Required Inputs
- Organization: Company name, industry, size, and geographic footprint.
- Crisis History: Past incidents, near-misses, and lessons learned.
- Stakeholder Map: Key internal and external stakeholders (board, regulators, media, customers, employees, investors, partners).
- Existing Plans: Current BCP, DR, incident response, and communication plans.
- Risk Profile: Top enterprise risks from
enterprise-risk-assessmentskill output. - Regulatory Requirements: Mandatory notification obligations (breach notification laws, regulatory reporting, stock exchange disclosure).
Execution Steps
1. Crisis Classification Framework
Classify every potential crisis by severity to drive proportional response.
Severity Level Definitions
| Level | Name | Definition | Examples | Escalation Authority |
|---|---|---|---|---|
| 5 | Existential | Threatens organizational survival. Regulatory shutdown, mass casualty, systemic fraud discovery. | Major regulatory sanction, CEO arrested, product causes deaths | Board of Directors, CEO |
| 4 | Severe | Material financial, operational, or reputational impact. Multi-day disruption. National/international media attention. | Major data breach (>100K records), facility destroyed, class action lawsuit, hostile activist campaign | CEO, Crisis Management Team |
| 3 | Significant | Meaningful disruption to operations or reputation. Regional media attention. Regulatory inquiry likely. | Localized data breach, key system outage >24h, executive misconduct allegation, product recall | CMT Lead, C-suite sponsor |
| 2 | Moderate | Contained disruption. Internal impact primarily. Local media possible. | Single-site disruption, employee injury, negative social media trend, vendor failure | Business unit head, Communications |
| 1 | Minor | Routine incident handled through normal operations. No media interest. | IT help desk spike, minor customer complaint trend, small policy violation | Department manager |
Escalation Triggers (Any One Triggers Escalation to Next Level)
| From | To | Trigger |
|---|---|---|
| Level 1 | Level 2 | Media inquiry received; regulatory contact; social media amplification |
| Level 2 | Level 3 | National media pickup; regulatory investigation opened; financial impact > $1M; customer attrition spike |
| Level 3 | Level 4 | International media; multiple regulatory investigations; financial impact > $10M; stock price impact > 5% |
| Level 4 | Level 5 | Going concern risk; criminal investigation of leadership; mass harm confirmed; regulatory shutdown threatened |
2. Crisis Management Team (CMT) Structure
Core CMT Roles
| Role | Filled By | Primary Responsibility | Backup |
|---|---|---|---|
| CMT Leader | CEO or COO | Final decision authority, strategic direction | Deputy CEO or designated successor |
| Operations Lead | COO or VP Ops | Business continuity, operational response | Senior operations director |
| Communications Lead | CCO or VP Comms | All external and internal messaging, media | Senior communications manager |
| Legal Counsel | General Counsel | Legal exposure assessment, regulatory liaison, privilege protection | Outside counsel (pre-retained) |
| Finance Lead | CFO | Financial impact assessment, insurance, investor relations | VP Finance |
| HR Lead | CHRO | Employee safety, workforce communication, labor relations | VP HR |
| IT/Cyber Lead | CIO or CISO | Technology response, cyber incident management, forensics | IT Director |
| Business Unit Lead | Relevant BU Head | Subject matter expertise for affected area | BU deputy |
| External Advisors | Pre-retained firms | Crisis communications firm, forensic accountants, outside counsel | Identified alternates |
CMT Activation Protocol
| Severity Level | Activation | Assembly | Communication Mode |
|---|---|---|---|
| Level 5 | Automatic, full CMT | Immediate (within 1 hour), war room or secure virtual | Secure channel, all communications privileged |
| Level 4 | Automatic, full CMT | Within 2 hours | Dedicated crisis channel, attorney-client privilege invoked |
| Level 3 | CMT Lead activates relevant members | Within 4 hours | Designated crisis platform |
| Level 2 | Business unit lead notifies CMT Lead | Within 8 hours (assessment only) | Standard secure channels |
| Level 1 | No CMT activation | N/A | Normal escalation |
3. Decision Trees by Crisis Type
Each decision tree follows: Detect --> Assess --> Decide --> Act --> Communicate --> Review.
3A. Operational Crisis (Supply Chain Failure, Facility Loss, Key Vendor Collapse)
START: Operational disruption detected
|
+--> Can operations continue at >80% capacity?
| YES --> Level 1-2: Monitor, activate backup procedures
| NO --> Proceed
|
+--> Is customer delivery impacted?
| YES --> Level 3+: Activate BCP
| | +--> Backup facility available?
| | | YES --> Failover within RTO
| | | NO --> Invoke mutual aid / emergency vendor contracts
| | +--> Customer notification required?
| | YES --> Activate customer communication template
| NO --> Level 2: Internal remediation, enhanced monitoring
|
+--> Duration estimate?
< 24 hours --> Manage internally with status updates
24-72 hours --> CMT activated, stakeholder communication
> 72 hours --> Level 4: Full crisis response, regulatory notification if required
3B. Reputational Crisis (Negative Media, Social Media Viral, Executive Misconduct)
START: Reputational threat identified
|
+--> Is the allegation/story true?
| YES --> Acknowledge, take responsibility, announce corrective action
| NO --> Prepare factual rebuttal with evidence
| PARTIAL/UNCERTAIN --> Acknowledge concern, announce investigation, do NOT deny
|
+--> Is media coverage active?
| YES --> Activate Communications Lead
| | +--> Prepare holding statement (within 1 hour)
| | +--> Designate single spokesperson
| | +--> Monitor media and social channels continuously
| NO --> Prepare reactive statement, monitor for escalation
|
+--> Does it involve executive misconduct?
| YES --> Legal privilege immediately; board notification;
| | outside counsel leads investigation; consider executive leave
| NO --> Standard investigation protocol
|
+--> Social media velocity?
Trending --> Activate social media war room (see Section 6)
Contained --> Standard monitoring cadence
3C. Cyber Crisis (Data Breach, Ransomware, System Compromise)
START: Cyber incident confirmed
|
+--> Invoke incident response plan (link to cyber-risk-assessment skill)
+--> Contain: Isolate affected systems (DO NOT power off -- preserve forensics)
|
+--> Is personal data affected?
| YES --> Start breach notification clock
| | +--> GDPR: 72 hours to supervisory authority
| | +--> US state laws: Varies (30-90 days; check specific state)
| | +--> HIPAA: 60 days to HHS, affected individuals, media if > 500
| | +--> Engage breach counsel and forensic firm
| NO --> Assess operational and IP impact
|
+--> Is it ransomware?
| YES --> DO NOT pay without legal, insurance, and law enforcement consultation
| | +--> Engage law enforcement (FBI IC3, local field office)
| | +--> Activate offline backups
| | +--> Check cyber insurance policy for ransom coverage
| NO --> Standard containment and eradication
|
+--> Business impact?
Critical systems down --> Activate BCP/DR; CMT Level 4+
Non-critical systems --> Targeted remediation; Level 2-3
3D. Financial Crisis (Liquidity Event, Restatement, Covenant Breach)
START: Financial crisis indicator
|
+--> Going concern risk?
| YES --> Level 5: Board emergency session; engage restructuring advisor
| NO --> Assess severity
|
+--> Covenant breach?
| YES --> Immediate lender notification (most agreements require prompt notice)
| | +--> Engage financial advisor for waiver negotiation
| | +--> Prepare covenant compliance remediation plan
| NO --> Proceed to liquidity assessment
|
+--> Financial restatement required?
| YES --> Audit committee notification; SEC 8-K filing; investor communication
| | +--> Engage restatement counsel and forensic accountants
| NO --> Standard financial remediation
|
+--> Stock exchange disclosure required?
YES --> Draft 8-K/6-K with legal counsel within required timeframe
NO --> Internal remediation with board reporting
3E. Legal Crisis (Litigation, Regulatory Action, Government Investigation)
START: Legal crisis identified
|
+--> Government investigation / subpoena?
| YES --> IMMEDIATELY invoke legal privilege on ALL related communications
| | +--> Engage outside counsel with relevant expertise
| | +--> Implement litigation hold (preserve ALL documents, emails, data)
| | +--> DO NOT conduct internal interviews without counsel present
| | +--> Board notification (audit committee)
| NO --> Standard legal assessment
|
+--> Class action or mass litigation?
| YES --> Assess insurance coverage; engage mass tort counsel;
| | prepare investor communication; assess disclosure obligation
| NO --> Individual matter management
|
+--> Regulatory enforcement action?
YES --> Cooperate unless counsel advises otherwise
| +--> Assess self-disclosure benefit (DOJ cooperation credit, SEC whistleblower)
| +--> Prepare remediation narrative
NO --> Monitor and prepare defensive position
3F. Natural Disaster / Physical Crisis
START: Physical threat detected
|
+--> Is there immediate danger to life?
| YES --> Evacuate. Call emergency services. Account for all personnel.
| | NOTHING else matters until people are safe.
| NO --> Assess facility and asset impact
|
+--> Facility accessible?
| YES --> Damage assessment; secure affected areas
| NO --> Activate alternate work locations; remote work protocol
|
+--> Duration estimate?
< 3 days --> Temporary measures; employee communication
3-14 days --> BCP activation; customer notification
> 14 days --> Full relocation; insurance claim; regulatory notification if applicable
4. First 24 Hours Playbook (Golden Hour Protocol)
Hour 0-1: Detection and Initial Response
| Action | Owner | Deliverable |
|---|---|---|
| Confirm the incident is real (not rumor/false alarm) | First responder | Incident confirmation report |
| Classify severity level (1-5) | First responder + manager | Initial severity classification |
| Notify CMT Leader | First responder | Phone call (not email) |
| Activate CMT if Level 3+ | CMT Leader | Activation notification sent |
| Invoke legal privilege if Level 4+ | General Counsel | Privilege notice to all participants |
| Secure evidence and preserve records | IT/Legal | Litigation hold if applicable |
| Draft initial holding statement | Communications Lead | Holding statement approved by Legal |
Hour 1-4: Assessment and Mobilization
| Action | Owner | Deliverable |
|---|---|---|
| CMT assembles (physical or virtual war room) | CMT Leader | Attendance confirmed |
| Situation briefing (facts known, facts unknown, assumptions) | Incident owner | Situation report v1 |
| Stakeholder impact assessment | All CMT members | Stakeholder impact matrix |
| Identify mandatory notification obligations | Legal Counsel | Notification checklist with deadlines |
| Assign workstreams with clear owners | CMT Leader | Workstream assignment sheet |
| Establish communication cadence (CMT update frequency) | CMT Leader | Schedule set (typically every 2-4 hours for Level 4+) |
Hour 4-12: Containment and Communication
| Action | Owner | Deliverable |
|---|---|---|
| Execute containment actions per decision tree | Operations/IT Lead | Containment status report |
| Issue internal communication to employees | HR Lead + Comms | Employee notification |
| Issue external holding statement if required | Communications Lead | Press release / statement |
| Notify regulators if mandatory | Legal Counsel | Regulatory notification filed |
| Notify insurance carrier | CFO / Risk Manager | Claim notification |
| Update board / audit committee chair | CMT Leader | Board briefing memo |
Hour 12-24: Stabilization
| Action | Owner | Deliverable |
|---|---|---|
| Updated situation assessment | CMT | Situation report v2 |
| Detailed stakeholder communication (customers, partners) | Communications Lead | Stakeholder messages sent |
| Remediation plan drafted | Relevant leads | Remediation plan v1 |
| Resource needs identified (external advisors, additional staff) | CMT Leader | Resource request |
| Media monitoring summary | Communications Lead | Media/social media report |
| Next 24-hour action plan | CMT Leader | Action plan for Day 2 |
5. Stakeholder Communication Templates
5A. Employee Communication (Level 3+)
Subject: Important Update -- [Brief Description of Situation]
Team,
We are aware of [brief, factual description of what happened]. We are actively
managing the situation with the following steps:
1. [Immediate action taken]
2. [What we are doing to resolve]
3. [What employees should/should not do]
Your safety and well-being are our top priority. [If physical safety: follow
evacuation/safety procedures. If cyber: change passwords, be alert for phishing.]
We will provide updates every [frequency]. Direct questions to [designated contact].
Please do NOT speak to media, post on social media about this incident, or
share information outside the company. Direct all media inquiries to [name/number].
[Signature -- CEO or appropriate senior leader]
5B. Customer Communication (Level 3+)
Subject: [Company Name] -- Important Notice Regarding [Issue]
Dear [Customer],
We are writing to inform you of [factual description]. We take this matter
very seriously.
What happened: [Clear, factual explanation -- no speculation]
What we are doing: [Specific remediation steps]
What this means for you: [Direct impact assessment]
What you should do: [Specific, actionable steps for the customer]
[If data breach: We are offering [credit monitoring / identity protection]
at no cost. Enroll at [link] or call [number].]
We sincerely apologize for [the inconvenience / concern this may cause].
For questions, contact [dedicated support line/email].
[Signature -- CEO or relevant executive]
5C. Media Statement (Holding Statement -- Level 3+)
[Company Name] is aware of [brief description]. We are taking this matter
seriously and are actively [investigating / responding / working to resolve
the situation].
[The safety of our people / the security of our customers' data / the
continuity of our operations] is our highest priority.
We are working with [relevant authorities / external experts / law enforcement]
and will provide updates as more information becomes available.
Media contact: [Name], [Phone], [Email]
5D. Regulator Notification (Template)
[Date]
[Regulatory Body Name]
[Address]
Re: [Notification Type] -- [Company Name] -- [Reference Number if applicable]
Dear [Title/Name],
Pursuant to [specific regulation/statute requiring notification], we are
notifying [regulatory body] of [description of incident/event].
Date of discovery: [Date]
Nature of incident: [Brief factual description]
Scope of impact: [Number of individuals/entities affected]
Immediate actions taken: [Containment measures]
Ongoing investigation: [Status and expected timeline]
Point of contact: [Name, title, phone, email]
We will provide supplemental information as our investigation progresses.
Respectfully,
[Name, Title]
5E. Investor/Board Communication (Level 4+)
[Confidential -- Board / Investor Communication]
Subject: [Incident Type] -- Board Briefing [Date/Time]
Situation Summary:
[2-3 sentence factual summary]
Current Status: [Contained / Active / Escalating]
Financial Impact Assessment: [Estimated range or "under assessment"]
Regulatory Exposure: [Notification obligations and status]
Legal Exposure: [Litigation risk assessment -- privileged]
Reputational Impact: [Media coverage assessment]
Insurance Coverage: [Applicable policies and status of claim]
Actions Taken:
1. [Action and owner]
2. [Action and owner]
Board Action Required:
- [Approval / oversight / decision needed]
Next Update: [Date/time]
6. Social Media Response Protocol
Monitoring and Escalation
| Metric | Threshold | Action |
|---|---|---|
| Mentions per hour | > 50 | Alert Communications Lead |
| Mentions per hour | > 500 | Activate social media war room |
| Sentiment score | < -0.5 (negative) | Prepare proactive response |
| Influencer amplification | > 100K follower account posts | Direct engagement consideration |
| Hashtag trending | Appears in trending topics | Full war room; executive approval on all posts |
Response Decision Matrix
| Post Type | Response | Timing |
|---|---|---|
| Factual question | Answer with approved facts | Within 1 hour |
| Misinformation | Correct with facts (no arguing) | Within 30 minutes |
| Emotional/angry customer | Empathize, move to DM, resolve | Within 1 hour |
| Troll/bad faith actor | Do not engage | N/A |
| Media journalist post | Redirect to media contact | Within 30 minutes |
| Employee post (policy violation) | Internal HR follow-up (NOT public correction) | Within 2 hours |
Golden Rules for Crisis Social Media
- NEVER delete posts or comments (it will be screenshot and amplified).
- NEVER argue, be defensive, or blame others.
- ONE consistent voice -- all posts approved by Communications Lead.
- Acknowledge the situation even if you cannot share details.
- Provide a single link for updates (crisis landing page).
- Pause all scheduled marketing/promotional posts immediately.
7. Business Continuity Activation Triggers
| Trigger | BCP Component Activated | RTO Target |
|---|---|---|
| Primary facility inaccessible > 4 hours | Alternate work location plan | 8 hours |
| Core IT system down > RTO threshold | IT disaster recovery plan | Per system classification |
| Key vendor failure (no service delivery) | Vendor contingency / alternate vendor | 24 hours |
| Workforce unavailable > 30% | Remote work / cross-training activation | 4 hours |
| Pandemic / public health emergency | Pandemic response plan | 24 hours |
| Payment systems failure | Manual payment processing | 4 hours |
| Regulatory shutdown order | Legal response + appeal + temporary cessation | Immediate compliance |
8. Post-Crisis After-Action Review
Conduct within 2-4 weeks of crisis resolution while memory is fresh.
After-Action Review Structure
| Phase | Activities | Output |
|---|---|---|
| Data Gathering (Week 1) | Collect all crisis logs, communications, decisions, timelines | Chronological fact base |
| Stakeholder Interviews (Week 1-2) | Interview CMT members, front-line responders, affected stakeholders | Interview summaries |
| Analysis (Week 2-3) | Timeline reconstruction, root cause analysis (5 Whys), decision assessment | Analysis report |
| Findings Workshop (Week 3) | CMT reviews findings, identifies improvements | Prioritized improvement list |
| Report and Action Plan (Week 4) | Document findings, assign improvement actions | After-action report |
After-Action Review Template
## After-Action Review: [Crisis Name]
### Incident Summary
| Field | Detail |
|---|---|
| Crisis Type | [Classification] |
| Severity Level | [1-5] |
| Duration | [Start date/time -- End date/time] |
| Total Duration | [Hours/Days] |
| Financial Impact | [$X actual + $X estimated ongoing] |
| People Impacted | [Employees, customers, public] |
### Timeline of Key Events
| Date/Time | Event | Decision Made | By Whom | Outcome |
|---|---|---|---|---|
| [Timestamp] | [Event] | [Decision] | [Role] | [Result] |
### What Went Well
1. [Specific positive action or decision with evidence]
### What Did Not Go Well
1. [Specific gap or failure with evidence]
### Root Cause Analysis
[5 Whys or fishbone diagram output]
### Improvement Actions
| ID | Finding | Action | Owner | Deadline | Priority |
|---|---|---|---|---|---|
| AAR-001 | [Finding] | [Specific action] | [Role] | [Date] | [High/Med/Low] |
### Plan Updates Required
[List specific changes to crisis management plan, BCP, communication templates]
9. Crisis Simulation / Tabletop Exercise Design
Exercise Design Framework
| Element | Detail |
|---|---|
| Objective | Test specific plan components (e.g., CMT activation, communication, decision-making) |
| Scenario Type | Select from crisis types in Section 3 (rotate through all types over 2-year cycle) |
| Participants | CMT + relevant stakeholders (include board members annually) |
| Duration | 2-4 hours for tabletop; 4-8 hours for functional exercise |
| Facilitator | External facilitator recommended for objectivity |
| Injects | Pre-planned scenario escalations delivered at timed intervals |
Tabletop Exercise Template
| Phase | Duration | Activity | Inject |
|---|---|---|---|
| Setup | 15 min | Ground rules, scenario introduction, role confirmation | Initial scenario briefing |
| Turn 1 | 30 min | Initial response decisions | "Media is calling. What's your statement?" |
| Turn 2 | 30 min | Escalation and stakeholder management | "Regulator has contacted us. Social media is trending." |
| Turn 3 | 30 min | Complications and secondary impacts | "A second incident has been discovered. An employee leaked info." |
| Turn 4 | 30 min | Resolution and recovery decisions | "The immediate crisis is contained. What do you do next 30 days?" |
| Hot Wash | 30 min | Immediate participant feedback | Facilitated discussion |
| Debrief | 15 min | Key takeaways and next steps | Action item assignment |
Exercise Evaluation Criteria
| Criterion | Scoring (1-5) | Indicators |
|---|---|---|
| Detection and escalation speed | [1-5] | Time from inject to CMT notification |
| Decision-making quality | [1-5] | Decisions aligned with plan and good judgment |
| Communication effectiveness | [1-5] | Messages timely, accurate, appropriate for audience |
| Role clarity | [1-5] | Each CMT member knew their responsibilities |
| Coordination | [1-5] | Information shared across workstreams |
| Plan adherence | [1-5] | Team followed established procedures |
| Adaptability | [1-5] | Team adjusted when plan did not cover the scenario |
10. Reputation Recovery Roadmap
Phase 1: Immediate (Week 1-4 Post-Crisis)
| Action | Owner | Deliverable |
|---|---|---|
| Fulfill all commitments made during crisis | CMT Leader | Commitment tracker |
| Complete all regulatory notifications and filings | Legal Counsel | Filing confirmation |
| Launch customer remediation program (if applicable) | Business Lead | Program details and enrollment |
| Internal town hall -- transparent assessment | CEO | Town hall completed |
| Stakeholder check-in calls (top customers, partners, investors) | Relevant executives | Call log and feedback summary |
Phase 2: Rebuild (Month 2-6)
| Action | Owner | Deliverable |
|---|---|---|
| Publish remediation results and improvements | Communications Lead | Public update or report |
| Commission independent review (if warranted) | Board | Review engagement |
| Implement after-action review improvements | Relevant owners | Improvement progress report |
| Proactive media engagement (positive stories, executive visibility) | Communications Lead | Media plan and coverage |
| Customer and employee satisfaction pulse survey | HR / Marketing | Survey results and action plan |
Phase 3: Sustain (Month 6-18)
| Action | Owner | Deliverable |
|---|---|---|
| Track reputation metrics (NPS, trust scores, media sentiment) | Marketing / Communications | Monthly reputation dashboard |
| Demonstrate sustained improvement through third-party validation | Relevant function | Audit or certification |
| Share lessons learned externally (industry conferences, publications) | CEO / CMT Leader | Thought leadership content |
| Update all crisis plans based on lessons learned | Risk / CMT | Updated plans |
11. Legal Coordination Protocol
What TO Say
- Facts that are confirmed and verified
- Steps being taken to address the situation
- Commitment to transparency and accountability
- Specific remediation being offered to affected parties
- Information required by law or regulation to be disclosed
What NOT to Say
- Speculation about cause, scope, or blame before investigation is complete
- Admission of legal liability (distinguish "responsibility" from "liability")
- Number of affected individuals before count is confirmed
- Specific dollar amounts of damages or losses
- Anything that contradicts or could contradict regulatory filings
- Details that could compromise an ongoing investigation
- Information protected by attorney-client privilege
Legal Privilege Preservation
| Action | Purpose |
|---|---|
| Label all crisis communications "Privileged and Confidential -- Attorney Work Product" | Preserve attorney-client privilege |
| Route all investigation communications through counsel | Maintain privilege |
| Conduct internal investigation under legal direction | Create privileged work product |
| Separate business remediation (not privileged) from legal investigation (privileged) | Avoid inadvertent waiver |
| Do NOT forward privileged communications to third parties without counsel approval | Prevent waiver |
Output Template
## Crisis Management Plan: [Organization]
### Document Control
| Field | Detail |
|---|---|
| Version | [#] |
| Approved By | [CEO / Board] |
| Last Updated | [Date] |
| Next Review | [Date -- annual minimum] |
| Distribution | [Confidential -- CMT members, General Counsel, Board] |
### Crisis Classification Framework
[Severity levels 1-5 with escalation triggers]
### Crisis Management Team
[Roles, contact info, backup assignments]
### Decision Trees
[Crisis-type-specific decision trees]
### Golden Hour Protocol
[First 24 hours playbook]
### Communication Templates
[Pre-approved templates for each stakeholder group]
### Business Continuity Activation Triggers
[Trigger-response matrix]
### Reputation Recovery Roadmap
[Post-crisis recovery phases]
### Legal Coordination Protocol
[What to say / not say; privilege preservation]
### Exercise Schedule
[Annual tabletop and simulation calendar]
### Appendices
- A: CMT contact list (wallet card format)
- B: External advisor contact list (counsel, PR firm, forensics, insurance broker)
- C: Regulatory notification requirements by jurisdiction
- D: Insurance policy summary (coverage, limits, deductibles, notification requirements)
- E: Pre-approved holding statements by crisis type
Quality Checks
- Crisis classification framework has 5 distinct severity levels with specific, measurable escalation triggers between each level.
- CMT roles are defined with primary and backup assignments -- no single points of failure.
- Decision trees exist for all 6 crisis types (operational, reputational, cyber, financial, legal, natural disaster) and use branching logic, not linear checklists.
- Golden hour protocol covers the first 24 hours in specific time blocks with named owners and defined deliverables.
- Stakeholder communication templates exist for all key audiences (employees, customers, media, regulators, investors/board).
- Social media response protocol includes monitoring thresholds, response decision matrix, and explicit "do not" rules.
- Business continuity activation triggers link to specific BCP components with RTO targets.
- After-action review methodology includes root cause analysis (5 Whys or equivalent), not just "lessons learned."
- Tabletop exercise design includes injects, evaluation criteria, and scoring -- not just a discussion guide.
- Reputation recovery roadmap spans 3 phases (immediate, rebuild, sustain) over 18 months minimum.
- Legal coordination protocol explicitly defines what to say and what not to say, with privilege preservation procedures.
- All templates include attorney-client privilege markings where applicable.