A crisis communications plan should help a law firm make accurate decisions while facts are incomplete, deadlines continue, and professional duties constrain what can be said. It is not a folder of reassuring statements.
The plan connects incident response, leadership, client service, legal and ethical review, staff instructions, outside communication, corrections, and recovery. Its first job is to reduce avoidable harm from silence, contradiction, speculation, or an operational promise the firm cannot keep.
Define activation by conditions, not headlines
List events that require assessment:
- technology or data incident;
- office, phone, email, or vendor outage;
- attorney or staff allegation;
- public filing, ruling, or active-matter development;
- protest, threat, safety event, or severe weather;
- false public claim or impersonation;
- leadership departure or incapacity; and
- any event that materially affects client communication or service.
For each, name the person who can activate the team, the backup, the immediate operating checks, and the records to preserve. Not every criticism is a crisis. A material service interruption can be one even before press interest exists.
Create a call tree with role, primary, backup, secure contact, authority, and unavailable-person rule:
Scroll sideways to review every column.Each row is shown as a labeled card.
| Role | Decision |
|---|---|
| Incident lead | Coordinates facts, actions, timing, and log |
| Managing authority | Sets business priorities and resources |
| Responsible legal/ethics reviewer | Applies duties, matter limits, and approval |
| Operations/technology owner | Confirms service and system facts |
| Client-service owner | Identifies affected clients and working alternatives |
| Communications owner | Drafts audience-specific messages and monitors response |
| Spokesperson | Delivers approved public statements |
One person may hold several roles in a small firm, but the decisions remain separate. A vendor can supply facts or advice; it should not silently become the firm's final authority.
Build a verified-facts ledger
For every important statement, record:
- exact fact or report;
- source and time received;
- confirmed, plausible but unverified, disputed, or false status;
- who can verify it;
- affected system, person, client, or matter;
- disclosure or notification decision owner; and
- next review time.
Use the ledger to prevent one team's assumption from becoming another team's public fact. Preserve versions. Do not delete an inaccurate draft and lose the reason it was rejected.
Map audiences by what they need to do
Current clients may need a working contact route or deadline information. Staff may need operational instructions and a rule for inbound calls. Courts, regulators, insurers, law enforcement, vendors, or affected people may require different information through different channels. Journalists and the public may need a narrow verified statement.
Do not publish one universal message merely because it is easier. State the audience, purpose, confirmed facts, action, channel, sender, approval, and next update.
Avoid inventing legal notification requirements in the communications plan. Responsible counsel should decide which duties apply and when.
Prepare structures, not canned answers
A holding structure can contain:
- what the firm has confirmed;
- what action it is taking now;
- what affected people should do;
- which details remain under review; and
- when or where the next verified update will appear.
“We take this seriously” without a fact or action gives the audience little help. “No client data was affected” is dangerous unless the incident record supports it.
Preapprove blank structures for outage updates, office closure, impersonation warning, and request acknowledgment. Fill them from current facts during the event.
Protect professional duties in the response
ABA Model Rule 1.6 provides a model-rule confidentiality baseline. ABA Model Rule 3.6 addresses trial publicity. Neither substitutes for the controlling jurisdiction, client instructions, court orders, contractual duties, insurer requirements, or incident-specific legal advice.
Do not reveal client facts to rebut criticism. Do not let a spokesperson speculate about responsibility or legal effect. Preserve privilege and confidentiality decisions under the firm's actual process.
Coordinate operations and public promises
Before telling clients to call, verify that the phone line works and staff have the script. Before naming a response time, confirm coverage. Before posting an alternative email address, approve and secure it.
Pause scheduled marketing that could appear insensitive, contradict the event, or route people into a broken system. Preserve what was paused and who approved the decision. Resume deliberately.
Cybersecurity incident response has broader technical and legal requirements than communications. NIST's current Incident Response Recommendations and Considerations, SP 800-61 Rev. 3, offers operational context; it does not decide a law firm's disclosure duties or public statement.
Exercise the plan under constraint
Use a tabletop with a clock, incomplete facts, unavailable leaders, a client deadline, a journalist request, and a false social post. Test secure communication if ordinary email or chat may be unavailable.
Score decisions rather than polish:
- time to activate and reach backups;
- time to a confirmed-facts ledger;
- affected-client and deadline identification;
- working alternate contact route;
- approval clarity;
- consistency across staff, client, website, and public messages;
- corrections made; and
- unresolved decisions with owners and next times.
Work a fictional incident from alert to repair
At 8:10 a.m., a technology vendor tells a fictional twelve-lawyer firm that unusual access affected a system used for website forms. The vendor has not established what data, if any, was accessed. The public form is disabled. The managing partner is on a flight.
At 8:18, the operations lead activates the plan and reaches the backup authority. The facts ledger records the vendor alert, uncertain access scope, disabled form, working phone line, and pending technical investigation. The firm does not call the event a breach or state that no data was affected.
By 8:35, intake tests the phone and creates a secure alternate route approved by the technical and legal owners. Staff receive an internal instruction: route new inquiries by phone, avoid collecting details in ordinary email, record anyone reporting a form problem, and send media requests to the spokesperson. Matter teams separately confirm same-day client deadlines.
At 9:05, the website carries a narrow service notice: the online form is temporarily unavailable, the tested phone route, and the next-update time. A scheduled ad sending people to the form is paused. A journalist emails at 9:30 after a social account claims “all client files were stolen.” The spokesperson replies only that the firm is investigating unusual access reported by a vendor, has disabled the affected form, has no confirmed basis for the social claim, and will provide verified updates through the named page.
At noon, the vendor confirms that the affected environment stored 18 form submissions but still cannot determine access. Responsible counsel, technical advisers, insurer, and other required decision-makers assess next steps; the communications draft does not decide whom law requires the firm to notify. The facts ledger and audience map guide approved direct and public communication.
The after-action review finds that the backup chain worked in eight minutes and the public route was live in 55 minutes. It also finds one stale directory listing still linked to the disabled form and two staff members used an old media script. The decision is repair before closing the incident: update controlled links, retire the script, repeat staff briefing, preserve the full decision log, and schedule a new exercise. Fast public posting alone would not count as success.
All facts, times, systems, people, and responses in this scenario are hypothetical. They do not prescribe a notification timeline or legal conclusion.
Recover, correct, and learn
After the immediate event, reconcile every statement with the final known record. Correct material errors where they appeared. Update clients and other audiences through the appropriate route. Resume campaigns only after destinations and intake work.
Record cause where verified, audience effects, unresolved issues, costs, missed or protected deadlines, message versions, corrections, and control changes. Assign each repair and test it. Retire temporary pages and contact routes deliberately.
Review the plan after exercises, personnel changes, new systems, vendors, offices, matters, and applicable-rule changes. A plan that names departed staff or dead phone numbers is a liability disguised as preparation.
Juris Digital's current Solutions hub provides broad communications context. Bring the activation matrix, call tree, facts-ledger template, audience map, controlled public surfaces, and last exercise findings. Ask for a written scope that states which planning, content, web, monitoring, exercise, and reporting work is proposed, who retains legal and incident authority, and what is excluded. The hub does not establish a crisis-response service, response time, or outcome promise.
