What is a crisis communication plan, and what does it typically define?

• A. A plan for managing production schedules during normal operations.
• B. A plan for hiring external auditors for IT.
• C. A plan for budget approvals after a security incident.
• D. A plan defining who communicates, what channels, what messages, and timing during a crisis to maintain trust and control.

Answer: (D)

A crisis communication plan coordinates how information is shared during a disruption to protect trust and maintain control. It defines who communicates (the designated spokespersons or incident lead), what channels to use (internal alerts, media briefings, social media, regulators), what messages to deliver (clear, consistent talking points with factual updates and impact), and when to communicate (timing, cadence of updates, escalation triggers). It may also outline approval processes, media handling, and post-crisis follow-up. This plan helps prevent rumors, ensures regulatory and legal considerations are met, and supports a coherent response that maintains stakeholder confidence and aids recovery.