No Speed Without Preparation: Why Crisis Communication Starts Long Before the Crisis

Since the Belgian NIS2 law came into force, many organisations have been working hard on their cyber resilience: incident reporting within 24 hours, business continuity, clear accountability at board level. That is good news. But one question often remains in the background: who communicates, what, to whom, and when?

We wish no organisation a cyberattack, or any other crisis. But being prepared for neither is naive at best, and poor governance at worst. Here is why crisis communication deserves a place in your preparation today, and what “being ready” actually looks like.

By Sofie Bockaert and Katrien Decroos, Partners at SoWhatCommunications powered by Square Circle

Every organisation is vulnerable

A crisis rarely announces itself. It can start with a workplace accident, a cyberattack, a product failure, an act of malice, an organisational error, a social conflict or a rumour that spreads faster than the facts. It can also start with a decision your organisation took itself, fully in line with the rules, that the outside world reads very differently.

The first consequences are often felt inside: unnecessary stress, frustration and, too often, people blaming each other. Then come the wider effects: operational disruption, legal exposure, pressure from media and authorities, and a loss of trust among employees, clients and partners that can take years to rebuild.

Crisis management decides. Crisis communication translates. Together.

Many organisations, especially larger ones, already have solid structures in place. It helps to be clear about what each of them does.

Business continuity keeps the organisation running: critical processes, systems, back-ups and recovery. Crisis management controls and resolves the situation: securing people and sites, limiting damage, taking decisions under pressure. Crisis communication protects trust and reputation: informing stakeholders, managing the narrative and speaking with one voice, before, during and after the crisis.

These disciplines do not work one after the other, but side by side. Crisis management takes the decisions; crisis communication translates them, at the same time, to the inside and outside world. When communication only joins once the decisions have been made, valuable time is already lost.

The link works in both directions. Not every incident requires active external communication. And not every communication crisis requires a crisis management or business continuity team. A social media post going viral, a journalist asking about a sensitive HR case, an internal rumour or an unfortunate statement by a manager can leave operations untouched, while your reputation is very much at stake.

The first hours set the frame

Organisations are often too slow to react and to communicate. Yet the battle for accurate communication is won in the first hours. Journalists, employees, clients and authorities form their first judgement long before all the facts are known, and they judge above all whether you appear to be in control.

Those first hours are not only about speaking. They are also about deliberately staying silent until the facts are checked, and about reaching the right people immediately, without searching for who knows how to contact your security firm or IT support.

A few principles matter from the very first moment:

Internal before external, or at least at the same time. Employees should not learn from the press what is happening in their own organisation.
Frontline first. Reception, customer service and points of sale receive the first questions. They need a briefing and a Q&A, not silence.
One validated message. A holding statement shares what is confirmed, acknowledges what is not yet known and commits to an update. It is validated by the crisis team, including legal, before it goes out.
One voice, more than one spokesperson. External communication goes through a briefed and trained spokesperson. Organisations are wise to prepare several, because people go on holiday or fall ill.

Preparation is not a binder. It is a set of reflexes.

There is no speed without preparation. Yet many organisations are not there yet. A recent evaluation report by CyberXP*, a Belgian training programme for SMEs co-funded by the EU and the FPS Economy, found that nearly 70% of the SMEs involved had never thought about a response plan for a cyber incident. Around 75% had no one officially in charge of cybersecurity. The biggest obstacle, according to the participants, is not money, but time and expertise.

And even where a plan exists, it is not always up to date. People have left, back-up contacts are no longer correct, and nobody is quite sure where the latest version is.

In our work on transformations, from announcing restructurings and collective redundancies to preparing for media attention and possible actions, we regularly see that a clear playbook and flow are not in place, or not up-to-date, everywhere.

A well-prepared organisation can answer these questions today:

Has it been tested? At least one exercise a year, as close to real conditions as possible.
Who takes the lead? Every role in the crisis team has a holder and a back-up, reachable 24/7.
When is an incident a crisis? A simple severity grid, covering people, operations, data, media and legal impact, allows a quick first assessment and a clear decision on whether to activate the crisis team.
Who speaks, and who approves? Spokespersons are designated, briefed and trained; the validation path is known.
Are the tools ready, and can you reach them? Holding statement, Q&A, media log, frontline briefing, internal message and contact list exist as templates, not blank pages. And they remain accessible even when a cyber incident takes down your servers.

So how can we support your organisation?

We help management teams and communication managers prepare for the moments when pressure is highest and the margin for error smallest. Our approach takes three half days of your team’s time:

Intake (online). We listen first. Together we map what is already in place, so we complement rather than duplicate. Nothing is more frustrating than a training on something you already have or know.
Half-day training. With your management and communication leads, built around your own scenarios: roles and mandates, the first hour, holding statements, and the interplay between crisis management, legal, HR and communication.
Follow-up (online). We leave you a crisis communication toolbox as homework. A few months later, we check together whether it has been completed, so it does not end up back on the to-do list.

Want to go further? Our media training prepares your spokespersons to bring their message across in front of the camera, and we can organise exercise days based on a realistic scenario.

If you want your organisation to be ready before the phone rings, get in touch!

If you’re interested to have more information on this field of expertise, don’t hesitate to contact Sofie Bockaert or Katrien Decroos, partners at SoWhatCommunications powered by Square Circle.

More information: www.sowhatcoms.com – www.squarecircle.be

* Source: CyberXP evaluation report, as reported by KMO.partners (16 September 2026).