Startup crisis communication: the first-hour protocol

Article summary
- Decisions made in the first 60 minutes of a crisis carry more weight than anything done afterward: the first narrative available becomes the reference narrative.
- The protocol fits into four windows: H+0 to H+1 to qualify and lock down, H+1 to H+4 to publish an initial position, H+4 to H+24 to respond to the media, and Day 2 to Day 7 to regain the initiative.
- Only one person should speak. Three mistakes are enough to turn an incident into a crisis: prolonged silence, saying "no comment," and issuing a denial that you will later have to correct.
In crisis communication, a startup must qualify the incident, designate a single spokesperson, and publish an initial statement within four hours. What the leader decides during the first hour carries more weight than anything they will do in the following sixty hours, because in a crisis, people accept the first information they receive as the truth.
The three crises that actually affect a tech startup
Crisis communication manuals are written for industrial conglomerates. A tech startup faces three specific scenarios, and they do not call for the same response.
The product crisis. Prolonged outage, data breach, or a bug that caused customer losses. This is the most frequent and manageable type, because the facts are technical and verifiable. The primary audience is your customers; the press follows.
The leadership crisis. Poorly received remarks, personal allegations, or public internal conflict. This is the most dangerous type, because the subject is a person rather than a system, and because the leader is both judge and party.
The funding crisis. Rumors of financial trouble, layoffs, or the bankruptcy of a major client. This attacks the confidence of employees and candidates as much as that of the market.
Qualification is the first decision of the protocol. Treating a product incident as a leadership crisis creates a crisis that didn't exist in the first place.
The hour-by-hour protocol
The concept of the "golden hour" comes from emergency medicine and applies to crisis communication: the response time determines the outcome more than the quality of the message. Every hour of delay costs more than the last.
This protocol assumes that only one person decides and only one person speaks. Confusion of roles is the primary cause of escalation.
The window most often missed is the second one. Many teams jump straight from shock to a full press release, skipping the intermediate position—which is precisely what stops speculation in its tracks.
What to include in an initial statement published within four hours
An initial statement is not a full press release. It should be four sentences long and has one single goal: to claim the narrative before someone else does.
It contains: what you know, what you don't know yet, what you are doing right now, and when you will provide an update. Nothing else.
The fourth element is the one most often forgotten, yet it is the most useful. Announcing a follow-up deadline puts you in control of the pace. Without a deadline, every hour of silence is open to interpretation.
What it never contains: an explanation of causes before an investigation, unverified financial commitments, blaming a third party, or expressions of regret drafted by a legal department.
Who speaks, who stays silent
There should be a single spokesperson, designated before a crisis, not during one. In a startup, this is the CEO for leadership or funding crises, and the CTO or technical lead for product crises.
Everyone else stays silent, especially on LinkedIn. This is a specific point of concern for startups: teams are active on LinkedIn and used to commenting, but three contradictory posts from employees become a news story for a journalist.
Internal messaging must therefore go out before external messaging, or at the very latest, simultaneously. It should state what to do, not just what to think: do not comment, do not share, and redirect all inquiries to a single address.
A startup that notifies its team after publishing its statement will find its own employees commenting on the news article.
Phrases that make a crisis worse
Four types of phrasing consistently produce the exact opposite of the intended effect.
"No comment." Read as an admission of guilt. Always replaceable with "we cannot answer that question yet, but here is what we can share today."
We formally deny this. Only use this if the denial is absolutely certain and documented. A denial that later needs to be corrected destroys more credibility than the initial fact.
This is off the record. Nothing is off the record with a journalist you don't know, and the agreement must be explicit before the statement, never after.
I am not aware of that. Regarding their own area of responsibility, a leader who is not aware is either negligent or evasive. It is better to say, "I will check and call you back by [time]," and then follow through.
Prepare the protocol before you need it
A protocol written during a crisis is useless. Effective preparation is concise and fits on a single page.
This page should contain: a list of the three most likely scenarios for your business, the designated spokesperson for each, a list of people to contact within the hour with their personal numbers, the dedicated email address for inquiries, and the two or three journalists you will call first because you already have a relationship with them.
This last point is what makes the difference, and it must be built outside of a crisis. A leader who has already spoken to journalists in their sector during calm times has someone to call when a crisis hits. Someone who only encounters the press on the day of an incident is negotiating without a relationship. A comprehensive crisis management plan covers these elements in detail.
When not to respond publicly
Not every accusation deserves a public response. Responding gives it an audience.
Three criteria help you decide: is the topic being covered by a media outlet your target audience reads, does it concern a verifiable fact or an opinion, and does a response provide new information? If the answer to all three is no, silence is the right decision.
An isolated social media post, even a virulent one, does not justify a press release. Addressing it publicly turns a minor incident into a major story. However, when published information is factually incorrect, a right of reply is the appropriate tool.
Key takeaways
The quality of your crisis communication is determined before the crisis hits. Protocols, spokespeople, and media relations must be established during calm periods—it is the only time you can effectively do so.
Spokespeople also need preparation: our media training support uses simulations to work through these scenarios. If you don't have a one-pager for this yet, let's talk about it before you actually need it.
Have questions?
Four actions, in this order: qualify the incident by establishing what is known and unknown, designate a single spokesperson, instruct all teams not to comment—including on LinkedIn—and centralize all inquiries to a single address. No external communication is necessary within this first hour, but no uncoordinated statements should be released.
Neither. You should publish an interim statement within four hours that outlines what you know, what you don't know, what you are doing, and when you will provide an update. Waiting until you have all the facts is the surest way to let someone else tell the story for you.
Only one person, designated in advance based on the type of crisis. The CEO for a crisis involving leadership or funding, or the technical lead for a product crisis. Everyone else must remain silent, including on their personal accounts.
By warning them beforehand, not after. Internal communication must go out before or at the same time as external communication, and it must provide clear operational instructions: do not comment, do not share, and redirect all inquiries. This is a specific challenge for startups, where teams are accustomed to posting freely.
Yes, and it fits on one page: three likely scenarios, one spokesperson per scenario, personal phone numbers for people to contact within the hour, a redirect address, and two or three journalists you already know. Writing this page takes two hours when things are calm and becomes impossible during a crisis.
No. Responding gives them an audience. Use three criteria to decide: is the topic being covered by a media outlet your target audience reads, is it a verifiable fact or just an opinion, and does your response provide new information? If the answer to all three is no, do not respond.
Other resources LinkedIn & Media Relations
Go from invisible to essential in your market
Your expertise deserves to be visible, credible, and shared, both on LinkedIn and in the media.



%20Large.avif)
