message log so the team knows what was published, when and on whose authority.
Finally, a document that has never been exercised is only a draft. Contacts change, passwords expire and people discover that their backup role was never explained.
Frequently Asked Questions
How long should a small-business crisis communication plan be?
The working plan should be short enough to use under pressure. A concise core plan of several pages can link to contact lists, scripts and technical procedures stored separately.
Who should speak for the company?
Name a primary spokesperson and backup. The right person depends on the incident, but messages should come through a coordinated process rather than several employees publishing conflicting facts.
Should a business respond to every social-media comment?
No. Monitor for urgent questions and harmful misinformation, publish confirmed updates in a central location and avoid arguing. Preserve evidence of threats or abuse and escalate through the appropriate platform or authorities.
How often should the plan be tested?
Test after major staff, tool or supplier changes and on a regular schedule. A small tabletop exercise every six months is a practical starting point, but higher-risk organizations may need more frequent exercises.
Does this replace legal or emergency advice?
No. Call emergency services for immediate danger and use qualified legal, safety, privacy or technical professionals when the incident requires them.
Maintain a Single Source of Truth
During a disruption, conflicting drafts can become a second crisis. Choose one internal record as the current source of truth. It may be a controlled incident log, a secure collaboration page or a document available to the response team. Record the latest confirmed facts, current instructions, approved wording, message owners and next-update deadline.
Assign version numbers or timestamps to public updates. Customer-service staff should receive the current approved response rather than rewriting it independently. If a message changes, archive the previous version instead of deleting it. This makes it easier to explain corrections and review decisions later.
Access should follow need. The full incident record may contain personal, security or legally sensitive information that should not appear in a public statement. Maintain a separate approved-facts section that communicators can use without exposing restricted evidence.
Also decide where the public will find the authoritative update. A dedicated status page is often easier to maintain than scattered social posts. Other channels can point back to that page. If the main site becomes unavailable, the documented backup location takes over.
After the incident, preserve the decision log according to the organization’s records policy and any applicable professional advice. Then convert lessons into specific changes: update a contact, shorten an approval step, add a translation, repair a backup login or revise a template. A review is useful only when it changes the next response.
ORIGINAL ELEMENT
CLEAR framework, six-point exercise score and the copyable communication plan provide a usable system beyond a source summary.
