Crisis Comms / Holding Statement Lab
A breach is live and the questions are already coming. Now the hard part: do you issue a holding statement or wait, what can you honestly promise, who speaks, and in what order do regulators, customers, employees and the public hear it? Run the comms war room and make each call the way it holds up afterwards — say something early without speculating, never promise "safe" or "fully contained" before you know, keep one source of truth, and correct a wrong statement fast. Each decision shows you why, while the news cycle keeps moving.
Pair this drill with the free Breach Crisis Communications Kit — the holding statement, notification emails and spokesperson matrix you practise here. Educational drill, not legal or PR advice.
The real job. More noise, a tighter clock.
A breach is live and the questions are already coming. You run the comms war room. Work 10 decisions — hold statement or go silent, what you may and may not promise, who speaks, how you sequence the notifications, and how you correct an early statement that turns out wrong — then see why. You are graded on how many you get right against the clock, while the news cycle moves.
What this lab is
- A free, browser-based decision drill on communicating during a live breach: work ~14 war-room decisions about whether to issue a holding statement, what you can and cannot promise, who speaks, and how you sequence the notifications.
- The core discipline: get out an accurate holding statement early rather than go silent — but never speculate on cause or scope, and never promise "your data is safe" or "fully contained" before you know.
- You practise the real traps: a single source of truth and spokesperson, employees not learning from the news, coordinating the message with the 8-K and breach notices, correcting a wrong early statement, and not over-notifying to the point of crying wolf.
- Each decision reveals why the defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal or PR advice. Pair it with the free Breach Crisis Communications Kit.
Frequently asked questions
What is the Crisis Comms Lab?
A free, in-browser decision simulation that puts you in the comms war room during a live data breach. You work through the hard calls — hold statement or stay silent, what you may promise, who speaks, how to sequence regulators, customers, employees and the public, and how to correct an early statement that turns out wrong — and each one has a single defensible answer, revealed after you lock in your call.
Should you say anything before you know the full story?
Usually yes — a short, factual holding statement (you are aware, investigating, taking it seriously, will update) controls the narrative without committing to facts you do not have. What you must not do is speculate on cause, scope or attribution, or make absolute promises like "your data is safe" or "fully contained" that forensics may later contradict.
Is this legal advice?
No. The lab is an educational drill. Breach communications sit on top of real legal and regulatory notification duties that vary by jurisdiction and sector and change over time. Always coordinate your actual statements, timing and notifications with qualified counsel and your regulatory obligations.
Who is it for?
CISOs, communications and PR leads, general counsel, investor-relations teams, incident commanders and executives — anyone who would be in the room deciding what the company says, to whom, and in what order when a breach goes public, and who wants to rehearse those calls before it is real.