What is a Crisis Communication Plan?
A crisis communication plan is a pre-approved plan that sets out who communicates on behalf of an organisation during a crisis, with which audiences, through which channels and within which deadlines, so that information flows quickly, accurately and consistently both internally and externally. The plan limits reputational damage and unrest, keeps employees, customers, supply-chain partners and regulators informed on time, and makes sure legal notifications do not fall through the cracks. In operational technology the plan carries extra weight: a cyber attack or failure in process control can directly affect drinking water, energy, safety or deliveries to customers.
A good crisis communication plan ensures that everyone knows what to say, when and to whom, even when email, the phone system and the intranet are themselves affected.
🧠 Why is a crisis communication plan important?
In a crisis, the first communication often shapes the story. Silence leaves room for rumour; communicating too quickly and carelessly forces corrections later and costs credibility.
| Reason | Explanation |
|---|---|
| Maintaining trust | Being open about what is known, what is not and what you are doing prevents rumour and panic |
| Speed of information | Inaccurate or delayed communication can amplify impact, as the panic buying after the Colonial Pipeline attack in May 2021 showed |
| Legal obligations | Notifications under the Dutch Cybersecurity Act, the AVG (GDPR) and the Wwke have fixed deadlines and must match what you say in public |
| Internal coordination | Spokespeople, executives, the CISO and operations tell one consistent story |
| Safety | Employees and local residents need to know what action is expected of them |
Crisis communication is also no longer optional. NIS2 explicitly lists crisis management as a mandatory measure in Article 21(2)(c), alongside business continuity, backup management and disaster recovery.
📋 What does a crisis communication plan contain?
| Element | Description |
|---|---|
| Goals and principles | Why the plan exists and which principles it rests on, such as honesty, clear and simple language and a single line of communication |
| Roles and responsibilities | Who does what? Spokesperson, communication manager, executives, IT, OT, legal counsel, HR |
| Escalation and activation criteria | When crisis communication starts and for which type of incident, linked to the Incident Response Plan |
| Key messages and templates | Pre-written holding statements and messages for scenarios such as ransomware, outages or data breaches |
| Audiences | Employees, customers, supply-chain partners, press, local residents, regulators, the CSIRT and the insurer |
| Communication channels | Email, intranet, telephone, text messages, press releases, social media, website, plus a fallback channel outside your own network |
| Coordination touchpoints | Fixed meeting cycles with the crisis team, for example every hour in the first phase |
| Monitoring | Following reactions in the press and on social media so that you can quickly correct rumours and inaccurate reports |
| Contact lists | Up-to-date numbers for the crisis team, suppliers, regulators and government, also on paper |
| Evaluation and adjustment | Post-crisis lessons, embedded in continuity management |
🔐 Which legal notifications affect crisis communication?
A crisis communication plan is not a notification procedure, but the two must fit together. What you report to the regulator must not contradict what you say in a press release.
| Regime | Who reports | To whom | Deadline |
|---|---|---|---|
| Cybersecurity Act reporting | Essential and important entities | CSIRT (usually the NCSC) and supervisory authority | 24 hours, 72 hours, final report within one month |
| AVG Articles 33 and 34 | Controller in case of a personal data breach | Dutch Data Protection Authority; data subjects too if the risk is high | Where feasible within 72 hours of discovery |
| Wwke | Designated critical entities | Competent authority | No later than 24 hours after becoming aware |
| Cyber Resilience Act | Manufacturers of products with digital elements | CSIRT and ENISA | From 11 September 2026, 24 hours for an early warning |
NIS2 Article 23 goes beyond reporting to government. Where appropriate, entities must also notify the recipients of their services without undue delay of significant incidents that are likely to affect service provision. In the event of a significant cyber threat, they must tell potentially affected recipients which measures they can take themselves. That makes customer communication a legal part of the response.
🏭 How does crisis communication work in an OT environment?
In OT, crises are often technical in nature but have direct physical or societal impact. That places specific demands on the message and the audiences.
| Scenario | Communication considerations |
|---|---|
| Disruption in SCADA or process automation | Internal and external explanation of cause, impact and expected recovery time |
| Ransomware that hits IT and halts production | Explaining why OT was shut down as a precaution, even if control systems were not infected |
| Data breach via an OT connection | Notification to the Data Protection Authority if personal data leaked, in addition to the Cybersecurity Act report to the CSIRT |
| Cyber attack on critical infrastructure | Coordinated response to media, citizens, regulators and government |
| Emergency in water, energy or chemicals | Coordination with the Dutch safety region (veiligheidsregio), municipality and supply-chain partners on what residents should do |
Three OT-specific points of attention:
- Out-of-band channels - in a ransomware attack, email, Teams and VoIP often fail at the same time. Define fallback channels such as mobile phones, an external messaging service and paper contact lists.
- Safety comes before reputation - for major-hazard sites, the Seveso III Directive already requires public information on safety measures and how to behave in a major accident. See Seveso and Cybersecurity.
- Technical translation - operators and engineers know the facts, communication staff know the audiences. Assign someone per shift who turns technical information into plain language.
If a disruption at a water or energy company affects public safety, the safety region provides public information on what residents should do, under the responsibility of the mayor or the chair of the safety region. The company remains responsible for communication about its own services. The plan therefore records how you connect with the safety region, who makes first contact and how you align messages in advance. See also Water Sector OT Security.
🧭 How do you build a crisis communication plan step by step?
- Map the scenarios - use the business impact analysis and risk assessment to select the five to ten most likely crises, from ransomware to fire and a supplier breach.
- Assign roles and deputies - one spokesperson, a communication manager in the crisis team and at least one deputy per role, including outside office hours.
- Write holding statements - short first messages you can publish without lengthy discussion. Many organisations aim to have a first message ready within the first hour after activation.
- Link to the reporting processes - record how the communication line connects to incident reporting, the GDPR notification and the Incident Response Plan.
- Arrange channels and fallbacks - including access to the website and social media if your own network goes down or accounts are taken over through social engineering.
- Exercise - run through the plan at least once a year in a tabletop exercise, with a cyber scenario that affects both IT and OT, and train spokespeople to give interviews under time pressure.
- Evaluate and update - after every exercise and incident, and whenever legislation, the organisation or contact details change.
As a guide for tone, many organisations use the six principles of the US CDC framework Crisis and Emergency Risk Communication: be first, be right, be credible, express empathy, promote action and show respect.
🏢 Which real-world example shows how it works?
The Norwegian aluminium group Norsk Hydro was hit by the LockerGoga ransomware on 19 March 2019. The company, with around 35,000 employees in 40 countries, switched to manual production wherever possible. Because its global network and its own website were down, Hydro used its Facebook page as its main communication channel. The company held press conferences with its chief financial officer, published an update on production capacity every working day and reported the attack to the police. That openness has since been widely cited as a model.
The contrast is NotPetya in June 2017, which among other things halted container terminals in the port of Rotterdam for days while customers and hauliers were left uncertain about the situation for a long time.
🔁 How does the plan relate to other plans?
| Plan | Relationship to crisis communication |
|---|---|
| Incident Response Plan | Technical response; the communication plan dovetails with it |
| Continuity management | What if primary processes fail, and how do you communicate about alternatives? |
| ISO 22301 | Requires documented procedures for warning and communication with interested parties and media in clause 8.4.3 |
| Security policy | Defines guidelines for information disclosure during security incidents |
| Governance | Determines who may communicate and how escalation flows |
❓ Frequently asked questions
Is a crisis communication plan mandatory?
A separate crisis communication plan is not literally required by law. However, NIS2 and the Dutch Cybersecurity Act do require essential and important entities to manage crises and to inform recipients of their services about significant incidents, and ISO 22301 requires documented communication procedures. In practice, a crisis communication plan is therefore the usual way to meet those requirements.
Who is responsible for crisis communication?
Ultimate responsibility for crisis communication lies with the executive board. Execution lies with a communication manager in the crisis team and one designated spokesperson, so the organisation speaks with one voice.
What is a holding statement?
A holding statement is a short, pre-written first message that acknowledges something is happening, says what the organisation is doing and when the next update will follow. It prevents silence in the first hours of a crisis while the facts are still being investigated.
How often should you exercise a crisis communication plan?
You should exercise a crisis communication plan at least once a year, preferably with a tabletop exercise in which IT, OT, communications and executives work through a realistic scenario together. Update the plan after every exercise and every real incident.
What is the difference between a crisis communication plan and an incident response plan?
An incident response plan describes the technical handling of a security incident: detection, containment, eradication and recovery. A crisis communication plan describes who says what to whom during that crisis. Both plans refer to each other and are exercised together.
How do you communicate when email and the network are down?
A crisis communication plan defines fallback channels that are independent of your own network, such as mobile phones, an external messaging service, an externally hosted emergency page and paper contact lists. In a ransomware attack, the normal channels are often unusable or can no longer be trusted.
📌 In summary
A crisis communication plan sets out in advance who says what to whom during a crisis, through which channels and within which deadlines. In IT/OT environments, the plan connects the technical response with legal notifications under the Dutch Cybersecurity Act, the GDPR and the Wwke, and with clear information for employees, customers and the surrounding area. Organisations that exercise the plan and arrange fallback channels keep trust, even when their own systems are down.