Five things, agreed in writing before anything goes wrong: who decides, who speaks, what can be said before the facts are settled, who hears first, and when the plan gets rehearsed. Most companies do not have that document. Capterra's Crisis Communications Survey, conducted in January 2023 among 243 U.S. business leaders at director level or above, found that only 49% have a formal, documented crisis communication plan. Another 28% have an informal, undocumented one, and 23% have no plan at all or are not sure whether they do. Among leaders who had actually activated a plan, 98% said it was effective, and 77% said it was very effective.
That gap, between how few companies have a plan and how well the plan performs for those who do, is the whole case for writing one. This article covers what goes in it. It is about communication, not law. Regulatory notification duties vary by jurisdiction and by the kind of incident, and they are a question for qualified counsel, not for a communications team.
Why does a plan have to be written before anything happens?
Because the decisions a crisis demands are slow when made calmly and nearly impossible when made in a hurry by exhausted people with incomplete information. A plan does not predict the incident. It settles in advance the questions that otherwise eat the first critical hours: who has authority to approve a statement, who is permitted to talk to a reporter, and what the company can say while it still does not know the full picture.
Capterra's respondents who had been through a crisis were candid about what they got wrong. A full 84% said they would increase how much they practice the plan in advance, 78% would increase the tools used for communication, and 72% would broaden the plan's scope. Only 3% or fewer would decrease any of those.
There is also a trust argument. The 2026 Edelman Trust Barometer, based on nearly 34,000 respondents across 28 countries interviewed between October 23 and November 18, 2025, found that nearly seven in ten people fear institutional leaders are deliberately misleading the public. A company that goes silent, or that says something confident and then retracts it, confirms that suspicion. A company that explains what it knows, what it does not, and when it will say more is working against it.
What counts as a crisis for a startup?
Anything that could change what customers, investors, employees or regulators believe about the company faster than you can respond to it. Founders picture a hostile news story, but the trigger is more often operational. In Capterra's survey, cyberattacks accounted for 28% of the events that caused leaders to activate their plan and technology failures for another 22%. Workplace violence or threats made up 19%, health-related crises 16%, natural disasters 9%, and what respondents classified as PR crises just 6%.
A plan written only for the bad headline will therefore miss most of what actually happens. A breach communications plan is the cybersecurity-specific version of what this article describes. The same restraint applies in reverse when someone else is in crisis: tying your brand to a tragedy is the mistake that defines newsjacking done badly, and a company known for a measured crisis response is one that has learned not to make it. For a startup, the realistic list of scenarios usually includes a security incident, a prolonged outage, a product fault that affects customers, a senior departure or founder dispute, a regulatory inquiry, a layoff, and a critical story or viral complaint. Write a scenario card for each one you consider plausible.
Who decides, and who speaks?
Name them. In a crisis the expensive delays are almost never about wording. They are about nobody being certain who is allowed to approve the wording. The plan should name one executive who makes the final call on external statements, one deputy for when that person is unreachable, and one trained spokesperson. It should also state plainly that nobody else speaks to the press, to customers in an official capacity, or on social media about the incident.
Capterra asked companies with a formal plan which departments were involved in writing it. IT management was included most often, at 91%, followed by business operations at 83% and public relations at 81%. Human resources trailed far behind, and the open-text responses from leaders who had been through a crisis kept returning to the same gap: not knowing where staff were or how to reach them. For a startup, the room should include the founder or CEO, whoever runs engineering or operations, legal counsel, the communications lead, and whoever owns customer support, because support is where affected customers will turn up first, often before any public statement exists.
For a founder-led company the founder is usually the spokesperson for anything serious, which is a reason to get media-trained before the plan is ever needed rather than after.
What should you draft in advance?
Holding statements for each scenario card, written while calm and reviewed by counsel. They will not fit the real event exactly. That is fine. Editing a reviewed draft under pressure is a completely different task from writing from a blank page at two in the morning. Each holding statement should do four things: confirm what is known, state what is not yet known, describe what is being done, and commit to a time for the next update. Committing to the next update matters more than it looks, because it turns silence from an absence into a schedule.
Draft a short internal version too, saying what happened in plain terms, who is authorized to speak externally, and where to send any outside inquiry. A company whose own staff are guessing has lost control of its account of events.
Alongside the statements, the plan needs a contact tree that lives somewhere other than the company systems that may be down or compromised. Printed copies and personal phone numbers are unfashionable and they work. Add a pre-agreed coordination channel, a short list of the reporters who cover your sector, and counsel's guidance on which regulators or partners have notification rights.
Who hears first: customers, employees, or the press?
Affected customers should never learn about an incident from a news story, and employees should never learn about it from a customer. In practice that means the customer notification and the public statement are planned together, with the notification going first wherever the facts and any legal obligations allow. Employees are briefed at the same time or earlier. The press hears last, but not much later, because a reporter who learns of an incident from a customer and gets no answer from the company will write the story without you.
Edelman's finding that people trust their own employer at 78%, against 64% for business in general and 53% for government, is the reason this sequencing works. In a moment of doubt, people believe the institution closest to them. A company's employees and existing customers are the audience most inclined to extend it the benefit of the doubt, and the plan should treat them as the first audience rather than an afterthought.
How do you say "we do not know yet" without sounding evasive?
By being specific about what you do know and what you are doing to find out the rest. "We are aware of the issue and investigating" is evasive because it contains no information. "At 14:10 we detected unauthorized access to one internal system. We have isolated it, engaged an external forensic firm, and have no evidence so far that customer data was affected. We will publish an update by 18:00 whether or not we have new information" is credible because it is checkable.
Avoid estimating scope before it is established, avoid assigning blame, and avoid describing an attack as "sophisticated" unless an independent party has said so, because that word reads as deflection. Anything stated early that has to be retracted later costs more trust than the original incident usually did. Measuring what the coverage actually said afterwards, rather than how much of it there was, is the only honest test of whether the statements worked.
Sources: Capterra's January 2023 Crisis Communications Survey of 243 U.S. business leaders and the 2026 Edelman Trust Barometer, both linked in the article.
How often should you rehearse the plan?
At least once a year, and after any material change to the company. The single most consistent regret in Capterra's survey was not practicing enough. A tabletop exercise, where the named people walk through one scenario card and draft the actual statement, takes a morning and exposes every weak point: the deputy who did not know they were the deputy, the counsel who needs 48 hours to review two paragraphs, the contact list with three dead numbers.
For companies operating in the UAE and the wider Gulf, the rehearsal should also cover regional specifics: which Arabic-language and English-language outlets would cover the incident, whether the company's media licensing or sector regulator has its own expectations, and who on the team can speak to Arabic-language press. Edelman's 2026 Trust Index puts the UAE at 80, tied highest of the 28 countries surveyed, which cuts both ways. Trust is high, and the cost of visibly abusing it is correspondingly steep. How media coverage works in the UAE is different enough from the U.S. or UK that a plan written for one will not transfer cleanly to the other.
The relationships built in calm periods, as part of a broader PR strategy, are what make a reporter take the call in a bad one.
The direct answer, for anyone who read this far
Write down who decides, who speaks, what can be said before the facts are in, who hears first, and when you will rehearse. Draft holding statements for the five or six scenarios you can realistically foresee, have counsel review them now, keep a contact list that does not depend on your own systems, and run a tabletop exercise once a year. Fewer than half of companies have this document. Almost all of the ones who used theirs say it worked.
If you want help building or stress-testing a crisis communication plan for a company operating in the UAE or internationally, request a quotation and we will walk you through how we would approach it.
