Quick Check: Your current posture

• Tell me briefly about the most recent incident your team managed, including timing and outcome.
• How often do incidents that require an immediate communications response occur for your organization? Options: Multiple times a year, Quarterly, A few times a year, Rarely, Never
• Which of these issue types has your team handled in the last two years? Options: Data breach or leak, Whistleblower or employee allegation, Regulatory subpoena or inspection, Executive misconduct allegation, Operational incident (safety, outage), Environmental or site event, Activist or investor campaign, Other
• Describe who typically rings the alarm first inside your organization and how that alert reaches you.
• Estimate the typical time from first alert to a leadership communications decision in your last three incidents. Options: Under 1 hour, 1-3 hours, 3-12 hours, 12-24 hours, More than 24 hours
• When you think back to your last response, what felt like the single biggest communications mistake and why?

Where pressure peaks

• Name the one misstep in past incidents that cost you the most stakeholder trust.
• Who outside the executive team has the authority to demand disclosure or a public statement during an active event? Options: General counsel, Board chair or representative, Regulatory affairs lead, External counsel, Investor relations lead, None, Other
• How many external channels—media outlets, social platforms, regulators—typically start reporting within the first 24 hours for incidents like yours? Options: 0-2, 3-5, 6-10, More than 10, Unsure
• Describe the legal or regulatory constraints that have forced you to withhold or delay communications in past events.
• If a regulator subpoena or law enforcement request arrived during a public response, what immediate action would stop the communications plan?

People, power, and approvals

• Tell me why your current approval path would survive an incident that requires a same-day public statement.
• Which roles are always included in crisis calls and which are optional? Options: General counsel, Chief communications officer, CEO or president, Head of security or IT, Head of HR, Head of operations, Board representative, External counsel, Regulatory liaison, Other
• Who is the single final approver for any public messaging, and under what circumstances can that change?
• List the documents or legal signoffs you must have before a statement goes live.
• Rate the readiness of those approvers to convene within two hours during off-hours. Options: Always ready within 2 hours, Usually within 4 hours, Needs a business day, Needs multiple days, Unavailable off-hours
• What single legal or board-level condition would prevent you from authorizing a media response even if leadership wanted to speak?

Operational readiness and gating factors

• Explain which internal systems, data sources, or monitoring feeds must be available before a partner can run your monitoring and distribution playbook.
• Name the third-party systems that would need to connect to monitoring, distribution, or reporting tools for this engagement to work.
• Identify which team owns API access, credentials, or vendor relationships the partner would need to operate effectively.
• Estimate the headcount or FTE time your team can dedicate to onboarding and daily coordination during a 30-day engagement. Options: <0.5 FTE, 0.5-1 FTE, 1-3 FTE, 3-5 FTE, More than 5 FTE
• Are there regulatory approvals, board notifications, or legal clearances that could push initial availability beyond 72 hours? Options: Yes, regulatory approvals required, Yes, board or executive approvals required, No, none beyond routine reviews, Unsure
• If those systems or approvals are not in place, can your team commit to setting them up within four weeks to meet a go-live window? Options: Yes, No, Only with seller support, Need more information

Other paths you're weighing

• List the alternatives you are actively evaluating, including internal options, your incumbent provider, and other firms.
• For each alternative, explain the condition under which you would stick with it instead of changing.
• Has anyone on your team proposed solving monitoring and rapid response internally, and if so who would lead that effort? Options: Yes, proposed and launched, Yes, proposed but not launched, No, not proposed, Unsure
• Select the factors that would make you choose to stay with your current approach. Options: Lower cost, Faster activation, Existing relationships, Greater perceived control, Cultural fit with internal teams, Compliance continuity, Other
• Suppose an external partner guaranteed named senior counselor availability within two hours, name the internal barrier that would still prevent you from engaging them.

What success looks like under pressure

• Assume we had 48 hours to show measurable progress, outline the three metrics you would expect to move first.
• Provide target thresholds for media sentiment, executive visibility, and employee communications engagement you would consider acceptable after one week.
• Identify the decision-maker who will sign off on those thresholds and explain how they balance speed against legal exposure.
• When would you expect a partner to deliver a written after-action summary, and who on your team must receive it? Options: Within 48 hours, Within 1 week, Within 2 weeks, Within a month, Other
• Suppose a pilot shows the promised reduction in misinformation spread, which of the following would speed your internal approval to retain the partner? Options: Executive sign-off, Legal clearance, Budget approval, Acceptable contract terms, Nothing else, ready to sign

Next steps and deal accelerators

• Point to the one internal decision that, if approved this week, would let you sign a contract within 10 days.
• Indicate the role that controls the budget for this engagement. Options: CFO or finance lead, Head of procurement, Business unit owner, CEO or president, General counsel, Other
• Are there procurement steps, security reviews, or vendor onboarding checks that typically extend contracting beyond your target window? Options: Yes, always, Sometimes, Rarely, No, Unsure
• Outline the minimal SLA, retainer, or response-time commitments you require to move forward.
• Assuming the seller named the senior counselor you need and committed to a 24-hour start, would there be any other barrier to you signing within the month? Options: Yes, No, Possibly with changes, Need clarifying information

• Scenario Walkthrough and Tabletop Session

• Confirm the current state and its cost to your team
• You confirm the demonstrated workflow removes the approval bottlenecks that currently delay statements.
• Deliver a tailored scenario playbook draft mapping approvals, templates, and a 48-hour on-call roster within 48 hours.
• You confirm the named approvers, spokesperson roster, and escalation thresholds reflect your decision authorities.
• Run a live buyer-context scenario walkthrough
• Provide the definitive list of legal approvers, spokesperson candidates, and their contact availability windows.
• You agree the seller will produce a tailored scenario playbook and a simulation schedule that will serve as final proof points toward engagement.
• Validate approval flows and spokesperson controls
• Share any existing crisis templates, recent media sensitivities, and regulatory reporting deadlines relevant to the scenario.
• Draft and test the initial holding statement and channel actions
• Run a 60-minute simulation with the identified approvers within the next 7 days to validate the playbook under time pressure.
• Confirm the future state and remaining evidence

• Scenario Walkthrough and Tabletop Session
• Scenario Walkthrough Deck
• Scenario Walkthrough Brief

• meeting
• slides
• document

• Scenario Selection and Exercise Planning
• Tabletop Walkthrough, Scenario A
• Simulated Press Conference and Media Q&A Rehearsal
• Stakeholder Rehearsal and Approval Workflow Test
• Playbook Update, Readiness Decision, and Next Steps

• Update the playbook sign-off workflow with SLA timings and escalation steps based on the timed rehearsal results.
• Compile a short practice plan for the spokesperson addressing identified delivery issues.
• Recap scenario and key messages
• A validated sign-off workflow with SLAs for each approver role and a list of edits required to meet timing targets.
• Completed draft internal FAQ and regulator response templates ready for insertion into the playbook.
• A list of required contact detail updates and escalation paths for the stakeholder roster.
• Confirm scope and success criteria
• Publish the internal FAQ and regulator response templates as draft artifacts for final legal review.
• Produce an updated stakeholder contact list and escalation matrix with preferred contact methods and backup contacts.
• Review consolidated changes and artifacts
• A versioned playbook approved for use during incidents with a published change log of what changed.
• Named owners and an on-call schedule documented and accepted for the agreed readiness period.
• A documented readiness decision, or a clear remediation plan with owners and deadlines if not yet ready.
• Publish the versioned playbook with a change log and distribute to the stakeholder roster.
• Schedule and publish the on-call rotations and handoff procedures for the next 90 days.
• Activate the agreed monitoring feeds and set the first incident report cadence with templates.
• A prioritized list of 1 to 3 scenarios with severity tiers and inject points agreed for the working sessions.
• A signed exercise plan including participant roles, schedule, and success criteria for each scenario.
• A logistics checklist for running simulations, including recording and documentation assignments.
• Draft scenario scripts for each agreed scenario including timeline, initial facts, and three injects.
• Produce participant role list and contact availability windows for the scheduled exercises.
• Prepare exercise logistics pack including platform access, recording permissions, and note templates.
• Brief recap of scenario facts and objectives
• A documented incident timeline with each decision point mapped to required approver roles and expected time-to-decision.
• A prioritized gap list with proposed mitigation options for each gap.
• A list of evidence and data feeds needed at each decision point to avoid delays.
• Produce a mapped decision flow diagram showing approver roles, handoff points, and SLA timings for decisions.
• Document the prioritized gap list and proposed mitigation options for playbook updates.
• Compile the list of data sources and monitoring feeds required for each critical decision point.
• Exercise objectives and scoring criteria
• A rehearsal-scored, revised statement draft ready for inclusion in the playbook.
• A populated Q&A response library with graded risk levels and escalation rules for high-risk questions.
• A list of performance improvements for the spokesperson with time-boxed practice items.
• Produce the final statement draft and mark any legal caveats or factual checks required before public release.
• Create the Q&A response set with suggested phrasing, fallback lines, and escalation triggers for out-of-scope questions.
• Select priority scenarios and severity tiers
• Simulate approval workflow under timed conditions
• Confirm owners and on-call coverage
• Deliver mock opening statement
• Walkthrough of the incident response timeline
• Role-play regulator and employee inquiries
• Role-play press Q&A
• Set monitoring, reporting, and escalation endpoints
• Identify required participants and roles
• Identify decision triggers, approvals, and maximum response times
• Agree exercise format, timeline, and logistics
• Formal readiness decision and next steps
• Capture gaps and mitigation options
• Immediate critique and message refinement
• Finalize internal FAQ and regulator response templates

• 24/7 Crisis Hotline and Rapid Response
• Draft Initial Holding Statement
• Draft Regulator Disclosure Messaging
• Draft Customer and Partner Notifications
• Draft Employee Memo and FAQs
• Real-Time Media Monitoring and Social Listening
• Message Map and Q&A Package
• Simulated Press Conference and Spokesperson Coaching
• Press Release Drafting and Distribution Support
• On-Call Media Relations and Journalist Outreach
• Social Media Rapid Response and Post Management
• Legal Clearance and Redline of Public Statements
• Localize Statements and Translations

24/7 Crisis Hotline and Rapid Response

• Do you need 24/7 phone hotline coverage for initial triage of incidents (voice and voicemail-to-email)? Options: Yes, No
• How quickly must we answer an inbound hotline call for initial triage and escalation (for example within 30 minutes, 60 minutes)? Options: Within 15 minutes, Within 30 minutes, Within 60 minutes, Within 2 hours
• Which members of your incident response roster should receive hotline escalations (for example general counsel, chief communications officer, head of security)? Options: General counsel, Chief communications officer, Head of security, Head of IT/IR, Other
• Who is the primary authorized contact we may call and who can approve immediate external messaging from your side?
• Are there specific jurisdictions or notification regimes (for example GDPR data protection authority, SEC, state breach-notification laws) that change hotline escalation workflows? Options: Yes, No
• Confirm whether the acceptance criterion for this module is that a senior counselor answers the hotline and documents an initial triage note within the selected SLA. Options: Accept as stated, Request different SLA, Require pilot/test call

Draft Initial Holding Statement

• Do you want separate holding statement drafts for media, regulators, and employees or a single universal holding statement? Options: Separate for media, regulators, employees, Single universal holding statement, Start with one and expand as needed
• Provide the critical facts we are permitted to include in the holding statement (for example confirmed affected systems, number of impacted records, immediate containment steps).
• Which legal constraints should we observe when drafting the holding statement (for example pending litigation, securities disclosure windows, nondisclosure agreements)? Options: Pending litigation, Securities disclosure rules, Nondisclosure constraints, Other
• Who on your side must pre-clear the holding statement before distribution (for example lead counsel, chief communications officer, CEO)? Options: Lead counsel, Chief communications officer, CEO, Other
• When should the holding statement be issued relative to incident discovery (for example within 1 hour, within 4 hours, same business day)? Options: Within 1 hour, Within 4 hours, Same business day, Only after legal sign-off
• Do you require a short-form headline holding statement optimized for social posts in addition to a long-form release for owned channels? Options: Yes, No

Draft Regulator Disclosure Messaging

• Which regulators or reporting regimes will likely require notification in an incident (for example data protection authority, industry regulator, securities regulator)? Options: Data protection authority, Industry regulator, Securities regulator, State regulators, Other
• Describe the disclosure triggers your legal team uses that would require regulator messaging (for example confirmed exfiltration of >10,000 records, material impact on operations, regulatory subpoena).
• Who prepares the technical factual appendix for regulator submissions (for example your internal incident response team, external forensic vendor, or both)? Options: Internal incident response team, External forensic vendor, Both, Other
• Do you need templated regulator disclosure language for specific jurisdictions and formats (for example CSV of affected records, formal cover letter for data protection authority)? Options: Yes, No
• How quickly must regulator disclosure messaging be ready after the trigger event (for example within 24 hours, 48 hours, as counsel directs)? Options: Within 24 hours, Within 48 hours, As counsel directs
• Are there mandatory data fields or formats regulators require that we must include in messaging (for example incident classification codes, affected user counts, remediation timelines)? Options: Yes, No

Draft Customer and Partner Notifications

• Which customer or partner segments need separate notification templates (for example enterprise customers, SMB clients, resellers, channel partners)? Options: Enterprise customers, SMB clients, Resellers, Channel partners, All of the above
• Provide the content tiers you expect for customer notifications (for example immediate holding message, technical details for IT contacts, remediation steps, offers of credit).
• Do you require API or CRM integration to push notifications directly from your customer database (for example integration with your CRM export or email platform)? Options: Yes, No
• How will recipient lists be authenticated and verified prior to distribution (for example CRM export with verification, hashed email lists, OTP confirmation)?
• When do you intend to send customer notifications relative to regulator filings (for example before regulator disclosure, simultaneous, after legal sign-off)? Options: Before regulator disclosure, Simultaneous with regulator disclosure, After legal sign-off
• Which success metric will validate a customer notification deployment (for example delivery rate >95%, open rate >30%, acknowledgement from priority customers)? Options: Delivery rate threshold, Open/click rate, Acknowledgement from priority customers, Other

Draft Employee Memo and FAQs

• Which employee populations need tailored memos and FAQs (for example frontline staff, remote employees, contractors, unionized workers)? Options: Frontline staff, Remote employees, Contractors, Unionized workers, All of the above
• Provide the permitted level of technical detail for employee memos (for example high-level reassurance, system-specific remediation steps, or detailed incident timelines).
• Do you want a manager-facing FAQ with scripted answers for difficult questions and escalation paths for HR? Options: Yes, No
• Who will manage internal distribution channels and which channels do you use (for example corporate email, intranet, Slack or Microsoft Teams)? Options: Corporate email, Intranet, Slack/Microsoft Teams, All of the above, Other
• When should employee communications be sequenced relative to public statements and customer notifications (for example before public statement, simultaneous, after customers)? Options: Before public statement, Simultaneous with public statement, After customer notifications
• Are there HR or union review steps that must occur before an employee memo is distributed (for example HR sign-off, union notification period)? Options: Yes, No

Real-Time Media Monitoring and Social Listening

• Which specific media outlets and journalist beats must be included in monitoring (for example national business press, cybersecurity reporters, key local outlets)?
• Which social platforms require active listening and moderation during the incident (for example Twitter/X, LinkedIn, Facebook, Reddit, Telegram)? Options: Twitter/X, LinkedIn, Facebook, Reddit, Telegram, Other
• How frequently do you require live monitoring reports during active response (for example every 15 minutes, hourly, four-hour digest)? Options: Every 15 minutes, Hourly, Four-hour digest, Daily summary
• What alert thresholds should trigger an escalation to the response team (for example 20% spike in negative mentions, a post with >10,000 engagements)?
• Do you require sentiment analysis and a share-of-voice comparison against named competitors or sector peers during the incident? Options: Yes, No
• Will you provide access to existing paid monitoring feeds or do you need us to provision paid vendor dashboards for media clipping and social listening? Options: You will provide access to paid feeds, You need us to provision paid feeds, Hybrid

Message Map and Q&A Package

• Which external and internal audiences must be mapped with priority messages (for example customers, regulators, employees, investors)? Options: Customers, Regulators, Employees, Investors, Partners, All of the above
• Provide up to three priority messages you want emphasized in the message map (for example containment complete, notification issued, remediation underway).
• Do you require a legal-approved Q&A with scripted lines for common media and regulator questions (for example scope of breach, number of affected users, remediation timeline)? Options: Yes, No
• Who must sign off on the final message map and Q&A package (for example in-house counsel and chief communications officer)? Options: In-house counsel, Chief communications officer, CEO, External counsel, Other
• Confirm the acceptance criteria for the message map: sign-off by your legal counsel and chief communications officer and delivery of editable source files. Options: Accept criteria, Request modifications, Require pilot review
• Which file format do you prefer for the message map and Q&A deliverable (for example slide deck, editable Word document, Google Doc)? Options: Slide deck, Editable Word document, Google Doc, Other

Simulated Press Conference and Spokesperson Coaching

• Which named spokespersons require coaching and in what priority order (for example CEO for major statements, chief communications officer for media briefings)?
• Do you require a full simulated press conference with live journalists, a closed-room tabletop rehearsal, or both? Options: Full simulated press conference with live journalists, Closed-room tabletop rehearsal, Both
• How long should each simulation or coaching session run (for example 60 minutes, two hours, half-day)? Options: 60 minutes, 2 hours, Half-day, Full day
• Are there specific tough topics you want rehearsed during coaching (for example regulatory penalties, scope of data exposure, executive accountability)? Options: Yes, No
• Who will provide the factual brief and incident timeline used in simulations (for example internal incident lead, external forensic vendor)? Options: Internal incident lead, External forensic vendor, Both
• Do you want video recording of spokesperson rehearsals and an annotated critique with improvement actions? Options: Yes, No

Press Release Drafting and Distribution Support

• Which distribution channels should we use for press release distribution (for example wire services, owned website press room, partner channels)? Options: Wire service, Owned press room, Partner channels, Direct email to journalists, All of the above
• Do you require embargoed distribution to select reporters before public release under agreed terms? Options: Yes, No
• Which approved media contact list will we use for distribution and will you provide the verified media list or require us to build one? Options: You will provide an approved media list, We will build the media list, Hybrid
• What localization or regional variant needs exist for press releases (for example market-specific statements, translated versions for LATAM or APAC)? Options: Region-specific variants, Translations required, None
• How will you measure distribution success for press releases (for example pickup count, share-of-voice, syndication on top-tier outlets)? Options: Pickup count, Share-of-voice, Top-tier syndication, Other
• Do you require post-distribution clipping and media impact reports bundled with the press release delivery? Options: Yes, No

On-Call Media Relations and Journalist Outreach

• Which journalist beats and specific reporters should receive proactive outreach during the incident (for example national business editors, cybersecurity reporters)?
• Who will be authorized to go on-the-record for interviews and who is reserve spokesperson (for example named CEO, CCO, head of security)? Options: CEO, Chief communications officer, Head of security, Other
• Do you want pitch templates and embargo scripts prepared for outreach to priority reporters? Options: Yes, No
• How many targeted journalist outreaches per day should we plan during peak response (for example 1-5, 6-15)? Options: 1-5, 6-15, 16-30, 30+
• Are there reporters or outlets you explicitly want us to avoid engaging due to prior sensitivities or legal exposure? Options: Yes, No
• When should proactive journalist outreach begin relative to the public statement (for example before under embargo, at time of release, after release)? Options: Before under embargo, At time of release, After release

• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Retainer and Fee Schedule
• Service Level Agreement (SLA)
• Non-Disclosure Agreement (NDA)
• Data Processing Agreement (DPA)
• Escalation and On-Call Commitment
• Media and Statement Approval Protocol
• Termination and Transition Addendum
• Regulatory Compliance Addendum (conditional)

• Post-Response Health Check
• First Measurement Review
• Acceptance Gate, 90-Day Outcome Decision
• Reputation Recovery Retrospective and Lessons Learned
• Quarterly Recovery Review

• Produce a lessons-learned report with a redlined playbook showing required changes and rationale.
• Open remediation tickets for each failed criterion with owners and target resolution dates.
• Distribute the evidence package used for the acceptance decision to stakeholders for the record.
• Review outcome metrics and trend lines
• Document a prioritized list of lessons learned and the exact playbook changes to be made.
• Agree a timeline and owner-less tasks to implement playbook updates and training refreshes.
• Establish an ongoing monitoring cadence to watch net media sentiment score and the count of reopened reputation incidents.
• Re-confirm agreed success criteria and owners
• Create a training schedule to rehearse updated spokesperson guidance and approval flows.
• Set up a standing monitoring report tracking net media sentiment score and reopened reputation incidents, delivered each quarter.
• Review quarterly metric trends
• Confirm whether net media sentiment score and reopened incident count indicate sustained recovery or require further work.
• Agree on maintenance items and updates required to prevent recurrence of the same issues.
• Keep the remediation and playbook update tracker current with next steps and dates.
• Publish the quarterly metrics brief highlighting changes in net media sentiment score and reopened incident counts.
• Update the remediation tracker with status changes and new deadlines for persistent issues.
• Schedule any necessary follow-up workshops to address complex, recurring issues identified in the review.
• Confirm the response activities and handoff tasks are complete or have owners and deadlines.
• Identify and prioritize any critical open issues that must be closed in the next 30 days.
• Establish a short remediation plan with owners and target dates for immediate risks.
• Publish a 30-day remediation tracker listing open issues, owners, and target close dates.
• Activate monitoring feeds and distribute access to the agreed stakeholder list for ongoing observation.
• Confirm and publish the on-call escalation roster and contact protocol for the stabilization period.
• Present first measurement of net media sentiment score and time to resolution
• Determine whether net media sentiment score and time to resolution for high-severity issues are on track against targets recorded in Service Scope.
• Document root causes for any gaps and commit to specific corrective actions with target dates.
• Agree the next data refresh cadence and owner for metric reporting toward the acceptance gate.
• Deliver a metric dashboard update showing net media sentiment score and time to resolution trend lines for the period.
• Create a prioritized remediation plan addressing the top two drivers of negative sentiment, with deliverable dates.
• Schedule the acceptance gate review and circulate required evidence packet at least five business days in advance.
• Restate acceptance criteria and numeric targets
• Produce a clear pass or fail result for each acceptance criterion recorded in Service Scope.
• Capture a documented acceptance decision and, where applicable, the named signatory for the buyer.
• If any criteria failed, agree a remediation plan with owners and closure dates that will be tracked in ongoing reviews.
• Publish the acceptance decision memo listing pass/fail per criterion and the recorded signatory or buyer decision record.
• Validate deployment and deliverable completion
• Conduct timeline walk-through and decision review
• Surface persistent issues and blockers
• Present outcome data for each acceptance criterion
• Stakeholder feedback and employee sentiment snapshot
• Root cause analysis for any metric shortfalls
• Document pass or fail per criterion and capture decision
• Agree maintenance or corrective actions
• Review early media and stakeholder signals
• Capture lessons and playbook updates
• Team readiness and on-call transition
• Agree ongoing follow-ups and monitoring cadence
• Close completed items and update tracker
• Agree corrective actions and timelines
• Agree remediation items for any failed criteria
• Open issues, blockers, and remediation actions