Crisis Communication Plan Template for Small Businesses

A crisis communication plan is a short document that tells your team who speaks, what they say first, who they tell, and in what order, when something goes wrong in public. This guide gives you a fill-in-the-blanks template built for a small business, sample holding statements you can adapt today, a social media playbook, and a step-by-step timeline for the first 72 hours.

What Counts as a Crisis for a Small Business

For a large company, a crisis usually means national headlines. For a small business, the threshold is much lower. A crisis is any event that can seriously damage customer trust, stop you from operating, or expose you to legal or regulatory trouble, and that people outside the business will hear about whether you speak or not.

Common examples for small and midsize US businesses include:

• Operational failures: a fire, flood or power loss that closes the shop, a product defect, a food-safety complaint, a shipping meltdown during the holidays.
• Data and technology: a data breach, a ransomware attack, a payment system outage, a hacked social media account posting spam.
• People issues: an employee accident, an allegation of harassment or discrimination, a staff member’s offensive post going viral with your logo in the background.
• Reputation attacks: a scathing viral review, a local news story, a misleading post in a community Facebook group.
• External events: severe weather, a supplier going bankrupt, a recall by a manufacturer whose product you sell.

The Federal Emergency Management Agency’s Ready.gov business planning guidance puts it plainly: when an emergency occurs, the need to communicate is immediate, because customers want to know how they will be affected and regulators and local officials need to be notified. The businesses that handle these moments well are rarely the ones with the biggest budgets. They are the ones who decided in advance who would do what.

The Five Parts of a Crisis Communication Plan

Before the template, here is the structure. Every workable plan, whatever the company size, has these five parts:

1. Roles: who leads, who speaks, who handles each audience, and who has the authority to approve a statement.
2. Audiences and contact lists: everyone you might need to reach, with current phone numbers and emails stored somewhere you can reach even if your office or network is down.
3. Pre-approved messages: holding statements and templates for the crises you are most likely to face.
4. Channels: how each audience hears from you, from a staff group text to a website banner.
5. Process: a step-by-step sequence for the first hour, first day and first week, plus how you close the crisis and learn from it.

Your crisis communication plan sits alongside your broader emergency or business continuity plan. The U.S. Small Business Administration’s emergency preparedness guide recommends assessing your risks, creating a response plan, and practicing it with your staff. The communication plan is the part that deals with words and people rather than generators and backups.

Step 1: Assign Roles Before You Need Them

The single biggest mistake small businesses make in a crisis is having three people say three different things. Fix that with clear roles. In a team of five, one person may hold two or three roles; that is fine as long as it is written down.

Role	Typical person	Responsibilities
Crisis lead	Owner or CEO	Makes final decisions, approves every public statement, decides when the crisis is over.
Spokesperson	Owner, GM or a calm senior manager	The only person who speaks to media and posts official statements. Needs to be available by phone.
Backup spokesperson	Second senior person	Steps in if the spokesperson is unavailable or personally involved.
Internal communications	Office manager or HR	Briefs employees, answers staff questions, keeps a log of what was said internally.
Customer communications	Customer service lead	Handles emails, calls, DMs and reviews using approved language.
Social media monitor	Marketing person or contractor	Watches mentions, flags misinformation, posts only approved updates.
Advisors	Attorney, insurer, IT provider, accountant	Consulted before statements about liability, data or money.

Write the name, mobile number and personal email of each person next to each role. Personal contact details matter: if your email server is the thing that got hacked, a company address is useless.

Then add one rule in bold at the top of the page: No one other than the spokesperson comments publicly, including on personal accounts. Give every employee a polite script: “I’m not the right person to answer that, but I’ll make sure [name] gets back to you.”

Step 2: Map Your Audiences and Build the Contact Sheet

Different people need different information, at different times. List every group you might need to reach and how you will reach them.

Audience	What they need to know	Channel	When
Employees	What happened, what to do, what not to say	Group text, call tree, staff meeting	First, within the first hour
Directly affected customers	How it affects them, what you are doing, what they should do	Direct email, phone call	As soon as facts are confirmed
Regulators and authorities	Required notifications	As required by law or license	Within legal deadlines
Insurer, bank, landlord	Facts, claim or contract implications	Phone, then email	Same day
Suppliers and partners	Impact on orders and deliveries	Email or call	Within 24 hours
All customers and the public	Short, factual update	Website banner, social media, email list	Once affected people have been told
Local media	Statement, spokesperson contact	Email statement, phone	When asked, or proactively if the story is already public

Store the contact sheet in at least two places that do not depend on your office: a shared cloud folder the key people can open from their phones, and a printed copy at the owner’s home. Review it every quarter. Outdated numbers are the most common failure point in real incidents.

Step 3: Write Holding Statements Now

A holding statement is a short first response you publish while you gather facts. It buys you time without looking evasive. The golden rules: say what you know, say what you are doing, say when you will update, and show that you care about the people affected. Do not guess at causes, blame anyone, or promise outcomes you cannot guarantee.

General holding statement

“We are aware of [brief description of the issue] and are looking into it right now. The safety and trust of our customers and team come first. We will share an update by [time/date]. If you have been affected, please contact [name/email/phone].”

Temporary closure

“Because of [a water leak / a power outage / severe weather], [Business name] is closed today, [date]. Everyone is safe. Orders scheduled for today will be [rescheduled / refunded], and we will contact you directly. We expect to share our reopening plans by [time].”

Suspected data incident

“We have identified unusual activity on [system] and are investigating with outside specialists. We have taken steps to secure our systems. If we find that customer information was affected, we will contact those customers directly with details and next steps.”

For data incidents specifically, the Federal Trade Commission’s Data Breach Response guide for businesses notes that all states have breach notification laws and advises telling people how it happened, what information was taken, what you have done about it, and what support you are offering. It also warns against misleading statements and against withholding details that would help consumers protect themselves. Notification rules differ by state and change over time, so check with your attorney before you publish anything about a breach.

Product or service complaint going viral

“We’ve seen [customer’s] post and we’re sorry for their experience. We’ve reached out to them directly to make it right, and we’re reviewing what happened so it doesn’t happen again.”

Step 4: The Social Media Playbook

Social media is where most small-business crises either start or get bigger. A few rules keep you out of trouble.

Pause, then respond

• Pause scheduled posts immediately. A cheerful “Happy Friday, come see our new menu!” post published during a food-safety scare looks tone-deaf.
• Respond publicly once, then take it private. Post one acknowledgment where the complaint is, and move the detailed conversation to DM, email or phone.
• Pin your update. Put your holding statement at the top of your profile so newcomers see your position, not just the angry thread.
• Use the same words everywhere. Your website banner, Instagram post, Google Business Profile update and email should say the same thing.

What not to do

• Do not delete critical comments unless they contain threats, hate speech, or private information. Deleting fair criticism usually makes it spread.
• Do not argue with individual commenters, even when they are wrong. Correct factual errors once, politely, with a link to your update.
• Do not let the owner post emotionally from a personal account at midnight.

Step 5: The First 72 Hours, Step by Step

Print this timeline and keep it with your contact sheet. It is deliberately simple so a stressed person can follow it.

First hour

1. Make sure people are safe. Call 911 if anyone is hurt or in danger.
2. The crisis lead confirms they are in charge and calls the spokesperson.
3. Start a written log: time, what happened, who was told, what was said.
4. Pause scheduled social posts, ads and marketing emails.
5. Brief employees with the facts and the “refer all questions” rule.
6. Publish the holding statement if the issue is already public.

Hours 2 to 24

1. Gather facts. Separate what you know from what you suspect.
2. Call your insurer, attorney or IT provider as needed.
3. Contact directly affected customers personally before posting broadly.
4. Make any legally required notifications.
5. Publish a fuller update at the time you promised, even if the update is “we are still investigating.”
6. Monitor comments, reviews and local news every few hours.

Days 2 and 3

1. Share what you have learned and what you are changing.
2. Answer remaining customer questions using approved language.
3. Decide with the crisis lead when to resume normal marketing.
4. Thank staff.

Handling media calls

A local reporter calling does not mean your business is doomed. Reporters want accurate information quickly, and a cooperative, honest spokesperson usually gets a fairer story than a closed door.

• Anyone who takes the call gets the reporter’s name, outlet, deadline and question, then promises a call back from the spokesperson.
• The spokesperson calls back before the deadline, even if only to read the holding statement.
• Stick to three key messages: what happened, what you are doing, what affected people should do.
• Never say “no comment”. Say “I don’t have that information yet, and I’ll let you know when I do.”
• Assume everything is on the record. There is no casual chat with a reporter during a crisis.

Once the issue is resolved, share the fix in a factual statement or customer email. Do not try to spin a bad week into a marketing moment.

The Fill-in-the-Blanks Template

Copy this outline into a document and fill it in.

1. Purpose and activation. “This plan is activated by [crisis lead] when [criteria, e.g. an incident may affect customer safety, data, or our reputation publicly].”
2. Crisis team. Role, name, mobile, personal email, backup (use the table above).
3. Golden rules. One spokesperson. Safety first. Facts only. Affected people hear it from us first. No deleting fair criticism.
4. Risk list. Your five most likely crises, ranked. For a restaurant: food illness, fire, staff incident, bad review storm, POS outage. For an online store: data breach, shipping failure, product defect, hacked account, payment processor freeze.
5. Contact sheet. Employees, key customers, insurer policy number and claim line, attorney, IT provider, landlord, bank, key suppliers, local media contacts, relevant regulators.
6. Holding statements. One per risk on your list.
7. Channel checklist. Logins and who has access for website, email platform, every social account, Google Business Profile, phone voicemail greeting.
8. 72-hour timeline. As above.
9. Log template. Columns for time, event, action, owner, notes.
10. Review. Date of last update, date of last drill, next review date.

Test the Plan With a 45-Minute Tabletop Exercise

A plan that has never been tested usually fails on something small: a password nobody has, a phone number that changed, a manager who did not know they were the backup. Once a year, gather the crisis team for 45 minutes and walk through a scenario out loud.

For example, a coffee shop in Denver might run this scenario: “At 7:30 on a Saturday, a customer posts a photo on a neighborhood group claiming they found glass in a pastry. The post has 200 comments by 9:00.” The team talks through who sees it first, who is called, what the holding statement says, whether to pull the batch, who contacts the customer, and what the Instagram post says. Time each step. Write down every gap you find, then fix them the following week.

After any real incident, hold a short review within two weeks. Ask what worked, what was slow, and what you would change, then update the plan.

Frequently Asked Questions

How long should a small business crisis communication plan be?

Four to six pages is plenty for most small businesses. The contact sheet and holding statements are the most used parts. A long plan that nobody reads is worse than a short one that everyone knows.

Who should be the spokesperson?

Usually the owner or a senior manager who is calm on camera and on the phone. If the owner is personally involved in the issue, the backup should speak instead.

Should we respond on social media right away?

If the issue is already public, post a short holding statement within the first hour or two. Waiting a whole day while comments pile up lets others define the story. If it is not public yet, tell affected people directly first.

Do we need a PR agency?

Not for most incidents. A clear plan and a prepared spokesperson handle the majority of small-business crises. Consider outside help for serious legal matters, injuries, or stories picked up by national media.

Should we ever say “no comment”?

Avoid it. It sounds like you are hiding something. Say what you can confirm, explain what you are still checking, and promise an update by a specific time.

How often should we update the plan?

Update contacts quarterly, review the whole plan once a year, and revise it after every real incident or staff change in a key role.

Start With One Hour This Week

You do not need to finish everything today. Block one hour this week to fill in the roles table and contact sheet, and write one holding statement for your most likely crisis. That single page already puts you ahead of most small businesses. Add the rest over the following month, run your first tabletop exercise, and put the next review date in the calendar. Laws and notification rules change, so check official sources and your attorney whenever an incident touches safety, data or employment.