Crisis Response and War Room Best Practices

The recent CrowdStrike crisis has leaders revisiting their crisis response preparation. I wrote last week about the specifics of how Crowdstrike navigated the challenge and documented all of their communications for future use as templates.?

This week, I’ve gathered resources and best practices from top CMOs, PR leaders, and marketers who have been in the trenches and lived to tell. If you only do one thing before you move on to your 1 million other priorities - make a list of all critical people, get their cell phone #s, and print it out. If you’re going to make a bigger effort, below are essential elements. Harness the energy of the moment!?

1. Prepare in Advance: Policies and Training

PagerDuty has some of the best training resources, given their focus on incident resolution:??

• Training Hub: The PagerDuty Incident Response Training Hub goes deep on training, preparation, and policy development. Love it! Nice job!
• War Room: For the most critical incidents, you may want to set up a “war room” where key leaders are together in real-time, quickly making decisions, setting communication timelines, and debating challenges. Pagerduty War Room Best Practices?
• Incident Commander: It’s critical to identify the right contacts for roles and responsibilities (and get their cell #s!). Even better, assign and train an incident commander (and maybe a backup, too) before you need one. PagerDuty Incident Commander Best Practices
• YOUR Documentation and Process: Create your own clear crisis procedures for key players, key stakeholders, key communications, processes, and communications. Again, maybe print them out. Just in case.?
• Outline Stakeholders and All Channels: Where do customers get your communications - web, support hub, multiple social platforms, emails, in-product… How about partners? Investors? Work your way through your stakeholders and channels to know what you will need to share where.?
• Multiple Channels For Firefighting: You need to have multiple communication channels set up for your own team (cell, chat, email). I was once in a crisis where our crisis response rooms were in chat, but chat being down for ourselves and our customers was the crisis!
• Hire a Risk Manager: As companies grow, they often hire someone to be the point person for this type of work, so it’s not just a side project of an industrious person or group but a dedicated focus area to train and prevent risk.

2. Designate Your Crisis Management Team

The right crisis management team is?cross-functional?and often very senior. It includes representatives from engineering, finance, legal, communications, and executive leadership. Depending on the severity of the issue, some people will need to be fully dedicated to firefighting and will need quick and frequent access to senior leaders. (CrowdStrike CEO George Kurtz did most of the communicating initially).?

One of the best stories I heard was from Frédéric Mathieu , co-founder and Managing Partner of Facta and a former CMO. “When I was at Intel, we had a fitness tracker that started burning people's skin. Major financial and reputational risks. The company had a process designed to deal with this type of situation…They mashed up together engineers to understand and solve the problem, finance to asses cost-of-fix scenarios, legal to review options, communications, and marketing for messaging and media/analysts relations (+ internal comms), and an executive sponsor (SVP / EVP level). This group of people was removed from their day-to-day jobs, had virtually unlimited budgets, and were reporting on progress directly to the CEO at least once a day. The interesting part was the mission: do what's best for the company with an explicit mandate to 1) not care about anyone's BU's KPIs 2) not care about who is to blame (although that will come later...). It was pretty powerful: get key people to focus on the problem at hand (vs be distracted by day job), shorten decision loops, show the rest of the company and the outside world a united front. The process went on for ~6 weeks and resulted in a global recall… [but was handled very professionally and swiftly]”?

3. Engage a Crisis Communications Agency

Many top companies rely on specialized agencies since crisis management is (hopefully) a rarely used skill. The first time I needed a crisis comms agency, I was lucky enough to know a top PR leader who returned my phone call at 6:30 AM on her vacation to give me the scoop. I had been up all night. Better to have made contact with an agency (or coordinate with your own PR agency) before you need them. I have used Joele Frank and have also been referred to FGS Global.

4. Use This Communications Checklist

There are many big challenges to communicating effectively in a crisis. First you realize there’s a problem, then you’re trying to evaluate the gravity of the situation and who needs to be involved. Unfortunately, while you’re evaluating what’s happening, why, and how far the problem extends, you’re often responsible for communicating to many different audiences - customers, partners, employees, investors, media companies… There’s a difficult balance between offering as much transparency as possible to retain trust while properly assessing the situation and your legal risk. So many lessons are learned the hard way. A few lessons CMOs and PR people called out specifically.?

• Prep Tailored Messages Ahead of Time: Some PR execs pre-write tailored messages for the most likely issues (service interruption, for instance) to have on hand ahead of time. Easier to edit under the stress of a crisis than create from scratch.
• Regular Check-Ins: Within the response team, you need someone to set up regular check-in cadences based on severity levels (possibly in a war room).?
• Frequent, Timely Updates: It’s critical to provide regular updates, even if full information isn’t available. You can communicate that you know the problem, that you are working on it, and establish a next time to update. In the CrowdStrike example, the CEO was sending out a new Tweet and deep dive update every 5 hours on the first day.?
• Legal Caution: Depending on the severity level, your Chief Legal officer will often be involved, advising on what can be said due to potential legal implications. One CMO said, “Be very careful about what you put in writing before you know what really went wrong. Lessons learned the hard way!”
• Central Communicator: Designate a central communicator for internal and external messages.
• FAQs: Many PR Leaders mentioned having effective FAQs before and during a crisis. CrowdStrike’s whole communication hub was set up as an FAQ.
• Employee Ambassadors: It’s critical to include employees, both as a concerned audience and as stewards of the message. You need to explicitly train leaders and front-line workers to share consistent, up-to-date messaging. You might have daily all-hands meetings or 2x/day verbal training for sales and customer support at a minimum.?
• Create VIP Communications Assignments: Quite often, it’s helpful to assign VIP customers, partners, or investors to different company executives for personal calls and updates. Ideally, you have an executive assignment of top customers all the time, so there is a relationship before the crisis. If not, there is no time like the present!?
• Resilience Under Pressure: Tensions run high in a crisis, and sometimes, people have had little sleep. It’s critical to have a thick skin?and try to be as calm and respectful as possible. As a leader, the rest of the company (and the market) takes cues from your energy.

5. Use PR and Social Listening Tools

It’s helpful if you have listening tools in place before a crisis.?

• Monitoring & Analyzing Trends: Tools to monitor and analyze volume, sentiment, and trends on social media can be very helpful.?Sprout Social?has some great tools for this, as does?Brandwatch. If you don’t have tools in-house, your PR firm might also be able to help you summarize and?analyze circulating information.
• Regular Analysis & Updates: Having a schedule for internal communications on PR and social trending is also critical. One top PR leader had internal goals of providing news summaries every few hours for Severity 1 issues and once a day for Severity 2 issues.??

6. Consider Global Implications

Teams with international employees and international customers need to consider how they will hand off communications and processes 24x7. Leverage a "follow the sun" approach where regions in daytime working hours take over for regions in nighttime hours as possible.

7. Run Simulations?

Many top companies conduct regular crisis simulations or “tabletop exercises” to make sure their roles and responsibilities are up-to-date, their playbooks are accurate, and they have the right people to quickly model decision-making for different scenarios. Plan for no-tech scenarios (when usual apps are down) and consider maintaining hard copies of critical information and playbooks.??

8. Analyze and Update Policies Post-Crisis?

Like any good project, some of the most important learnings come from our mistakes. After the crisis has passed, run a?post-mortem, document lessons learned, and update processes accordingly.

Who has the time for all of this while we’re trying to drive more growth, be more efficient, and get enough sleep ourselves? Do what you can given you resources and priorities. Save my Crowdstike blog as a template you can use as necessary. And call on the experts if you really need them. I hope that’s never!

Carilu Dietrich is a former CMO, most notably the head of marketing that took Atlassian public. She currently advises CEOs and CMOs of high-growth tech companies. Carilu helps leaders operationalize the chaos of scale, see around corners, and improve marketing and company performance.

Carilu's primary blog with templates and other resources is published at https://www.carilu.com/. Subscribe there for full access.