Keep the first statement short
Publish only confirmed facts, the action customers should take, and the time of the next update. Add detail after it has been verified.
Approach
A clear process for incident communications.
The details vary by incident, but the basic work is consistent: confirm the facts, assign owners, publish on a schedule, and keep each audience informed.
- 010-15 min
Set up the response
I join one working channel, name a communications lead, and start a log of facts, decisions, owners, and deadlines.
- Assign the communications lead
- Start the decision log
- Confirm who can approve public statements
- 02First hour
Publish the first update
I confirm what is known, write a short first statement, and give a time for the next update. I also list the audiences that need direct communication.
- Publish a verified first statement
- List customers, employees, press, regulators, and investors
- Assign an owner and channel to each audience
- 03Hours 1-24
Keep updates consistent
I publish on the stated schedule, even when there is little new information. Support, sales, leadership, and the press team all receive the same confirmed facts.
- Maintain the update schedule
- Give internal teams approved responses
- Track and answer press inquiries
- 04Days 2-7
Explain what happened
After service is restored, I help the technical team explain the cause, impact, and corrective work. Commitments are limited to work the company has approved and can complete.
- Draft the post-incident report with the technical team
- Confirm corrective actions and owners
- Follow up with customers and regulators
- 05Week 2+
Review and improve
I review the response, update the playbook and draft messages, and continue monitoring customer and press questions where needed.
- Review public response after the incident
- Update the playbook and message library
- Hold a leadership debrief
Principles
Six principles I follow.
I agree these principles with you before an incident so the team can make decisions quickly when one occurs.
Be clear about unknowns
State what is known, what is still being investigated, and when more information will be available.
Check facts with the technical team
Public statements should match the incident record. I review technical details with the people doing the investigation before publishing them.
Use legal review without legal jargon
Counsel reviews facts, obligations, and legal risk. The final message should still be clear to customers and employees.
Apologize directly
Say what happened, acknowledge the impact, and explain what the company is doing about it. Avoid conditional or vague apologies.
Assume internal messages may become public
Internal updates should be accurate, respectful, and consistent with what the company says externally.
Common mistakes
What to avoid during an incident.
These problems are easier to prevent with clear owners, approval paths, and an update schedule.
Waiting for complete information before saying anything
Publish the facts that have been verified and give a time for the next update.
Using legal language that customers cannot understand
Write a clear statement, then ask counsel to review it for accuracy and legal risk.
Telling employees after the press release
Tell employees before or at the same time as the public announcement, using consistent facts.
One long update, then nothing for six hours
Set an update schedule and keep it, including when there is no material change.
Letting the loudest channel set the response
List each audience, assign an owner, and choose the right channel for each one.
Editing the status page in place
Add timestamped updates and preserve the earlier entries.
On call, every hour of the year
Test the plan before an incident.
A live exercise shows whether your team knows who makes decisions, who approves statements, and how information moves between technical and communications teams.