Crisis Communications Plan for Small Businesses and Founders: Template and First-24-Hours Checklist
A crisis communications plan for a small business is a short written document, prepared before anything goes wrong, that names who decides, who speaks, what you will say in the first hour before the facts are in, which channels you will use, who watches for the story spreading, and which statements go past a lawyer. It should fit on three pages, because in the first hour of a real incident nobody reads a binder. The plan matters more for a small company than a large one: there is no communications department, the founder is usually the spokesperson and the story at the same time, and a single viral complaint, a review wave, a data breach or an employee incident can reach every customer you have before lunch. The first 24 hours decide most of the outcome. Acknowledge fast, say only what you know, fix what you can, and tell the people affected before you tell the public. Everything after that, including the search results that will carry the incident for years, is reputation repair, which is slower and more expensive than getting the first day right.
Key takeaways
- Decide in advance: a three-person crisis team, one spokesperson, one backup, a pre-approved holding statement, and the lawyer you will call. Deciding under pressure is where small businesses lose the first hour.
- The holding statement acknowledges, states what you are doing, and promises an update time. It never speculates about cause, blame or scale.
- Data breaches are a regulated crisis: every US state has a breach notification law, and the FTC’s guidance expects you to secure systems, preserve evidence and notify law enforcement, affected businesses and individuals.
- Respond publicly when the story is public, factual and spreading; stay quiet when it is one anonymous post with no reach, a legal matter under advice, or bait designed to provoke a reaction.
- Most of the lasting damage is in search. Plan the post-crisis content, review response and press work from day two, not month six.
What counts as a crisis for a small business?
A crisis is any event that threatens your ability to operate, your customers’ trust or your name in search, and that is moving faster than your normal processes can handle. For a small business the list is more ordinary and more frequent than the recalls and disasters big-company frameworks are built for.
| Type | Example | Why it escalates | First priority |
|---|---|---|---|
| Review wave | A dozen one-star reviews in 48 hours after a bad interaction, a policy change or a coordinated attack | Rating drops are visible on Google and Yelp to every searcher; 77 percent of consumers say negative reviews make them less likely to choose a business (BrightLocal, 2026) | Separate real complaints from fake ones; respond to the real ones; flag the rest |
| Viral complaint | A customer’s video or thread about your service reaches hundreds of thousands of views | Platforms reward outrage; local news picks up what is already trending | Contact the customer directly, then post one calm public response |
| Data breach | A phished email account, a stolen laptop, a vendor compromise exposing customer records | Legal notification clocks start; customers find out from the breach notice, so the notice is the communication | Secure systems, preserve evidence, call counsel and law enforcement |
| Employee incident | Staff misconduct on camera, a harassment allegation, a discriminatory remark attributed to the business | The person becomes the brand in the public’s mind | Investigate fast; separate the individual’s conduct from the company’s values in your statement, without pre-judging |
| Lawsuit or regulatory action | A customer suit, a labor complaint, a health inspection failure, a licensing issue | Court filings and inspection reports are public records that rank | Legal review of every word; a short factual statement |
| Founder controversy | Old posts resurfaced, a personal dispute, a political statement, an arrest | The founder’s name and the business share search results | Decide whether the founder or the company speaks, and keep the two statements consistent |
The test for whether something is a crisis rather than a complaint: is it spreading beyond the people directly involved, and could it be the first thing a prospect sees when they search your name? If either is yes, run the plan.
What goes in the plan?
Seven components. Keep the document where two people can reach it at midnight, and review it twice a year.
1. The crisis team
Three people: the decision-maker (usually the founder), a communications lead (in-house or your PR firm) and operations (whoever can fix the problem and knows the facts). Name a backup for each, with phone numbers.
2. The spokesperson
One person speaks for the company and everyone else refers questions to them. For most small businesses that is the founder, who is often emotionally involved, which is why PRSA’s guidance on the first hour recommends choosing the team and spokesperson in advance and rehearsing likely scenarios (PRSA, May 2024). Write the staff instruction now: do not comment, do not delete, forward everything to this person.
3. The holding statement
A pre-approved template, filled in with the specifics, that goes out within the first hour. It buys time without silence. Templates are below.
4. Channels, in order
Affected people first, directly. Staff second. Then the public statement, on the channel where the story is happening and on your own site as the canonical version. Then media, if they ask. Decide now which accounts you will post from and who has the passwords.
5. Monitoring
Someone watches Google results for your name, review platforms, the social platform where it started, and local news, on a fixed cadence (every hour on day one, every few hours on day two, daily after). A monthly version of this is in how to monitor your online reputation; during a crisis it runs continuously.
6. Legal review
Name the lawyer and agree which categories require sign-off before publishing: anything involving an employee, a breach, an injury, an allegation, a regulator or a lawsuit, with a one-hour turnaround. This article is general information, not legal advice.
7. Scenario cards
One page per likely scenario from the table above: who is affected, what you can promise, what you must not say, which statement template applies, and who else must be notified (insurer, landlord, platform, regulator).
The first-24-hours checklist
Times are from the moment you learn of the incident. Move faster where you can; the digital window is often shorter than an hour, as PRSA notes.
| Window | Do | Do not |
|---|---|---|
| 0 to 15 minutes | Confirm it is real. Protect people if safety is involved. Alert the crisis team by phone. Screenshot everything. | Reply from a personal account. Delete anything. |
| 15 to 60 minutes | Establish the three facts you know for certain. Pick the scenario card. Call counsel if the category requires it. Draft the holding statement from the template. Brief staff: refer all questions to the spokesperson. | Speculate on cause, blame or how many people are affected. Argue in comments. |
| Hour 1 to 2 | Contact the people directly affected, personally. Post the holding statement where the story is live and on your site. Set the time of the next update and keep it. | Post on channels where the story is not happening; you will spread it. |
| Hour 2 to 6 | Fix what can be fixed. Gather facts for the full statement. Log every inbound media and customer inquiry. Check Google results and reviews for your name. | Offer compensation publicly before you know the scale. Blame a vendor or an employee by name. |
| Hour 6 to 12 | Issue the full statement: what happened, who is affected, what you have done, what you will do, how to reach you. Respond to legitimate reviews and comments individually. Answer media with the statement and one named contact. | Go dark after the holding statement. Use “no comment.” |
| Hour 12 to 24 | Update as promised even if nothing changed. Brief staff again. Note everything you would do differently. Start the post-crisis plan: FAQ page, review responses, outreach to key customers. | Declare it over. Threaten reviewers or posters with legal action in public. |
For a data breach, the FTC’s Data Breach Response guide adds specific steps inside this timeline: take affected equipment offline without powering it down before forensic experts arrive, do not destroy evidence, change credentials, remove any exposed personal data from your website and ask search engines to drop cached copies, verify that service providers actually fixed what they say they fixed, and notify law enforcement, affected businesses and individuals. The FTC notes that every state, plus DC, Puerto Rico and the US Virgin Islands, has a breach notification law, that health data may trigger the FTC’s Health Breach Notification Rule or HIPAA, and that notification timing should be coordinated with law enforcement so it does not impede the investigation. It also suggests offering at least a year of free credit monitoring where Social Security numbers were exposed. Counsel sets the clock for your state.
Statement templates
Replace the bracketed text, cut anything you cannot stand behind, and have the lawyer read any that touch an allegation, a breach or an injury. The tone is the same in all of them: plain, specific, no adjectives.
Holding statement (first hour, any scenario)
“We are aware of [what happened, in one neutral phrase] on [date]. We take this seriously and are working to understand exactly what occurred. Our first priority is [the people affected / the safety of our customers and staff / securing our systems]. We will share more by [specific time] today. If you have been affected, please contact [name] at [channel].”
Full statement: operational failure or service complaint
“On [date], [what happened, factually]. [Number or group] of our customers were affected by [specific impact]. This happened because [cause, if confirmed; otherwise ‘we are still confirming the cause’]. Since then we have [specific actions, with times]. To the customers affected: [what you are doing for them, concretely]. We will [the change you are making] so this does not happen again, and we will post an update here on [date]. Questions can go to [name, channel].”
Full statement: employee incident
“We are aware of [description] involving a member of our team on [date]. The conduct shown does not reflect how we expect our team to treat anyone, and we began an investigation as soon as we learned of it. [If action taken: ‘That employee is no longer with the company’ / ‘The employee has been placed on leave while we investigate.’] We have reached out to [the person affected] directly. We will not be commenting further on personnel matters, but we will share what we are changing as a result by [date].”
Data breach customer notice
“We are writing to let you know about a security incident that may have involved your information. On [date] we learned that [what happened]. The information involved may include [specific data types]. As soon as we discovered this we [secured systems, engaged forensic experts, notified law enforcement]. We are offering [credit monitoring or other support] at no cost; details are below. We recommend that you [specific protective steps, such as a fraud alert or credit freeze and checking your credit reports]. We are sorry this happened. For questions, contact [name, phone, email]. We will update [URL] as we learn more.” The FTC publishes a model letter for breaches involving Social Security numbers; use it as the baseline and let counsel adapt it to your state’s requirements.
Review or social reply (public, individual)
“[Name], thank you for telling us about this. What you describe is not the experience we want anyone to have, and I would like to put it right. I have sent you a direct message / please call me at [number] so I can hear the full details. [Your name, title].”
Avoid the three phrases that make every statement worse: “we apologize for any inconvenience,” “mistakes were made,” and “no comment.” Each signals that nobody is accountable.
When should you respond, and when should you stay silent?
Use three questions.
Is it public and spreading? A complaint with reach, a story a reporter is working on, a review wave visible on your Google profile: respond. One anonymous post with no engagement, a comment on a thread nobody is reading: monitor, do not amplify. Your response can be the thing that makes it visible.
Is it factual? If the core claim is true, acknowledge it, even if details are wrong. If it is false, correct it once, calmly, with evidence, and do not repeat the false claim in your correction. If it is an opinion, you cannot win an argument about it in public; a short, courteous reply that offers to talk directly is the ceiling.
Is it a legal matter or bait? Lawsuits, regulatory actions and anything under investigation get a short factual statement cleared by counsel and nothing more. Deliberate provocation (an account that exists to attack you, a competitor’s campaign, a demand for money to remove a post) gets documented and reported to the platform, not answered.
On reviews specifically, silence is read as indifference: BrightLocal’s 2026 Local Consumer Review Survey of 1,002 US adults found 89 percent expect business owners to respond to reviews, 80 percent are more likely to use a business that responds to all of them, and 50 percent are put off by generic or templated replies. Respond to every real review during a wave, individually, and flag the ones that violate platform policy using the process in how to remove a Google review.
What not to do
- Do not delete. Deleting posts, reviews you can hide, or your own earlier statements creates a second story (“they covered it up”) and screenshots already exist.
- Do not lie or shade the truth. The FTC’s breach guidance says it plainly: do not make misleading statements. The same applies to every category. A correction later costs more than the truth now.
- Do not threaten. Public legal threats against a customer or reviewer become the headline. If legal action is warranted, your lawyer sends a letter; you do not post about it.
- Do not let the founder freelance. Late-night replies from a personal account are the most common way a small-business crisis grows.
- Do not buy your way out visibly. A flood of new five-star reviews the week after a wave is obvious to readers and platform filters.
- Do not promise what operations cannot deliver. “This will never happen again” is a hostage to the next incident. “Here is what we changed” is not.
- Do not stop communicating when the story quiets. The promised update you skip is the one a reporter notices.
Post-crisis: reputation repair and search cleanup
The news cycle ends in days; the search results do not. A month later the incident may be the second result for your business name, and for a founder it may sit under their personal name for years. Post-crisis work has four parts and starts on day two.
- Close the loop with the people affected. Individual follow-up, the promised remedy delivered, and a final update on your site. Satisfied complainants sometimes edit or remove their posts; nobody else will.
- Rebuild reviews the slow way. Ask every satisfied customer, consistently, through the channels the platforms allow. Keep responding to every review. The rating recovers over months as volume dilutes the wave.
- Publish what changed. A dated page on your site describing the incident briefly and the changes in detail. It ranks for your name plus the incident, it is the version reporters link to, and it tells AI assistants what the resolution was. Without it, the only account of the incident is the original complaint.
- Build the authority content that outranks the incident. Features in recognized outlets, interviews, expert quotes and strong owned profiles push the negative result down the page and give searchers and AI systems something else to read. This is standard reputation work; the mechanics are in push down negative search results with content that outranks them, and removal options, which are narrower than most people hope, are in can you remove negative articles from Google.
For a founder whose personal name is affected, run the same program for the person: profiles, a personal site, bylines and features, as described in reputation management for individuals. Check what AI assistants now say when asked about the business or the founder, and correct the sources they are drawing from.
How PR firms handle a small-business crisis
A PR firm brought in during an incident does four things a small business usually cannot do alone. It takes the media calls, so the founder stops being the switchboard and the spokesperson at once. It drafts and sequences every statement with counsel. It runs monitoring across search, reviews, social and news and tells you what is spreading and what is not, so you do not respond to the wrong things. And it starts the post-crisis content and placement work immediately, because the search results are the long-term damage.
Crisis work is priced as a project or an hourly block, and costs more for a cold call at 9 p.m. than for a retained client; the ranges are in how much reputation management costs. The cheaper path, by a wide margin, is to have the plan written and a firm on call before anything happens. A firm that already knows your business can act in the first hour; one that has to be briefed from zero cannot.
Where Viral Spike fits
Viral Spike Marketing’s public relations team handles crisis response for founders and small businesses: the holding statement, media inquiries, review and social responses, and staff guidance, coordinated with your counsel. The reputation management service takes over on day two: removal where platform policy allows it, suppression where it does not, review recovery, and authority content that holds. Where the search results need independent coverage to outrank the incident, guaranteed editorial placements across 1,600+ outlets supply it, where you approve the draft, the article is published and indexed on Google, and the engagement is refunded in full if it never runs. If nothing is wrong today, ask us for the plan template and fill it in this week; if something is wrong right now, call.
Write the three pages before you need them
This week, write down the three names and phone numbers, the spokesperson, the holding statement with the blanks left in, the lawyer, and the order of channels. Save it where your backup can find it. Then pick the two scenarios most likely to happen to your business and write a one-page card for each. That is the whole plan, and it is the difference between a bad day and a bad year.
Frequently asked questions
What is a crisis communication plan for a small business?
A short written document, prepared in advance, that names the crisis team and spokesperson, provides a pre-approved holding statement, lists channels in order (affected people, staff, public, media), assigns monitoring, specifies which statements need legal review, and includes one-page cards for the most likely scenarios such as a review wave, a viral complaint, a data breach or an employee incident. Three pages is enough; it should be reachable at midnight.
What should a holding statement say?
That you are aware of the incident, that you are taking it seriously and working to understand it, what your immediate priority is (the people affected, safety, securing systems), when you will update next, and how affected people can reach you. It should go out within the first hour. It should not speculate about cause, assign blame, estimate scale, or apologize for “any inconvenience.”
How fast should a small business respond to a crisis?
A holding statement within the first hour of confirming the incident, direct contact with affected people within one to two hours, a full statement within six to twelve hours, and an update at the promised time within 24 hours even if nothing has changed. PRSA guidance notes the digital window can be shorter than an hour, which is why the team, spokesperson and holding statement are decided in advance.
What do I have to do after a data breach?
Per the FTC’s Data Breach Response guide: secure systems and take affected equipment offline without destroying evidence, fix the vulnerability and verify vendors’ fixes, remove exposed data from the web, and notify law enforcement, affected businesses and individuals. Every US state has a breach notification law with its own timing and content rules, and health data may trigger federal rules. Counsel should direct the notification; the FTC provides a model letter.
Should I respond to every negative review during a crisis?
Respond individually to every review that reflects a real customer experience, with a short, specific reply and an offer to talk directly; BrightLocal’s 2026 survey found 89 percent of consumers expect responses and half are put off by templated ones. Flag reviews that violate platform policy (no customer relationship, coordinated attacks, off-topic content) through the platform’s process rather than arguing with them publicly.
How do you repair reputation after a crisis?
Close the loop with affected people, rebuild reviews consistently through allowed channels, publish a dated page describing what changed, and build authority content and independent press coverage that outranks the incident for your business and founder name in search. Check what AI assistants say about you and correct the sources. Expect months, not weeks; the search results outlast the news cycle.
Sources
Primary sources referenced in this article, in order of first use.
- PRSA, May 2024 (prsa.org)
- Data Breach Response guide (ftc.gov)
- 2026 Local Consumer Review Survey (brightlocal.com)
More in Marketing Insights
Related services