Crisis Statement Templates
Adapted from a contribution by @fyscleaning-jpg (PR #381).
Structures for the most common crisis statements. Fill in real specifics. Nothing ships with brackets still in it. For when to use each one, see crisis-communications.md.
Contents
- Holding statement
- Full incident statement
- Data breach / security incident notification
- Product outage statement
- Customer harm / apology statement
- Billing or pricing error statement
- Public postmortem
Holding Statement
Use in the first 30-60 minutes, before facts are confirmed.
B0
Say nothing about cause, scope, or who's affected. That belongs in the full statement once confirmed.
Full Incident Statement
B1
Data Breach / Security Incident Notification
Have legal counsel review this before it goes out. Notification deadlines and required content vary by jurisdiction and data type, and counsel decides which apply. Keep the responsibility and apology language only once counsel has cleared it.
B2
Product Outage Statement
Initial (status page or pinned post):
B3
Resolution:
B4
Customer Harm / Apology Statement
For one customer's bad experience that has gone public. Contact the customer privately first. A public apology they haven't seen, or one that contradicts what you told them, makes it worse.
B5
Billing or Pricing Error Statement
Lead with the fix already underway. Don't ask affected customers to come forward.
B6
Public Postmortem
For Tier 3 and 4 incidents, published once the crisis is resolved and root cause is confirmed.
B7
Vague commitments ("we'll do better") are forgettable. Specific, checkable ones rebuild trust.