Crisis communication step by step: from first report to aftercare

Before you start: three ground rules

This process only works if three things are settled. One: you communicate on the basis of facts, and you say explicitly what is still an assumption. Two: you start with the people hit hardest, not with the press and not with your reputation. Three: you promise only what you deliver, including the time of the next update.

The steps below follow the BOB decision model used by Dutch crisis teams: first the picture, then the judgement, then the decision. Steps 1 to 3 build the picture, steps 4 and 5 are judgement and decision, steps 6 to 10 are execution and closure.

The ten steps

Step 1 — Take the report and start the clock

Time: the first minutes. Who: whoever receives the report.

Note the exact time of the report and who made it. That timestamp later determines statutory deadlines and your accountability afterwards. Record immediately what was reported in the words of the person reporting it, without interpretation. Alert the crisis team through the agreed route, even if it is still unclear whether this really is a crisis: escalating costs little, escalating too late costs a great deal.

Step 2 — Separate facts from assumptions

Time: 10 to 20 minutes. Who: information coordinator or communication adviser.

Make two columns: this we know for certain and this we suspect. For each line, note the source and the time it came in. This sounds bureaucratic but it is the single most important step in the whole process: almost every communication failure during a crisis traces back to an assumption that went out as a fact.

Where AI helps: summarising incoming reports, emails and messages into a timeline, and flagging contradictions between sources. What counts as a fact, you decide.

Step 3 — Build situational awareness

Time: parallel to step 2, continuously. Who: environment analyst or communication adviser.

Look at what is happening outside. Which questions are people asking, which rumours are circulating, which emotions dominate, and do people know what to do? Organise that along the three objectives of crisis communication: providing information, sensemaking and harm reduction. Situational awareness is an analysis, not a press clipping file: what is going on, and what does it mean for our communication?

Where AI helps: this is the clearest gain. Monitoring many sources at once, clustering recurring questions, flagging spikes. See AI and situational awareness.

Step 4 — Identify audiences and the message

Time: 10 minutes. Who: crisis team, led by the chair.

Put your audiences in order of how hard they are hit: first those directly affected, then those close to them (family, staff, neighbours), then involved parties (partners in the chain, regulators), then the general public and the press. Formulate one key message that is true for all of them, then vary tone and level of detail per group. The moment different groups receive different accounts, you have the problem you most wanted to avoid. See Rings of involvement.

Step 5 — Fix strategy and roles

Time: 10 minutes. Who: crisis team.

Record: who is the spokesperson, which channels you use, what the update rhythm is, who may speak on behalf of the organisation and who may not, and who contacts partners in the chain. Also decide explicitly what you are not doing. A decision to give no interviews for now is a decision, and should be recorded as such so the team does not keep revisiting it.

Step 6 — First message out

Time: within the hour, preferably sooner. Who: communication, approved by the chair.

The first message, the holding statement, does not have to be complete, but it must contain four things: what has happened as far as known, what this means for people, what you are doing now, and when the next update comes. Acknowledgement belongs in it: "we understand this causes concern" is not weakness but a condition for staying credible.

Where AI helps: a draft in two variants (factual-neutral and empathetic) within minutes, so you choose and sharpen rather than starting from a blank screen.

Step 7 — Prepare Q&As and media handling

Time: in the first hour, in parallel. Who: communication.

Write down the questions you would rather not receive, and answer exactly those. Who is responsible? Could this have been prevented? Are there casualties? What will this cost? Put the answers in plain language, so they are also usable on the website and by the people answering the phones. A spokesperson hearing these questions for the first time on camera has already lost the exchange.

Step 8 — Check statutory reporting duties

Time: in the first hour, and monitored thereafter. Who: legal or privacy, with communication.

Check whether statutory notifications are triggered, and within what deadline. The three that arise most often in the Netherlands:

Situation	To whom	Deadline	Legal basis
Personal data breach, unless it is unlikely to result in a risk to individuals	Dutch Data Protection Authority	Without undue delay, at the latest 72 hours after becoming aware	Article 33 GDPR
Personal data breach with a high risk to individuals	The individuals themselves	Without undue delay	Article 34 GDPR
Significant incident at an organisation covered by the Dutch Cybersecurity Act	Central reporting point MijnNCSC; the notification passes to both the sectoral CSIRT and the supervisory authority	Early warning within 24 hours, full notification within 72 hours, final report within 1 month	Cybersecurity Act (NIS2), in force since 15 August 2026
Serious adverse event in healthcare	Health and Youth Care Inspectorate	Without delay, and in any case within 3 working days of establishing it	Wkkgz

Two things to keep sharp. One: the clock starts when your organisation becomes aware of the incident, not when you know the cause and not when you happen to remember. Two: even if you decide not to notify, record that assessment. For a personal data breach that is an explicit requirement: you must be able to show why you considered notification unnecessary.

Thresholds and scope differ by sector. Under the Dutch Cybersecurity Act they are set out in ministerial regulations per sector. Always have the application to your own organisation checked by a lawyer or data protection officer; this table is a memory aid, not legal advice.

Where AI helps: flagging which deadlines may be running and drafting a notification from the facts already recorded. See Mandatory reporting and AI.

Step 9 — Hold the rhythm and adjust

Time: hours to days. Who: communication, with the crisis team.

Keep to the update rhythm you promised, even when there is nothing new. Keep refreshing your situational awareness: is the nature of the questions shifting, are new rumours forming, is disinformation gathering pace? Adjust the key message when the facts change, and say that the picture has changed. Quietly editing an earlier text is the fastest way to lose trust.

Step 10 — Stand down, aftercare and evaluation

Time: days to weeks. Who: crisis team.

Communicate the ending too: what has been restored, what stays different for a while, where people can go with damage or questions. Stay reachable for those affected after attention has faded; that is the moment trust is genuinely built or lost. Then evaluate with the whole team: what went well, what did not, and which change to the playbook prevents the same mistake returning.

Checklist for the first hour

Print this and put it on the wall. During a crisis nobody reads a manual.

• Time of the report noted, and who made it.
• Crisis team alerted, chair appointed.
• Facts and assumptions in two columns, with source and time.
• First situational picture: which questions are live right now?
• Audiences in order, those hit hardest first.
• One key message that is true for every group.
• Spokesperson appointed, everyone else agreed not to speak.
• First message published, stating the time of the next update.
• Staff informed, before or at the same time as external audiences.
• Q&As ready for the five hardest questions.
• Statutory reporting duties checked, deadlines noted.
• Log started: what was decided when, and by whom.

What this process does not solve

A step-by-step guide gives structure, not judgement. The hardest moments in a crisis are not the ones where the next step is unclear, but the ones where it is clear that every option has a downside. Do you communicate that personal data may have been taken, when you are not certain and could cause unnecessary alarm? Do you say that a mistake by one of your own people caused this?

No checklist and no AI system helps there. What does help: living through those dilemmas once in an exercise, so you recognise them when they arrive for real. That is why organisations that exercise regularly come through a real crisis noticeably calmer than organisations with a thicker plan.

Sources

• Netherlands Institute for Public Safety (NIPV), Crisis communication within crisis management — the three objectives of crisis communication. Accessed 22 September 2026.
• Dutch National Cyber Security Centre, reporting duties under the Cybersecurity Act — early warning within 24 hours, full notification within 72 hours, final report within one month; filed through MijnNCSC. Act in force since 15 August 2026. Accessed 22 September 2026.
• Articles 33 and 34 of the General Data Protection Regulation — notification of personal data breaches to the supervisory authority and to data subjects.
• Health and Youth Care Inspectorate, reporting a serious adverse event (Wkkgz) — without delay, in any case within three working days. Accessed 22 September 2026.