Outage Communications Template Set
Messages to staff, customers and suppliers during a disruption that is not a cyber incident, with the timings for the first message and the updates.
Available soon
- Format
- Word
- Size
- 65 KB
- Length
- 19 pages
- Version
- 1.2
- Updated
What's inside
- Purpose and audience
- Legal note
- When this set applies, and when it does not
- Who speaks for us
- Timings
- What every message says
- The message set
- Channels that work when the main systems are down
- Contact list
- Required inputs with owners
- Message approval log
- Follow-up template
- Adapting this template
- Framework references
- Definitions
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose and audience
When a critical service is disrupted, people decide what to do from what they are told: customers who hear nothing go elsewhere, and staff improvise. This set gives [[Organisation Name]] eight approved messages, OM-01 to OM-08, so that the communications lead fills in facts instead of writing from a blank page, every message goes out on time, and nothing is said that has not been checked.
It serves the Business Continuity & ICT Resilience Policy, whose rule RR-27 sets when staff and customers are told, and the plans that invoke it: each critical service's plan (Cyber Recovery Plan Template, section PS-10) and each site's or unit's plan (Site & Business Unit Continuity Plan Template). Who decides is set in the Crisis & Recovery Responsibility Matrix. It is for disruptions that are not cyber incidents; in a cyber incident, P09's Incident Communications Template Set is used instead.
The crisis lead approves every message (RA-15):
Message | When | Sent by |
|---|---|---|
OM-01 Staff first message | Within [[1]] hour of the crisis lead declaring the disruption (RR-27) | Communications lead |
OM-02 Customer first message | Within [[2]] hours of the declaration (RR-27) | Communications lead |
OM-03 Update | Every [[4]] hours after the customers' first message, and at each change, until the end of recovery (RR-27) | Communications lead |
OM-04 Service restored | When the crisis lead declares the end of recovery (RR-17) | Communications lead |
OM-05 Supplier or carrier notice | As soon as their work changes | Supplier liaison |
OM-06 Website or status-page notice | Posted with the customers' first message, changed with each update, replaced when the service is back | Communications lead |
OM-07 Call-handling script | Given to them with the customers' first message, and changed with each update | Communications lead |
OM-08 Media holding line | Prepared with the first messages; used only if a journalist asks or the disruption becomes public | Communications lead |
Guidance — delete before approval
Approve this whole set [[once a year]], and after any change of crisis lead or communications lead, so that in a disruption only the facts need approval.
The EXAMPLE is the pack's worked example, a wholesale distributor with about 900 staff, three warehouses and an online ordering service. Its messages illustrate a failure of Warehouse 2's network line on 13 Oct 2026 that is not an event in the example's story. Everything in it is fictional.
Legal note
This document helps you plan and test business continuity and recovery from a disruption, including a destructive cyberattack. It is not legal advice, and following it is not a statement that you comply with NIS2, DORA, the GDPR, HIPAA, ISO 22301 or any other law, standard or set of criteria. Which continuity and recovery duties apply to you depends on your sector and the law that applies to you: confirm them with counsel, your auditor or your supervisor.
This set holds no notice to an authority (see Notices to authorities below). The NIS2 Implementing Regulation (EU) 2024/2690 binds only the providers its Article 1 names, such as cloud and managed service providers; others may use its Annex as good practice. DORA binds financial entities only; the Articles cited below are its Articles 11 and 14. EXAMPLE: the distributor is an important entity under NIS2 in its Member State, and not a financial entity, so DORA's reporting duties do not apply.
When this set applies, and when it does not
Use this set when the crisis lead has declared the disruption of a critical service (RR-17) and nothing suggests an attack. That includes the failures the IT Disaster Recovery Procedure plans for, DS-01 to DS-05: a failed server, data centre, line or site, or a faulty update. It also applies to the four losses every site's or unit's plan plans for: building, people, supplier and systems. The procedure's last scenario, DS-06, an attack is suspected, is not this set's.
A cyber incident
In a cyber incident this set is not used. P09's Incident Communications Template Set holds the messages, CT-01 to CT-10, and P09's rule applies:
P09 IM-09 Only the communications lead may speak for the organisation about an incident outside it, using the approved templates; nobody else may talk to the media or post about an incident.
P09 sets the decision right in its own words: Say anything outside the organisation: “Communications lead, with the executive incident lead's approval. Only from the approved templates (IM-09).” RR-27 points to the same rule from this pack's side.
Notices to authorities
No message in this set is a notice to an authority, whatever caused the disruption. A disruption that is not an attack can still be one a law asks you to report. Whether a notice is due is decided under the reporting screen of the Security Incident Management pack, which the incident manager runs (P09 IM-06), and any notice is made with P09 and the Regulatory Incident Notification & Reporting pack (P18).
The legal reporting clocks are separate from RR-27. They do not start at the crisis lead's declaration of a disruption. P09 starts them at awareness: the time the incident is declared under P09, or earlier where the record shows reasonable certainty. The two declarations can come at different times. Four examples, each for the entities it binds. Under NIS2, essential and important entities send an early warning within 24 hours of becoming aware of a significant incident, and an incident notification within 72 hours. Under the GDPR, a controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals. Under DORA, a financial entity sends its initial notification within four hours of classifying an incident as major, and no later than 24 hours after becoming aware of it. Under SEC Form 8-K Item 1.05, a US registrant files within four business days of determining that a cybersecurity incident is material. P09's Incident Communications Template Set and the P18 pack hold these clocks, who each binds and when each starts, including when this pack treats you as aware. Whether any applies to you is for counsel and the reporting screen to say, and the times in this set never stand in for them.
If an attack is suspected during an outage
A disruption that began as a failure can turn out to be an attack. Then the messages move to P09 at once. Whoever suspects it tells the incident manager. The communications lead sends nothing more from this set: the next message comes from P09's templates, approved as P09 sets out, and until then the messages already sent stand and nobody outside is told that the cause has changed. No message promises a failover or a restore, because nothing fails over or is restored until the incident manager confirms that the copy or site to be used can be trusted (RR-23).
Who speaks for us
The Crisis & Recovery Responsibility Matrix sets who tells staff, customers and the public, in RA-15: the crisis lead is accountable, the communications lead responsible, the incident manager consulted and the business owner informed. The incident manager is consulted for one reason: any sign of an attack moves the messages to P09. Outside a cyber incident, this set keeps the discipline P09 IM-09 sets in one:
- Only the communications lead, or a spokesperson they name, speaks to journalists or posts in public about the disruption. The call handlers answer from OM-07.
- Each site or unit continuity lead tells their own people through the call tree and briefings, in the words of OM-01 (RR-22).
- The technical recovery lead is the only source of a time for the repair. A supplier's estimate reaches the messages through the technical recovery lead; the supplier liaison calls on the supplier's commitments (RA-14). Suppliers do not speak for you: OM-05 asks them to pass every question on.
Approving messages
The crisis lead approves each message before it goes, or the deputy when the crisis lead cannot be reached within [[15 minutes]]. The words are approved in advance, so the approver checks only the facts, against the facts sheet. A message changed after approval is a new version, and is approved again. Every message sent is logged in the approval log and kept with the crisis log for [[3]] years (RR-20).
The communications lead's deputy
The communications lead acts in the first hour of a disruption, so RR-19 asks for a named deputy, and for the first holder to hold no other role that acts in that hour. Name the deputy on the contact list before this set is approved. EXAMPLE: the distributor's communications lead, its Head of Marketing and Communications, has no deputy, and the readiness dashboard reports the gap under RRM-07, roles without a deputy: “Communications lead”. An outage on a day the Head of Marketing and Communications is away would leave nobody to send OM-01, so this set asks for a deputy.
Timings
RR-27, from the Business Continuity & ICT Resilience Policy:
RR-27 During a disruption of a critical service, the communications lead tells staff within [[1]] hour and affected customers within [[2]] hours of the crisis lead declaring it: what has happened, what still works, what to do, and when the next update will come. Updates follow at least every [[4]] hours, and at each change, until the end of recovery, all from the approved outage templates. In a cyber incident P09's templates and its rule IM-09 apply instead, and notices to authorities stay with P09 and P18.
Each time is the latest a message may go, counted from the moment the crisis lead declares the disruption, which may be later than the fault; updates are counted from the customers' first message. Send sooner where you can, and declare early: a declaration for an outage that clears in ten minutes costs a short message and an all-clear. Staff see each customer message when it goes out, so they never hear the news from a customer first and never wait more than 4 hours for word; without that copy, their wait for the first update would be 5 hours. The resilience coordinator puts every message time in the crisis log as a deadline.
These times are internal defaults for this pack, counted from the declaration. They are starting points to set against your own contracts, and none has a legal source. A customer contract or service level agreement may require notice sooner or on other terms, so check them first and change the placeholders to match.
Worked illustration: a line failure at a warehouse
EXAMPLE. An illustration, not an event in the example's story. At 06:20 on a weekday Warehouse 2's network line fails. At 06:40 the crisis lead declares the disruption: the site dispatches from its printed pick lists, perishable orders first, and some other orders from Warehouse 2 may arrive a day late. The provider restores the line at 18:40.
The crisis lead declared the disruption 20 minutes after the line failed, so the clock runs from 06:40. The line provider's contract gives 12 hours to repair a failed line and dispatch's recovery time objective is 8 hours (OG-03), so the site goes straight to its printed pick lists (DS-03). In this illustration the technical recovery lead has no time for the repair to give before the line is back, so no message to customers gives one. The Head of Marketing and Communications, as communications lead, sends each message at its latest time, approved by the Chief Operating Officer as crisis lead. A third update would have fallen due at 20:40; the line was back first:
Latest time | To | Message | What it says |
|---|---|---|---|
07:40 | Staff | OM-01 Staff first message | What has happened, the printed pick lists at Warehouse 2, and a plan for the whole day: no time for the repair yet |
08:40 | Customers | OM-02 Customer first message | Some orders from Warehouse 2 may be a day late; perishable first; whom to call. With it: OM-06, OM-07, OM-08 prepared, a copy to staff |
12:40 | Staff and customers | OM-03 Update 1 | Nothing has changed; still no time for the repair |
16:40 | Staff and customers | OM-03 Update 2 | Nothing has changed; still no time for the repair |
18:40 | Staff and customers | OM-04 Service restored | The line was repaired at 18:40; dispatch at Warehouse 2 is back to normal; thanks |
What every message says
Every message answers the same four questions, in this order, in plain words: what has happened, in facts only; what still works, including the workaround, because it is what most readers act on; what to do, the one or two things this reader should do or not do; and when the next update will come, a time that is then kept, even when there is nothing new to say. That is the outage message the pack defines (RR-27).
Every message also says when the service will be back, and states only a time the technical recovery lead has given, with what that time depends on; until there is one, it says so. A supplier's contracted repair time is the longest the contract allows, not an estimate for today: staff may plan around it, but no message to customers passes it on as a promise. A time given and then missed costs more trust than no time at all.
What every message avoids
- A guess at the cause. Say what failed. Leave out why until the technical recovery lead has confirmed it. Never say whether it is a cyberattack; if anyone suspects one, the messages move to P09 (see When this set does not apply).
- Blame. Do not name a supplier or a colleague as the cause in a message that leaves the organisation.
- Promises about money. Do not offer compensation, credits or refunds, or accept fault, without [[the approver of such offers, e.g. Legal or the Chief Financial Officer]].
- Jargon. Write for a customer who does not work in IT: say the warehouse has lost its network connection, never that the site's circuit is down.
- Contradiction. Every message is filled in from one facts sheet, kept by the communications lead. A figure changes there first, then in every message after it.
The message set
Each message has its use, then a table: the template on the left, with [[placeholders]] to replace and lines to delete where they do not apply, and on the right the same message filled in for the illustration, which is not an event in the example's story. The crisis lead approves every message (RA-15); in the illustration, the Chief Operating Officer.
OM-01 Staff first message
Staff run the workaround and answer the customers, so they hear first. Send it even when little is known: a short message on time is worth more than a full one late.
When: Within [[1]] hour of the crisis lead declaring the disruption (RR-27). To: staff whose work the disruption changes, and [[any other staff who will notice it]]. EXAMPLE: sent 13 Oct 2026, 07:40, to all staff at Warehouse 2, and the customer contact team.
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[Text message from a service outside your own systems; the site or unit lead's briefing; email where it works]] | The Warehouse 2 call tree, started as a first step of the site's plan; [[a text message to the customer contact team]] |
Subject | [[the service, site or team affected]]: [[what is disrupted, in a few words]]. What to do | Warehouse 2: network line down. What to do |
Greeting | Dear colleagues, | Dear colleagues, |
What has happened | [[What has happened: what, where and since when. No guess at the cause]] | At 06:20 Warehouse 2's network line failed, so the site has no connection to our systems. The network connectivity provider is repairing it. |
What still works | [[What still works, and the workaround in use]] | Warehouses 1 and 3 are working normally. Warehouse 2 is dispatching from its printed pick lists, perishable orders first. |
What to do | [[What staff should do, by site or team: e.g. run the workaround]] | At Warehouse 2: pick from the printed pick lists, perishable orders first. Delivery note pads and carrier manifest forms are in the dispatch office cupboard. Everywhere else: carry on as normal. |
When it will be back | [[Only a time the technical recovery lead has given, and what it depends on; otherwise: We do not yet know. We will tell you as soon as we do]] | We do not have a time for the repair yet. The network connectivity provider's contract gives it up to 12 hours to repair a failed line, so plan for the printed pick lists to carry the whole day. We will tell you as soon as the Head of IT has a time. |
If anyone asks | Do not talk or post about this outside the organisation. Pass questions from customers to [[the customer contact team]] and from journalists to [[Name]], Communications lead. You will see each message to customers as it goes out. | Do not talk or post about this outside the organisation. Pass questions from customers to the customer contact team and from journalists to [[Name]], Head of Marketing and Communications. You will see each message to customers as it goes out. |
Next update | [[time and date of the next update]]. | By 12:40 today, or sooner if anything changes. |
Signed | [[Name]], [[role, e.g. Crisis lead]] | [[Name]], Chief Operating Officer |
OM-02 Customer first message
Tell only the customers whose service is affected, and lead with what still works and what to do. Copy it to the staff who had OM-01, so that none of them hears the news from a customer first.
When: Within [[2]] hours of the declaration (RR-27). To: customers whose service the disruption affects. EXAMPLE: sent 13 Oct 2026, 08:40, to customers with orders due from Warehouse 2 today; a copy to the staff who had OM-01.
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[Email from the customer service mailbox or the account managers]] | [[Email from the customer service mailbox]] |
Subject | [[Organisation Name]]: [[what the disruption means for customers, in a few words]] | [[Organisation Name]]: some deliveries from our Warehouse 2 may be a day late |
Greeting | Dear [[Customer name]], | Dear [[Customer name]], |
What has happened | [[What has happened, in plain words: what, where and since when]] | Since 06:20 today a network line failure has left our Warehouse 2 without its connection to our systems. Our line provider is repairing it. |
What still works | [[What still works for the customer]] | Our other warehouses are working normally, and Warehouse 2 is sending perishable orders first. |
What it means for you | [[What it means for this customer]] | Some other orders from Warehouse 2 may arrive a day late. |
What to do | [[What the customer should do, and how to reach us]] | Nothing for most orders. If an order you need today is due from Warehouse 2, call our customer contact team on [[number]]. |
When it will be back | [[Only a time the technical recovery lead has given, and what it depends on; otherwise: We do not yet know. We will tell you as soon as we do]] | We do not yet know when the line will be repaired. We will tell you as soon as we do. |
Next update | [[time and date of the next update]]. | By 12:40 today. |
We are sorry for the disruption. | We are sorry for the disruption. | |
Signed | [[Name]], [[role, e.g. Crisis lead]] | [[Name]], Chief Operating Officer |
OM-03 Update
Send it on time even when nothing has changed, and say so; send one at once when something changes. Staff and customers each get a version: only the What to do line differs.
When: Every [[4]] hours after the customers' first message, and at each change, until the end of recovery (RR-27). To: everyone who had a first message. EXAMPLE: sent 13 Oct 2026, 12:40, to the same customers; the staff version repeats OM-01's What to do.
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[The channels of the first messages]] | [[As OM-01 and OM-02]] |
Subject | Update [[n]]: [[what is disrupted, in a few words]] | Update 1: deliveries from our Warehouse 2 |
What has changed | [[What has changed since the last message, or: Nothing has changed]] | Nothing has changed. The line is still being repaired, and Warehouse 2 is still sending perishable orders first. |
What still works | [[What still works, and the workaround in use]] | Our other warehouses are working normally. |
What to do | [[What this audience should do now]] | Nothing for most orders. If an order you need today is due from Warehouse 2, call our customer contact team on [[number]]. |
When it will be back | [[Only a time the technical recovery lead has given, and what it depends on; otherwise: We do not yet know. We will tell you as soon as we do]] | We still do not have a time for the repair. We will tell you as soon as we do. |
Next update | [[time and date of the next update]]. | By 16:40 today, or sooner if the line is back. |
Signed | [[Name]], [[role, e.g. Crisis lead]] | [[Name]], Chief Operating Officer |
OM-04 Service restored
Send it when the crisis lead declares the end of recovery (RR-17). The first system coming back is too early. It is the last message about the disruption.
When: When the crisis lead declares the end of recovery (RR-17). To: everyone told earlier. EXAMPLE: sent 13 Oct 2026, 18:40, to everyone told earlier; the staff version thanks the Warehouse 2 team.
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[The channels of the first messages]] | [[As OM-01 and OM-02]] |
Subject | Back to normal: [[the service, site or team affected]] | Back to normal: deliveries from our Warehouse 2 |
Greeting | Dear [[Customer name, or colleagues]], | Dear [[Customer name]], |
What has happened | [[What is back, and since when]] | Warehouse 2's network line was repaired at 18:40, and dispatch there is back to normal. |
What happens now | [[What happens to the backlog, and who tells customers about anything still late]] | Some orders from Warehouse 2 may still arrive a day late, as we said this morning. |
What to do | [[What to do now, or: Nothing]] | Nothing. |
Thank you | [[Who to thank, and for what]] | Thank you for your patience today. |
This is our last message about this disruption. If it still affects you, contact [[phone number, email and opening hours]]. | This is our last message about this disruption. If it still affects you, contact our customer contact team on [[number]]. | |
Signed | [[Name]], [[role, e.g. Crisis lead]] | [[Name]], Chief Operating Officer |
OM-05 Supplier or carrier notice
The site or unit lead may phone suppliers and carriers at once as a first step of its plan (RR-22); this notice confirms it in writing. Calling on a supplier's own recovery commitment is a separate call, by the supplier liaison (RA-14).
When: As soon as their work changes. To: suppliers and carriers whose work the disruption changes. EXAMPLE: after the Warehouse 2 Manager has phoned them, a first step of the site's plan, to the three carriers (SUP-007, SUP-008, SUP-009).
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[Email to the contract's contact, after a phone call]] | [[Email to each carrier's contact]] |
Subject | [[Organisation Name]]: [[what changes for the supplier, in a few words]] | [[Organisation Name]]: collections from Warehouse 2 today |
Greeting | Dear [[Supplier or carrier contact name]], | Dear [[Carrier contact name]], |
What has happened | [[What has happened: what, where and since when. No guess at the cause]] | At 06:20 Warehouse 2's network line failed, so the site has no connection to our systems. The network connectivity provider is repairing it. |
What changes for you | [[What changes for the supplier]] | Perishable orders are loaded first, and there may be fewer other orders than usual. Manifests come on the paper forms until the line is back. |
What we ask of you | [[What we ask of the supplier, and by when]] | Please collect at your usual times and accept the paper manifests. |
When it will be back | [[Only a time the technical recovery lead has given, and what it depends on; otherwise: We do not yet know. We will tell you as soon as we do]] | We do not yet know when the line will be repaired. We will tell you as soon as we do. |
Please refer any question from our customers or the press to [[Name]], Communications lead. | Please refer any question from our customers or the press to [[Name]], Head of Marketing and Communications. | |
Your contact | [[Name, role and phone]]. Next update: [[time and date of the next update]]. | [[Name]], Warehouse 2 Manager, [[phone]]. Next update: when the line is back, or sooner if anything changes for you. |
OM-06 Website or status-page notice
Customers who are not on your mailing list look at your website. Keep the notice the same as the emails, and host it where it can be changed when the main systems are down.
When: Posted with the customers' first message, changed with each update, replaced when the service is back. To: customers and the public. EXAMPLE: sent 13 Oct 2026, 08:40, to customers and the public.
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[A banner on your website, or a status page hosted apart from your own systems]] | [[A banner on the online ordering site]] |
Heading | [[A heading a customer understands at a glance]] | Some deliveries from our Warehouse 2 may be a day late |
Posted | [[date and time posted; time of each change]] | 13 Oct 2026, 08:40; changed at 12:40 and 16:40; replaced by a service-restored notice at 18:40 |
What has happened | [[What has happened, in plain words: what, where and since when]] | Since 06:20 today a network line failure has left our Warehouse 2 without its connection to our systems. Our line provider is repairing it. |
What still works | [[What still works for the customer]] | Our other warehouses are working normally, and Warehouse 2 is sending perishable orders first. |
What it means for you | [[What it means for this customer]] | Some other orders from Warehouse 2 may arrive a day late. |
What to do | [[What the customer should do, and how to reach us]] | Nothing for most orders. If an order you need today is due from Warehouse 2, call our customer contact team on [[number]]. |
When it will be back | [[Only a time the technical recovery lead has given, and what it depends on; otherwise: We do not yet know. We will tell you as soon as we do]] | We do not yet know when the line will be repaired. We will tell you as soon as we do. |
Next update | [[time and date of the next update]] | By 12:40 today |
OM-07 Call-handling script
The call handlers are your largest channel in an outage, and the first to hear a question the messages did not answer. Give them the script before the customers' first message goes out.
When: Given to them with the customers' first message, and changed with each update. To: everyone who answers customers' calls [[e.g. the customer contact team, reception, a contact centre]]. EXAMPLE: sent 13 Oct 2026, 08:40, to the customer contact team, and the outsourced customer contact centre (SUP-013).
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[Sent to each team leader and read out at each shift]] | [[Sent to each team leader and read out at the shift briefing]] |
Say first | [[What the call handler says before the caller asks, e.g. If you are calling about a delivery today: …]] | If you are calling about a delivery today: our Warehouse 2 has lost its network connection, and some orders from it may arrive a day late. Perishable orders are going out first. |
If asked about an order | [[How to check whether this caller's order or service is affected, and what to tell them]] | Check which warehouse sends the order. From Warehouses 1 and 3: not affected. From Warehouse 2: perishable orders go out first; other orders may arrive a day late. If the customer needs it today, [[take the order number and pass it to Warehouse 2]]. |
If asked when it is back | [[Only a time the technical recovery lead has given, and what it depends on; otherwise: We do not yet know. We will tell you as soon as we do]] | We do not yet know when the line will be repaired. We will tell you as soon as we do. |
If asked the cause, or about an attack | [[Only a cause the technical recovery lead has confirmed, in one plain sentence. Otherwise: We are still finding out what caused it]] | A network line to the warehouse failed, and the line provider is repairing it. |
Journalists and compensation | A journalist: answer no questions; take their name, number and deadline and pass them at once to [[Name]], Communications lead. Compensation: note what they say, promise nothing, and pass it to [[role, e.g. the Customer Contact Manager]]. | A journalist: answer no questions; take their name, number and deadline and pass them at once to [[Name]], Head of Marketing and Communications. Compensation: note what they say, promise nothing, and pass it to the Customer Contact Manager. |
After each call | Log the time, the caller, what they asked and what you said. Pass any question the script does not answer to the communications lead at once. | Log the time, the caller, what they asked and what you said. Pass any question the script does not answer to the communications lead at once. |
OM-08 Media holding line
Most outages never reach the press. Prepare the line with the first messages anyway; only the communications lead uses it (RA-15).
When: Prepared with the first messages; used only if a journalist asks or the disruption becomes public. To: journalists, and the public where the disruption is visible. EXAMPLE: prepared at 08:40 with the customers' first message, to any journalist who asks.
Template | EXAMPLE, an illustration | |
|---|---|---|
Channel | [[Read or sent by the communications lead to a journalist who asks]] | [[Read by the communications lead]] |
Statement | [[A short paragraph: what has happened and since when, what still works, what customers should do, when the next update will come]] | A network line failure at our Warehouse 2 has affected deliveries from it since 06:20 today. Perishable orders are going out first, and some other orders from Warehouse 2 may arrive a day late. Our other warehouses are working normally. We are telling the customers affected directly and will update them by 12:40. |
If asked the cause, or about an attack | [[Only a cause the technical recovery lead has confirmed, in one plain sentence. Otherwise: We are still finding out what caused it]] | A network line to the warehouse failed, and the line provider is repairing it. |
If asked when it is back | [[Only a time the technical recovery lead has given, and what it depends on; otherwise: We do not yet know. We will tell you as soon as we do]] | We do not yet know when the line will be repaired. We will tell you as soon as we do. |
If asked anything else | We will say more when we know more. I will come back to you by [[time]]. | We will say more when we know more. I will come back to you by [[time]]. |
Spokesperson | [[Name]], Communications lead; deputy [[Name]] | [[Name]], Head of Marketing and Communications; deputy none named (RRM-07) |
Channels that work when the main systems are down
An outage can take away the channels you would use to talk about it: a site's email, the intranet, the phone system. As RR-16 does for the plans and contact lists, keep for each audience at least one channel that does not depend on the systems most likely to fail.
Channel | Reaches | What it needs | Check |
|---|---|---|---|
Text messages to staff phones | Staff, wherever they are | [[A messaging service that runs outside your own network and sign-in directory, with staff numbers kept current]] | [[A test message every quarter]] |
The call tree, briefings and the noticeboard | Each site's or unit's staff, including those without email | The printed call tree in each site's or unit's plan (RR-22), and the site or unit lead and shift supervisors | [[At each exercise, and when people join or leave]] |
A second route for email | Customers and suppliers, when your own email or a site's connection is down | [[e.g. sending from another site, or from a mailbox outside your own email service]] | [[Once a year]] |
Website banner or status page | Customers and the public | [[A page hosted apart from the systems it reports on, that the communications lead and a deputy can change from a phone]] | [[Once a year]] |
Telephones of the customer contact team | Customers who call | [[Lines that do not depend on the failed systems, or a diversion to a contact centre]] | [[At each exercise]] |
EXAMPLE. Warehouse 2's plan and call tree are printed in the site office, and held at home by the manager and the deputy, and starting the call tree is one of the plan's first steps: that is how OM-01 reached the site's staff while the line was down. The distributor's other channels stay as placeholders.
When email and chat are the outage, use the contact list kept offline and the channel agreed in advance. That means the printed call tree and the printed contact list, whose numbers answer without your own phone system, and text messages sent from a service outside your own network and sign-in directory. Test them on the schedule in the table, so that nobody learns on the day that the list is out of date.
Contact list
The people a disruption needs in its first hours, each with a deputy (RR-19), and the outside contacts. Every number must answer out of hours without your own phone system. Keep the list printed with this set and on each holder's phone.
Role or contact | Holder, deputy and 24/7 numbers | EXAMPLE |
|---|---|---|
Crisis lead | [[holder, deputy, numbers]] | Chief Operating Officer; deputy Chief Financial Officer |
Communications lead | [[holder, deputy, numbers]] | Head of Marketing and Communications; deputy none named (RRM-07) |
Technical recovery lead | [[holder, deputy, numbers]] | Head of IT; deputy IT Operations Manager |
Incident manager | [[holder, deputy, numbers]] | Information Security Manager; deputy Head of Information Security |
Site or unit continuity lead | [[holder, deputy, numbers]] | Warehouse 2 Manager; deputy Warehouse 2 Shift Supervisor |
Supplier liaison | [[holder, deputy, numbers]] | Procurement Manager; deputy Finance Manager |
[[Each line or network provider]] | [[name, reference, number]] | Network connectivity provider (SUP-014): repairs, through the technical recovery lead |
[[Each carrier or key supplier]] | [[name, number]] | The three carriers (SUP-007, SUP-008, SUP-009): OM-05 |
[[Outsourced contact centre]] | [[name, number]] | Outsourced customer contact centre (SUP-013): OM-07 |
[[Website or status-page host]] | [[name, number]] | [[host]]: OM-06 |
Required inputs with owners
Every message is filled in from one facts sheet, kept by the communications lead and dated at each change. Each fact comes from its owner, and a message states only what the sheet states.
Input | Used in | Owner |
|---|---|---|
The disruption, and when the crisis lead declared it | All | Crisis lead |
The services, sites and customers affected | All | Business owner |
What still works, and the workaround in use | All | Business owner, Site or unit continuity lead |
What staff should do | OM-01, OM-03 | Site or unit continuity lead |
What customers should do, and how they reach us | OM-02, OM-03, OM-06, OM-07 | Communications lead |
When it will be back, and what that depends on | All | Technical recovery lead |
Any sign that the disruption is an attack | All: a sign moves the messages to P09 | Incident manager |
Whether a notice to an authority is due | None: P09 and P18 make every such notice | Incident manager |
Suppliers and carriers affected, and what changes for them | OM-05 | Supplier liaison |
Messages sent, and the next update | All | Communications lead |
EXAMPLE. When OM-01 went out at 07:40, the sheet's line on the repair read: no time yet; the contract, a failed line restored within 12 hours. Staff could plan around the contract. Customers were told only that no time was known.
Message approval log
Log every message that leaves the crisis team, with the text actually sent and a dated copy of the facts sheet each time it changes: the log shows whether each message went within the time RR-27 sets. The EXAMPLE rows are the illustration's messages with a fixed time; OM-05 went after the Warehouse 2 Manager's call, and OM-08 was not needed.
Ref | Message | To | Due by | Sent | Approved by | Channel |
|---|---|---|---|---|---|---|
[[MSG-nn]] | [[OM-nn]] | [[audience]] | [[time]] | [[time]] | [[name and role]] | [[channel]] |
MSG-01 EXAMPLE | OM-01 | Warehouse 2 staff; customer contact team | 07:40 | 07:40 | Chief Operating Officer | Call tree |
MSG-02 EXAMPLE | OM-02, with OM-06 and OM-07 | Customers due from Warehouse 2 | 08:40 | 08:40 | Chief Operating Officer | [[Email]]; [[Banner]] and [[Team leaders]] |
MSG-03 EXAMPLE | OM-03 (1) | Staff and customers | 12:40 | 12:40 | Chief Operating Officer | [[As OM-01, OM-02]] |
MSG-04 EXAMPLE | OM-03 (2) | Staff and customers | 16:40 | 16:40 | Chief Operating Officer | [[As OM-01, OM-02]] |
MSG-05 EXAMPLE | OM-04 | Everyone told earlier | 18:40 | 18:40 | Chief Operating Officer | [[As OM-01, OM-02]] |
Follow-up template
After OM-04, the communications lead completes this lessons note, headed with the disruption, its dates and what it affected. It goes into the review of the service's plan after a real recovery (RR-16) and of the site's or unit's plan after it is used (RR-22).
Question | Answer |
|---|---|
Was each message sent within its time (RR-27)? If not, why not? | [[answer, from the approval log]] |
Did any message give a repair time the technical recovery lead had not given? Did staff hear anything from a customer first? | [[answer]] |
Which channels failed, who missed a message they needed, and what did callers ask that the script could not answer? | [[answer]] |
Did anyone speak or post outside the organisation other than the communications lead? | [[answer, and what was done]] |
What should change in this set, the contact list or the channels? | [[change, owner, date]] |
Adapting this template
Guidance — delete before approval
Small organisation: keep the first messages, the update rhythm and the rule on repair times. One person may send every message, but not one who leads the crisis or the technical recovery in the first hour (RR-19).
Regulated entity (NIS2, DORA): reports to authorities stay with P09 and the P18 pack. A provider named in Article 1 of the NIS2 Implementing Regulation checks the contact list and the channels against Annex points 4.1.2 and 4.3.2 with counsel; a financial entity under DORA reads this set against Article 14 with [[legal or compliance]].
Service run by a supplier: its status page is not your message. Tell your own customers, from these templates.
Set every [[placeholder]] that does not depend on a disruption, and apply your style guide, before approval. Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; ISO 22301:2019 incl. Amd 1:2024 (clause numbers and titles only); NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR); 45 CFR Part 164 (HIPAA Security Rule, eCFR current to 6 October 2026); AICPA Trust Services Criteria (number and series title only).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.29 — Information security during disruption | When this set does not apply: a suspected attack moves the messages to P09 |
NIST CSF 2.0 | RC.CO-03 — “Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders” | OM-01 to OM-04 and the timings, until the end of recovery |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management” | The whole set, within crisis management |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Legal note: who the Implementing Regulation binds |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.1.2 — “The relevant entities’ operations shall be restored according to the business continuity and disaster recovery plan.” The plan is based on the risk assessment (point 2.1) and includes, where appropriate: purpose, scope and audience; roles and responsibilities; key contacts and communication channels; conditions for plan activation and deactivation; order of recovery for operations; recovery plans for specific operations, including recovery objectives; required resources, including backups and redundancies; restoring and resuming activities from temporary measures | The contact list; the channels that work when the main systems are down |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.3.2 — the crisis management process addresses at least “roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow”; appropriate communication means between the entity and the relevant competent authorities, covering both obligatory and non-obligatory communications; and measures to maintain network and information system security in crisis situations | Who speaks for us; communication with authorities stays with P09 and P18 |
DORA — Regulation (EU) 2022/2554 | Article 11(7) — “Financial entities, other than microenterprises, shall have a crisis management function”, which, when the ICT business continuity plans or ICT response and recovery plans are activated, sets out clear procedures to manage internal and external crisis communications (Article 14) | Financial entities only: the approvals and the timings |
DORA — Regulation (EU) 2022/2554 | Article 14(1) — “financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate” | Financial entities only: OM-02, OM-06 and OM-08; a major ICT-related incident is disclosed under P09 and P18 |
DORA — Regulation (EU) 2022/2554 | Article 14(2) — “financial entities shall implement communication policies for internal staff and for external stakeholders”; the policies for staff take into account “the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed” | Financial entities only: OM-01 and OM-03 for staff to be informed, apart from the crisis team |
DORA — Regulation (EU) 2022/2554 | Article 14(3) — “At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose.” | Financial entities only: one communications lead, with a named deputy |
ISO 22301:2019 incl. Amd 1:2024 | Clause 8.4.2 — Response structure (clause number and title only) | Who speaks for us; approving messages |
ISO 22301:2019 incl. Amd 1:2024 | Clause 8.4.3 — Warning and communication (clause number and title only) | The message set, the timings and the channels |
ISO/IEC 27001 references name the clause or control this document relates to; ISO 22301 is named by clause number and title only, and its text is not reproduced. Neither says that meeting one meets any other framework's requirement.
Definitions
Term | Meaning in this template set |
|---|---|
Approval log | The record of every outage message sent: which template, to whom, who approved it, when it was due, when it was sent, and how. |
Declared | The moment the crisis lead declares the disruption of a critical service. Every message time is counted from it, which may be later than the fault. |
End of recovery | The point at which the crisis lead declares every affected critical service back in normal operation, on the criteria the plan sets, and the records are complete (RR-17). |
Facts sheet | The single, dated record of what is known about a disruption, kept by the communications lead, from which every message is filled in. |
Holding line | A short statement for a journalist that says what is known and when more will follow, before the full picture is available. |
OM-nn | A message in this template set. |
Outage message | A message to staff, customers or suppliers about a disruption, from an approved template: what has happened, what still works, what to do, and when the next update will come (RR-27). |
Workaround | A way of running the service, or its most important part, without its systems for a set time, such as dispatch from printed pick lists. Owned and accepted by the business owner (RR-06). |