Crisis Communications: A Step-by-Step B2B Playbook

The first hour of a crisis is the rest of the crisis.

Everything the company does in those 60 minutes, what gets said, what doesn't, who speaks, what's promised, what's denied, becomes the record. The reporters cite it. The lawyers cite it. The board cites it. The customers cite it. The companies that handle crises well are the ones that ran the protocols before the event. The companies that handle them badly are the ones improvising the holding statement while the phone is ringing.

This is the playbook. Use it before the crisis, not during.

Our crisis communications agency page covers the response plan, the first 24 hours, and when to bring in outside help.

The Five Crises B2B Companies Actually Face

Most crisis communications writing assumes a generic corporate disaster. The actual taxonomy is narrower. For a B2B enterprise, five types of crisis cover roughly 90% of what's coming:

Cyber incident. Breach, ransomware, exfiltration, customer data exposure. Regulatory disclosure clocks start ticking immediately. SEC's four-business-day cyber rule applies to public companies.

Operational failure. Major outage, service degradation, supply-chain break, product defect. Customer churn risk is the live wire.

Executive crisis. Sudden departure, misconduct allegation, indictment, public scandal. Internal stability and external credibility both at risk.

Regulatory or legal event. Subpoena, enforcement action, class action, congressional inquiry, restatement. The press cycle and the legal cycle have to be coordinated.

Reputational event. Activist campaign, viral employee complaint, sourced investigative piece, social-media pile-on. The faster these move, the more the runbook matters.

Each type has its own playbook. A single generic crisis plan covering all of them ends up covering none of them well.

The Step-by-Step Playbook

Step 1: The crisis runbooks exist before the crisis

Each of the five crisis types should have its own written runbook, drafted in advance, legal-approved, and rehearsed annually. The runbook includes: trigger criteria, escalation tree, decision rights, holding statement templates, internal comms templates, customer comms templates, regulatory notification protocols, media protocols, and the contact list for outside counsel, forensics, insurers, and key analysts.

Companies without runbooks spend the first hour deciding who's in charge. Companies with runbooks spend the first hour executing.

Step 2: The first 60 minutes, facts, not narrative

In the first hour, the comms team's job is to assemble facts, not to write the story. What happened. When it happened. What is known. What is not yet known. Who is affected. Who is investigating. What the company is doing right now. That fact base is what every downstream communication will draw from.

The single most expensive mistake in crisis comms is writing a narrative before the facts are stable. The narrative gets contradicted within 48 hours by emerging facts, and the company is now lying instead of being wrong.

Step 3: Hold, don't spin

The first external statement is a holding statement. Its purpose is to acknowledge, demonstrate seriousness, and commit to a follow-up timeline. It is not the place to explain causes, assign blame, or speculate.

A workable holding-statement structure: we are aware of [event], we are taking it seriously, we are investigating with [internal + external resources], we will provide an update by [specific time]. Four sentences. Sometimes three.

Step 4: Internal first, external second, regulator parallel

Employees should not learn about the crisis from the press. Customers should not learn about it from social media. Regulators should not learn about it from the journalist who called them for comment. The sequencing should be: brief the executive team, brief the legal and compliance team, brief affected employees, notify regulators (where required), notify affected customers, brief the press.

The brief windows between those steps are operational. Compressed correctly, they protect the company. Compressed incorrectly, they create the leak that becomes the story.

Step 5: Pick the right spokesperson

The CEO is not always the right voice. Sometimes the right voice is the CTO (for technical failures), the CISO (for cyber incidents), the General Counsel (for legal events), or the Chief Customer Officer (for customer-impacting outages). Choosing the wrong spokesperson, usually defaulting to the CEO when the technical credibility belongs elsewhere, undermines the substance of the message.

The right spokesperson is the one who can answer the next 20 questions credibly, not the one with the biggest title.

Step 6: Update on the timeline you committed to

If the holding statement said "we will update by 4pm," the next communication happens at 4pm, even if the update is "we don't have new information, the investigation continues, we will update by [next time]." Missing a self-imposed update window is the single most damaging signal a company can send mid-crisis. It looks like loss of control. It often is loss of control.

Step 7: When facts stabilize, write the narrative

Once the facts are stable, typically 48–96 hours into the event, the company writes the explanatory narrative. What happened, why it happened, what the company is doing to ensure it doesn't happen again, what the company is doing for affected parties. This is the moment for substance, accountability, and specifics. Vague apologies do not work. Quantified commitments do.

Step 8: The post-mortem is a comms product

Two to four weeks after the event has stabilized, the company should publish a substantive post-mortem, what failed, what the company learned, what is changing. This is not optional. It is the most credibility-positive moment of the entire crisis cycle. Companies that publish substantive post-mortems rebuild trust faster than companies that move on quietly. Cloudflare, Stripe, and GitHub have built much of their enterprise credibility on this discipline.

The Crisis Patterns That Recur

Three patterns produce most of the avoidable damage in B2B crisis events:

Lawyering the comms instead of communicating. Legal review is essential. Legal control over every word is fatal. The press hears defensive lawyer-speak immediately and reads it as guilt. The discipline is integrated drafting, comms and legal in the same room, drafting together, not sequential review.

The slow walkback. The first statement claims something the second statement softens which the third statement contradicts. Every walkback is a credibility tax. Better to say less in the first statement than to walk back more in the third.

Treating the press as the only audience. Employees, customers, regulators, analysts, investors, and board members are all reading the same statement. A statement optimized only for the press often misfires with the other five audiences. The strongest crisis comms is written for all six.

The Connection to Everything Else

Crisis communications is not a standalone discipline. It is the test of the broader corporate communications function. Companies with strong reputational equity going into a crisis exit with that equity reduced but intact. Companies with weak equity going in exit with what's left destroyed.

For the recovery side specifically, our piece on reputation recovery strategies covers the post-event work. For the IR-side coordination required in any disclosure-triggering event, our IR PR playbook covers the parallel discipline. And for the specific case of brand-level crisis response, our piece on global crisis response goes deeper.

The One-Sentence Test

If the crisis communications function cannot, today, produce in under 60 seconds: the name of the senior executive on call for crisis events, the location of the runbook for each of the five crisis types, the contact details for outside counsel and forensics, and the rehearsal date of the last tabletop exercise, then the function is not ready. Whatever crisis is coming next will land harder than it had to.