Why words cost more than the incident
A failure, an accident or an attack is an event; reputational damage is created by the reaction. Clients forgive incidents — they do not forgive lies, silence and chaos: a version that changes three times a day, staff learning news from the media, an official statement contradicted by screenshots. Systems recover in days; trust recovers in years.
The good news: the outcome is almost entirely determined by preparation, and preparation costs nothing — it is organizational work within existing salaries.
Five principles
- Speed beats completeness. First message within hours: «we know, we are investigating, next update at N». A pause gets filled by other people's versions.
- Never lie. You may withhold details; you may not say untruths — one caught lie devalues everything else.
- One voice. A single spokesperson and a single version across channels; everyone else knows where to redirect questions.
- Your people first. Staff hear the news before the press does — otherwise staff become the press's source.
- People before processes. First words are about the safety of people and client data, not about «divisions operating normally».
What to prepare in advance
- First-message templates for 5-7 scenarios: staff, clients, partners, media. In a crisis they get edited in 15 minutes instead of written from scratch.
- Answers to the ten hardest questions per scenario — agreed with legal in peacetime.
- A named spokesperson and deputy; the «who stays silent» rule: everyone else.
- Channels: how to physically reach staff and clients if corporate systems are down.
- A do-not-say list: admissions before investigation, promised deadlines, guesses about causes.
The first hours: sequence
Hour 0-1: fix the facts (what is known for certain), activate the team, stop unofficial comments. Hours 1-3: first staff message, first external message from the template, commit to the next update time. Then — updates at the promised time even when there is no news: «still working, next update 18:00». Update discipline is itself a signal of control. The full framework is in the crisis plan article; cyber specifics — in why companies hide cyberattacks.
Classic mistakes
«No comment». Reads as «we have something to hide» and hands the microphone to others. Legalese instead of human language. «Partial service degradation has occurred» instead of «we have an outage, we are fixing it, here is what to do». Premature promises. A missed recovery deadline is a second crisis on top of the first. Forgotten staff. The internal audience always matters more: they talk to your clients.
FAQ
Do we need a PR agency? Useful in an acute public crisis, but the templates, the spokesperson and the first hours are always yours — no agency arrives that fast.
Should we admit a cyberattack? A hidden attack that surfaces later hurts more than an admitted one: the lie is added to the damage. Many companies also carry legal notification duties.
How to train? Include the communications block in every exercise: the spokesperson writes a real message against the clock, and the team approves it under time pressure.