Scroll Top

Crisis Management PR Firm: What to Buy, When to Buy It

Updated September 2026 · Written and maintained by the Progression Agency strategy team

Every firm worth hiring will tell you the same thing, and almost nobody acts on it: retain a crisis team before you need one. A crisis PR firm engaged on day one of an incident spends that day learning your business instead of managing it, and the first hour is the hour that decides whether the story is about what happened or about how you responded. This page covers what crisis management actually costs, how the standby-plus-day-rate structure works, what to do in the first sixty minutes, how to judge a firm in one call, and the long tail nobody plans for.

The short answerCrisis PR is normally bought as a standby retainer of roughly $2,500 to $6,000 a month plus an activated day rate of $5,000 to $50,000 depending on severity and sector. Buy the standby retainer before anything happens: it is the cheap part, and it removes the briefing day that otherwise costs you the first and most important twenty-four hours. In the first hour, establish the facts, name one decision-maker and one spokesperson, put legal and communications in the same room, issue a holding statement, notify affected people before the press, and start a time-stamped log. Any firm that offers to make the story go away is telling you it has not handled a serious one.

Crisis PR, in five facts
The firms worth hiring will tell you the same thing: retain before you need it. A crisis firm hired on day one of a crisis spends that day learning your business instead of managing it.
Before — When to hire. Retain before you need it, always.
1 hour — The decisive window. Silence reads as guilt or incompetence.
Holding — The cheapest tool there is. Acknowledge, act, say when you will update.
Log — Start it immediately. Every decision, time-stamped.
One — Decision-maker. And one spokesperson; often different people.
Legal — In the room from minute one. Not consulted afterwards.

Why you hire before, not during

Answer first: because activation without a standby relationship costs you the first day. A team that already knows your business, your spokespeople, your regulator and your legal posture starts work in the first hour. A team hired that morning starts work the following morning.

What a standby retainer actually buys

  • A briefed team. People who have read your risk register, met your spokespeople and understand your sector’s regulator.
  • Pre-drafted holding statements for your three or four most likely scenarios, ready to be adapted rather than written under pressure.
  • An agreed escalation route with names and numbers that work at three in the morning.
  • Priority access. A retained client is answered first when a firm has several incidents at once, and firms frequently do.
  • Media training kept current, because a spokesperson trained four years ago is effectively untrained.

What it costs not to have one

The activation day rate is higher without a standby arrangement, but that is the smaller cost. The larger one is the twenty-four hours spent briefing a team while the story forms without you. In that window the narrative is set by whoever is talking, and if that is not you it is somebody else.

What a crisis management PR firm costs

Answer first: a standby retainer of roughly $2,500 to $6,000 a month, a preparedness project at $10,000 to $25,000, and activated day rates from $5,000 to $50,000 depending on severity, sector and whether counsel is coordinating.

What crisis management PR actually costs
The standby retainer is the cheap part and the part almost nobody buys. Activation without it costs more and starts slower, because the first day goes on briefing rather than responding.
$3,500 — Standby retainer, monthly. A briefed team on call.
$15,000 — Preparedness project. Plan, scenarios, training, holding statements.
$8,000 — Activated day rate. Mid-market, named team.
$20,000 — Activated day rate. Enterprise, multiple workstreams.
$50,000 — Litigation-adjacent. Coordinated with counsel.
Cheaper — To retain than to activate cold. Day one is briefing, not responding.
Crisis PR pricing structures, compared
StructureTypical costWhat it coversRight when
Standby retainer$2,500 – $6,000/monthBriefed team, escalation route, pre-drafted statementsAny organization with real downside risk
Preparedness project$10,000 – $25,000 one-offPlan, scenarios, media training, statement libraryYou have no plan and want one
Activated day rate, mid-market$5,000 – $12,000/dayA named team working the incidentAn incident is live
Activated day rate, enterprise$15,000 – $30,000/dayLarger team, multiple workstreamsMulti-jurisdiction or regulated
Litigation or regulatory-adjacent$30,000 – $50,000+/dayCoordinated with counsel, extendedLegal exposure is the primary driver
Post-crisis rebuild$5,000 – $20,000/monthSearch, content, stakeholder repairThe coverage has ended and the results have not

The conclusion: the standby retainer is the line almost nobody buys and the one that changes the outcome most. It costs a fraction of a single activated day.

The first hour

Answer first: establish the facts, name one decision-maker and one spokesperson, put legal and communications in the same room, issue a holding statement, notify affected people before the press, and start a time-stamped log. In that order.

The first hour of a crisis, in order
The holding statement buys you hours and costs almost nothing. Silence in the first hour is read as either guilt or incompetence, and both are harder to correct later than an incomplete statement.
Facts — Establish them first. And what is still unknown.
Speed — Beats completeness. An incomplete statement beats silence.
Affected — Notify them before press. Wherever possible.
One — Voice, consistently. Multiple spokespeople create contradictions.
Update — When you said you would. Missing your own deadline compounds it.
Correct — Errors immediately. Politely, in writing, with evidence.

Why the holding statement matters more than the full statement

A holding statement acknowledges that something has happened, says what you are doing about it, and states when you will update. It costs almost nothing, it can be issued before you know everything, and it buys hours. Silence in the first hour is read as guilt or incompetence, and both are harder to correct later than an incomplete statement is to update.

What a holding statement should and should not contain

Holding statement: in and out
IncludeExclude
That you are aware of the incidentSpeculation about cause
That you are investigating or respondingAssignment of blame, internal or external
Concern for anyone affected, if people are affectedAnything you have not verified
What you are doing right nowLegal conclusions
When you will update, specificallyDefensive comparisons to competitors
A named contact for media‘No comment’, in any form

Why ‘no comment’ is the worst available answer

It is a comment, and it reads as a refusal. If you cannot say something, say why you cannot say it — an active investigation, a duty to notify affected people first, a legal constraint. Explaining the constraint is transparent; refusing to engage is not, and audiences do not distinguish between cannot and will not unless you do it for them.

Answer first: counsel usually wants to say less and communications usually wants to say more, and the correct answer is almost never either extreme. Put both in the room from minute one rather than consulting them in sequence.

Breach — Notification duties apply. Timelines are set by law, not by comms.
Safety — People before reputation. Always, and it is also the better strategy.
Misconduct — Independence matters. An internal-only review is not believed.
Regulator — Tell them before the press. Where the rules require it.
Insurance — Check the policy. Some cover crisis communications costs.
Counsel — Privilege is real. How comms are handled can affect it.
  • Privilege is real and how communications are handled can affect it. Ask counsel early how to structure the working arrangement.
  • Notification duties are set by law, not by strategy. Data breach timelines in particular are statutory, and communications strategy operates inside them rather than around them.
  • An admission and an apology are not the same thing in most jurisdictions, and the distinction is worth understanding before you need it. Take advice on it in advance.
  • Regulators frequently expect to hear from you before the press does. Know which of your regulators do.
  • Insurance may cover crisis communications costs. Check the policy before an incident, not during one.

This page is not legal advice and Progression Agency is not a law firm. Notification obligations, privilege and disclosure requirements vary by jurisdiction and sector. Take advice from qualified counsel and build the relationship before an incident rather than during one.

Not every bad day is a crisis

Answer first: match the response to the severity. Treating an operational incident like a full crisis manufactures the story you were trying to avoid. Treating a safety incident like an operational one is considerably worse.

Not every bad day is a crisis
Matching the response to the row matters. Treating an operational incident like a full crisis creates the story you were trying to avoid; treating a safety incident like an operational one is far worse.
Four incident types and what each requires
TypeExampleResponseWho leads
Operational incidentAn outage, a delivery failureDirect customer communication onlyOperations, with comms advising
Service or product failureA defect, a recallProactive statement plus direct contactComms, with legal advising
Data breachUnauthorised access to personal dataStatutory notification plus statementLegal, with comms executing
Safety or misconductInjury, abuse, serious wrongdoingFull crisis response, independent reviewBoard level, with both advising

The conclusion: escalation should be a decision made against written criteria, not a judgement made under pressure by whoever picks up the phone. Write those criteria while nothing is happening.

How a crisis actually unfolds

How a crisis actually unfolds
The single most common failure is treating day three as the end. Search results and the second wave both arrive later, and both are shaped by what was said in the first hour.

The second wave

Answer first: most crises have one, and it is caused by new facts emerging after the first response has closed. It is almost always worse than the first wave, because the story becomes what you knew and when — which is a story about honesty rather than about the original incident.

How to avoid causing your own second wave

  1. Never say more than you have verified, however much pressure there is to fill the silence.
  2. Distinguish clearly between what you know, what you believe and what you are investigating.
  3. If you are uncertain whether something will come out, assume it will.
  4. Update proactively when new facts emerge rather than waiting to be asked.
  5. Keep the log, because the sequence of what you knew will be reconstructed by others if you cannot produce it yourself.

Six incident types and what each one demands

Answer first: the response is shaped by the type of incident far more than by the size of the organization. These six cover most of what actually happens.

Recall — Product withdrawn from market. Notification duties, direct customer contact.
Outage — Service unavailable. Status page beats press release.
Breach — Personal data exposed. Statutory timelines govern everything.
Injury — Someone was harmed. People before reputation, always.
Misconduct — Serious wrongdoing alleged. Independent review or nobody believes it.
Activist — Organized public pressure. Different arc, longer duration.

Product recall

Answer first: the notification and safety mechanics lead, and communications operate inside them. Direct customer contact matters more than press coverage, and the recall process itself sets the timeline you must communicate against.

Service outage

Answer first: a status page updated frequently beats any statement. Customers want to know whether it is fixed and when, and an outage handled with visible frequent updates rarely becomes a reputational event at all.

Data breach

Answer first: statutory notification timelines govern everything, and they are set by law rather than by strategy. Counsel leads, communications executes, and the schedule is not negotiable. The FTC publishes a data breach response guide worth reading before you need it.

Injury or safety incident

Answer first: people before reputation, without exception — and it is also the better strategy. Care for those affected, cooperation with authorities and visible seriousness are what shorten these, and any attempt to manage the perception before the substance makes it worse.

Misconduct allegation

Answer first: an internal-only review is not believed, by anyone. Where the allegation is serious, independence in the review is the thing that determines whether the response is credible, and it should be announced early rather than conceded later under pressure.

Organized public pressure

Answer first: this has a different arc from an incident — longer, quieter, and driven by a campaign rather than a news cycle. Engagement, not statements, is the instrument, and the mistake is treating a sustained campaign as though it will pass in three days.

How sector changes the playbook

Restaurant — Foodborne illness. Health department leads the timeline.
Healthcare — Patient data or care failure. HIPAA breach notification applies.
Financial — Client funds or advice. Regulator first, press second.
Manufacturer — Product defect. Recall mechanics dominate the response.
School — Safety incident. Parents before press, without exception.
Nonprofit — Donor or safeguarding issue. Board accountability is the story.

Answer first: the sector determines who must be told first and what the statutory clock is, which in turn determines the sequencing of everything else. A restaurant’s timeline is set by the health department; a healthcare provider’s by breach notification rules; a school’s by an obligation to parents that overrides every other consideration.

Crisis management agencies, crisis PR firms and reputation firms: the labels

Answer first: crisis management agencies and crisis PR firms are the same thing, used interchangeably. Reputation management firms are a different product — slower, search and content led, and usually engaged after the news cycle rather than during it.

What each label usually means
LabelWhat it usually isEngagedPriced
Crisis PR firmLive incident communicationsDuring, ideally retained beforeStandby plus day rate
Crisis management agenciesThe same thing, different phrasingSameSame
Crisis communications consultancyOften preparedness-weightedBeforeProject or retainer
Reputation management firmSearch and content over monthsAfterMonthly retainer
Litigation communicationsCoordinated with counsel on a caseDuring legal proceedingsDay rate
Issues managementSlow-burn organized pressureOngoingRetainer

The conclusion: buy against the situation rather than the label. If the news cycle has ended and the search results have not, you need the fourth row, not the first.

Judging a crisis management firm in one call

Answer first: the fastest filter is whether they ask about your legal exposure in the first conversation. A firm that has handled serious incidents asks immediately, because in a serious incident that question governs everything else.

Judging a crisis management firm
The first row is the fastest filter. A crisis firm that does not ask about legal exposure immediately has not handled a serious incident, because in a serious incident that question governs everything else.
What is our legal exposure? — Ask. The first question, always.
Who works it, by name? — Ask. Not the pitch team.
What is the standby structure? — Ask. Retainer plus activated day rate.
When do you advise silence? — Ask. A firm with no view has not done this.
Tell me about a bad outcome — Ask. And what you would do differently.
How fast do you answer at 3am? — Ask. Test it before you sign.

Six questions worth asking

  1. What is our legal exposure here, and how do you work with counsel?
  2. Who specifically would work this, and what is their background?
  3. What is your structure — standby retainer plus activated day rate, or something else?
  4. When would you advise us to say nothing at all?
  5. Tell me about an incident where the response was wrong, and what you would do differently.
  6. If I call at three in the morning, who answers and how quickly?

Answers that should end the conversation

'We'll kill the story' — No. Nobody can, and offering it is disqualifying.
Famous logos as evidence — No. Which incident, and what happened?.
Comms without counsel — No. On anything with legal exposure.
Denial before facts — No. The single most damaging reflex.
'No comment' — No. It is a comment, and a bad one.
Blaming a junior employee — No. It reads exactly as it is.

The one that matters most: any firm offering to make the story go away, kill the coverage or guarantee suppression is either describing something you should not buy or promising something nobody can deliver. Both are disqualifying.

Best crisis management companies: why this page does not rank them

Answer first: because crisis work is confidential by nature, so the engagements that would tell you who is genuinely good are the ones nobody can discuss. Any ranked list of the best crisis management firms is built on the cases that became public, which are disproportionately the ones that went badly.

  • The best work is invisible. An incident handled well frequently never becomes a story, which means it never appears in any assessment of the firm.
  • Public case studies are self-selected. Firms publish what they are permitted to publish, which is a small and unrepresentative sample.
  • Client lists tell you nothing about outcomes. A famous name on a website says a firm was hired, not that the engagement worked.
  • Sector fit dominates. The best crisis management firm for a hospital and the best one for a restaurant group are not the same firm, and no general ranking captures that.
  • Individual practitioners matter more than the firm. As in the rest of PR, the relationships and judgement belong to people who move between firms.

What this page offers instead is the diligence set above: the six questions, the structural expectations, and the answers that should end the conversation. Those are checkable by you, in one call, and they are more predictive than any list.

Monitoring: knowing before the journalist calls

Answer first: set alerts on your own organization name, your key executives, your products and your sector’s common failure terms. The worst way to learn about an incident is from a reporter asking for comment, because it means the story is already written.

  • Your own name, in every spelling. Including common misspellings and the trading names customers actually use.
  • Executive names. Personal stories become organizational ones quickly.
  • Product and brand names, separately from the company name.
  • Review platforms relevant to your sector. Consumer damage frequently appears there first.
  • Your own employees’ public posts, to the extent that is appropriate and lawful in your jurisdiction.
  • Regulator publications, where your sector has one that publishes enforcement.

What to do in the first week, after the first hour

Answer first: move from holding to substance, contact key journalists directly rather than only issuing statements, pursue corrections politely and in writing, and communicate remediation with named changes and dates.

  1. Day one to two: the substantive statement. More than the holding statement, still only what is verified, with what changes as a result.
  2. Direct outreach to the journalists who matter. A phone call to the reporter covering it is worth more than a press release to everyone.
  3. Correct errors immediately, politely, in writing, with evidence. Most outlets correct genuine factual errors; almost none respond well to an aggressive approach.
  4. Brief employees before or at the same time as the press. They are asked constantly and they are the most credible source anyone has.
  5. Communicate remediation specifically. Named changes with dates, not commitments to do better.
  6. Keep the log running. The sequence of what you knew will be reconstructed by others if you cannot produce it yourself.

Post-incident review, including for the small ones

Answer first: run a review after every incident, not only the serious ones. Small incidents are where a plan gets tested cheaply, and the failures they reveal are the same failures that would have mattered in a serious one.

What a post-incident review should establish
QuestionWhy it matters
When did we first know, and how?Tests whether monitoring worked
How long until the first statement?The single most predictive number
Who made the escalation decision?Tests whether the criteria were used
Was the spokesperson available and prepared?The commonest single point of failure
Did legal and comms work together or in sequence?Sequential working is the usual cause of delay
What did we say that we later had to correct?Tests the verification discipline
What would we change in the plan?The only output that matters

Preparedness: what to build before anything happens

Answer first: a written plan, named roles with deputies, at least one trained spokesperson, monitoring on your own name, one tested scenario a year, and a review after every incident including the small ones.

Plan — Written, before anything. Scenarios, contacts, holding statements.
Roles — Named, with deputies. People take holidays.
Training — One trained spokesperson. Minimum; two is better.
Monitor — Know before the journalist calls. Alerts on your own name.
Test — Run one scenario a year. An untested plan is a document.
Review — After every incident. Including the small ones.
A crisis plan that fits on a few pages
SectionWhat it containsReview cadence
Escalation criteriaWhat makes something a crisis rather than an incidentAnnually
RolesDecision-maker, spokesperson, legal, operations, with deputiesEvery personnel change
Contact listNumbers that work out of hours, including counsel and insurerQuarterly
Scenario statementsHolding statements for your three or four likeliest eventsAnnually
Notification mapWho must be told, in what order, within what timeAnnually, or on regulation change
MonitoringWhat is watched, by whom, and what triggers an alertAnnually
Log templateWhere decisions are recorded, with time stampsSet once
Post-incident reviewHow the review is run and who sees itAfter every incident

Media training, and why it expires

A spokesperson trained four years ago is effectively untrained: the formats have changed, the questions have changed, and the muscle memory has gone. Refresh annually, and train a deputy — the single most common preparedness failure is that the one trained person is unreachable when it happens.

The long tail nobody plans for

Answer first: search results outlive coverage. The news cycle ends in days; what appears when somebody searches your name settles over six to twelve months and is shaped by what you publish afterwards.

Search — The long tail of a crisis. Results outlive the coverage.
Content — Rebuild deliberately. Own the questions people now ask.
Reviews — Where consumer damage persists. Respond, do not argue.
Employees — The audience most often forgotten. They read everything first.
Customers — Direct communication beats press. Especially in a breach.
Time — 6-12 months to settle. Plan for it rather than hoping.
  1. Own the questions people now ask. Publish clear, honest answers to what actually happened and what changed. This is the single most effective post-crisis action available.
  2. Communicate remediation specifically. Vague commitments to ‘do better’ do not move anything; named changes with dates do.
  3. Do not argue in reviews. Respond once, factually, and move the conversation offline.
  4. Remember employees. They read everything first, they are asked about it constantly, and they are the audience most often forgotten in a crisis response.
  5. Expect six to twelve months before search results settle, and plan the content program across that period rather than hoping.

The rebuilding half of this is ordinary content and search work rather than crisis work, and it is covered in what SEO services involve and our PR services.

Spokesperson selection: who should actually speak

Answer first: the most senior person available who can speak plainly under pressure — which is frequently not the chief executive. Seniority signals seriousness, but a senior person who performs badly on camera does more damage than a credible director.

  • Where people were harmed, seniority is not optional. A junior spokesperson reads as an organization hiding.
  • For technical incidents, credibility beats rank. The person who can actually explain what happened is more reassuring than the person with the biggest title.
  • Never make a junior employee the public face, and never name one as the cause. It reads exactly as it is.
  • One voice, consistently. Multiple spokespeople produce contradictions, and contradictions become the story.
  • Brief a deputy. The trained person will occasionally be unreachable, and that is when it happens.

Common mistakes, and what to do instead

Crisis communication mistakes and the alternative
MistakeWhy it costsInstead
Denial before facts are establishedTurns an incident into a credibility problemAcknowledge, investigate, update
Silence in the first hourRead as guilt or incompetenceA holding statement, even incomplete
‘No comment’It is a comment, and a bad oneSay why you cannot say more
Blaming a junior employeeReads exactly as it isOwn it at the level it belongs
Legal and comms working sequentiallyDelay, and internally contradictory outputBoth in the room from minute one
Multiple spokespeopleContradictions become the storyOne voice, one deputy
Treating day three as the endMisses the second wave and the search tailPlan six to twelve months
Attempting to suppress resultsVisible, fails, worse story when foundPublish honest answers instead

Where a crisis PR firm sits alongside your other advisers

Who does what in a serious incident
AdviserOwnsDoes not own
CounselLegal exposure, privilege, notification dutiesMessage, tone, media relationships
Crisis PR firmMessage, sequencing, media handlingLegal judgement, operational decisions
InsurerCover and claims, sometimes panel suppliersStrategy
OperationsThe incident itself and remediationPublic communication
BoardEscalation decisions and accountabilityDay-to-day execution
Internal commsEmployees, who read everything firstExternal statements

The conclusion: the crisis firm coordinates rather than commands. Where it adds the most value is in sequencing — deciding what is said, to whom, in what order — which is precisely the thing that cannot be worked out under pressure by people who have never done it before.

Which crisis capability you actually need
Top-right needs a retained firm with counsel already coordinated. Bottom-left usually needs a written plan and one trained spokesperson, which costs a fraction of a retainer.

Rebuilding: the six to twelve months after

Answer first: publish clear honest answers to the questions people now ask, communicate remediation with dates, respond once to reviews rather than arguing, and expect search results to settle over six to twelve months rather than weeks.

Why search is the part that lasts

The news cycle ends in days. What appears when somebody searches your name persists, and it is shaped almost entirely by what you publish afterwards. An organization that says nothing after an incident cedes that space permanently to the coverage.

What to publish, specifically

  1. A plain account of what happened, in your own words, on your own site.
  2. What you found when you investigated, including anything uncomfortable.
  3. What changed as a result, with names and dates.
  4. Answers to the specific questions customers are now asking.
  5. An update when the remediation is complete, rather than leaving the last word as the incident.

What not to do

  • Do not attempt to suppress results. It is visible, it fails, and its discovery is a worse story than the original.
  • Do not argue in reviews. Respond once, factually, and move it offline.
  • Do not publish a triumphant recovery narrative. Understatement is more credible and considerably safer.
  • Do not stop early. Six to twelve months is the realistic horizon and most organizations stop at six weeks.

Working with a crisis firm remotely

Answer first: crisis work is almost entirely remote-capable and always has been, because it is conducted by phone, message and document under time pressure. What matters is response speed and sector knowledge, not proximity.

  • Test the response time before you sign. Call the out-of-hours number at an inconvenient moment and see what happens.
  • Agree the working channel in advance — where the log lives, where drafts are shared, who is on the call bridge.
  • Time zones matter more than distance. A firm three hours behind you is asleep during your first hour.
  • In-person matters for two things: media training, and being physically present at a site during a serious safety incident.

Progression Agency works with organizations across all fifty states from New York City, and coordinates with the client’s own counsel rather than providing legal advice. Our wider communications work and published retainers are on the PR services page.

When you do not need a crisis firm

  • Your downside risk is genuinely small. Some businesses cannot generate a serious incident. Write a one-page plan and train one person instead.
  • The incident is operational and contained. Direct customer communication handles it, and escalating manufactures a story.
  • You have in-house communications with crisis experience. Then buy the standby relationship for surge capacity rather than for the core work.
  • The real problem is a legal one. Then counsel leads and communications supports. Buying comms to solve a legal problem does not work.

Updated August 2026. The pricing structures on this page are typical United States ranges stated as ranges rather than as survey findings, and they vary considerably by sector and by severity. Nothing here is legal advice.

Want a plan before you need one?

Tell us your three most likely scenarios and who your regulator is. You will get an escalation framework, a holding-statement structure and an honest view on whether you need a retained firm at all — before any proposal.

Build the plan

Communications and measurement, from the people who publish the platforms

Publicly available talks from Google Ads, Think with Google, Ad Age, HubSpot, Ahrefs and Neil Patel on measurement, search behavior and how coverage interacts with what people find afterwards — the long tail that outlives any news cycle. None of these are ours; each is credited to its channel by name and upload date, every identifier was verified live before publication, and each tile loads its player only when you click it.

Social, content and brand

The top crisis management firms are concentrated in a handful of markets, and crisis management firms in DC are a distinct cluster: Washington practices are built around regulatory, congressional and litigation-adjacent exposure, where the audience is a committee or an agency rather than a consumer. Crisis management firms in DC therefore staff differently — former government communications people and lawyers alongside media specialists. If your exposure is consumer or reputational rather than regulatory, that is the wrong specialism, competently delivered.

Frequently asked questions

What does a crisis management PR firm do?
It advises on what is said, to whom, and in what order during and after a serious incident. In practice that means establishing facts, drafting statements, preparing and protecting spokespeople, handling journalists, coordinating with counsel, monitoring coverage and sentiment, and managing the rebuilding period after the news cycle ends.
How much does a crisis PR firm cost?
Typically a standby retainer of $2,500 to $6,000 a month, plus an activated day rate from $5,000 to $50,000 depending on severity, sector and whether counsel is coordinating. Preparedness projects — plan, scenarios, media training, statement library — run $10,000 to $25,000 as a one-off.
What is a standby retainer?
A monthly fee that keeps a crisis team briefed on your business and available, with an agreed escalation route and pre-drafted holding statements, without any incident being live. It is the cheapest line in crisis PR and the one almost nobody buys, and it removes the briefing day that otherwise costs you the first twenty-four hours.
When should I hire a crisis management firm?
Before you need one. A firm engaged on day one of an incident spends that day learning your business instead of managing the situation, and the first hour is the hour that decides whether the story is about what happened or about how you responded.
What should I do in the first hour of a crisis?
Establish what is actually true and what is still unknown, and write both down. Name one decision-maker and one spokesperson. Put legal and communications in the same room rather than consulting them in sequence. Issue a holding statement. Notify affected people before the press wherever possible. Start a time-stamped log of every decision.
What is a holding statement?
A short statement acknowledging that something has happened, saying what you are doing about it, and stating when you will update. It can be issued before you know everything, it costs almost nothing, and it buys hours. Silence in the first hour is read as guilt or incompetence, and both are harder to correct than an incomplete statement is to update.
Should I ever say ‘no comment’?
No. It is a comment, and it reads as a refusal. If you cannot say something, say why — an active investigation, a duty to notify affected people first, a legal constraint. Audiences do not distinguish between ‘cannot’ and ‘will not’ unless you make the distinction for them.
Can a crisis firm make a story go away?
No, and any firm offering to is either describing something you should not buy or promising something nobody can deliver. What a good firm does is shape what is said, sequence it correctly, protect the spokesperson, and shorten the duration by removing the reasons for the story to continue.
Who leads in a crisis, legal or communications?
It depends on the exposure, which is exactly why both should be in the room from minute one rather than consulted in sequence. Counsel typically wants to say less and communications typically wants to say more; the correct answer is almost never either extreme, and the tension between them is the work.
Does crisis communication affect legal privilege?
It can, and how the working arrangement is structured matters. This is a question for qualified counsel and it should be settled before an incident rather than during one. Nothing on this page is legal advice.
Is every bad situation a crisis?
No, and treating an operational incident like a full crisis manufactures the story you were trying to avoid. Write escalation criteria while nothing is happening, so the decision is made against written standards rather than under pressure by whoever answers the phone.
What is a second wave and how do I avoid one?
New facts emerging after the first response has closed, which turns the story into what you knew and when — a story about honesty rather than about the original incident. Avoid it by never saying more than you have verified, distinguishing clearly between what you know and what you are investigating, assuming anything uncertain will come out, and updating proactively.
How long does a crisis last?
Coverage usually peaks within two or three days and declines over the following week. Search results take six to twelve months to settle, and a second wave can arrive weeks later if new facts emerge. Treating day three as the end is the most common planning error in this category.
Why does this page not rank the best crisis management companies?
Because crisis work is confidential, so the engagements that would tell you who is genuinely good are the ones nobody can discuss. Any ranked list is built on cases that became public, which are disproportionately the ones that went badly. The six diligence questions on this page are checkable in one call and more predictive than any list.
How do I judge a crisis management firm quickly?
Ask about your legal exposure in the first conversation and see whether they raised it before you did. A firm that has handled serious incidents asks immediately, because in a serious incident that question governs everything else. Then ask who specifically would work it, what the pricing structure is, and when they would advise saying nothing.
What should a crisis plan contain?
Escalation criteria, named roles with deputies, an out-of-hours contact list including counsel and insurer, holding statements for your three or four likeliest scenarios, a notification map, a monitoring arrangement, a decision log template, and a post-incident review process. It fits on a few pages and it should be tested once a year.
How often should spokespeople be media trained?
Annually, and train a deputy. A spokesperson trained four years ago is effectively untrained — the formats have changed and the muscle memory has gone. The most common preparedness failure is that the one trained person is unreachable when it happens.
Does insurance cover crisis PR?
Sometimes. Several policy types include crisis communications costs, occasionally with panel suppliers you are expected to use. Check the policy before an incident rather than during one, because discovering a panel requirement mid-crisis can force a change of adviser at the worst possible moment.
Should we notify our regulator before the press?
Frequently yes, and in some sectors it is a requirement rather than a courtesy. Know which of your regulators expect to hear from you first and within what timeframe, and put it in the notification map in your plan. Take advice on the specifics from counsel.
What happens after the coverage stops?
The search results remain, and they settle over six to twelve months shaped by what you publish afterwards. The most effective post-crisis action is publishing clear, honest answers to the questions people now ask, plus specific remediation with dates. Vague commitments to do better move nothing.
Who is the audience people forget in a crisis?
Employees. They read everything before customers do, they are asked about it constantly by friends and family, and they are the most credible source anyone has for what really happened. Internal communication should be planned at the same time as external, not afterwards.
What is the difference between crisis PR and reputation management?
Crisis PR handles a live incident: facts, statements, spokespeople, sequencing, journalists. Reputation management is the longer, slower work of shaping what appears about you over time, much of it search and content work. They overlap after an incident, and the second usually follows the first.
Can we handle a crisis in-house?
Sometimes, if you have communications people with genuine crisis experience and a tested plan. Even then a standby relationship is worth buying for surge capacity, because incidents do not respect holidays and an in-house team of two cannot run a twenty-four-hour response for a week.
What is the single biggest mistake organizations make?
Denial before the facts are established. It is the most damaging reflex in crisis communication because it converts a recoverable incident into a credibility problem, and credibility is far harder to rebuild than operations. The second biggest is blaming a junior employee, which reads exactly as it is.
Do small businesses need crisis PR?
Most do not need a retained firm. They do need a one-page plan, one trained spokesperson, and monitoring on their own name. That costs very little and covers the realistic downside for a business with no regulator and limited legal exposure. Buy the plan, not the retainer.

Sources and further reading

  1. Google Search Essentials — SEO starter guide
  2. Google: creating helpful, reliable, people-first content
  3. Google: intro to structured data
  4. Google: LocalBusiness structured data
  5. Google: FAQPage structured data
  6. Google: Article structured data
  7. Google: Product structured data
  8. Google: title links in search results
  9. Google: control your snippets
  10. Google: robots.txt introduction
  11. Google: sitemaps overview
  12. Google: consolidate duplicate URLs
  13. Google: redirects and Search
  14. Google: JavaScript SEO basics
  15. Google: multi-regional and multilingual sites
  16. Google Search Central Blog
  17. Google: get started with Search Console
  18. Google: how local search results are determined
  19. Google Business Profile: prohibited and restricted content
  20. Google Business Profile: address and service area guidelines
  21. Google Business Profile: review policy
  22. Google Business Profile: add or edit categories
  23. FTC: CAN-SPAM Act compliance guide
  24. FCC: telemarketing and robocall rules (TCPA)
  25. FTC endorsement guides — reviews and testimonials
  26. FTC: rule on consumer reviews and testimonials
  27. HHS: HIPAA guidance on online tracking technologies
  28. New Jersey Courts: attorney advertising guidelines
  29. New Jersey DCA: construction codes and permits
  30. New Jersey Home Improvement Contractor registration
  31. New Jersey Division of Consumer Affairs
  32. US Census Bureau QuickFacts: New Jersey
  33. US Census Bureau: American Community Survey
  34. US Census: Statistics of US Businesses
  35. Bureau of Labor Statistics: New Jersey data
  36. BLS: Occupational Employment and Wage Statistics
  37. NJ Department of Labor: labor market information
  38. New Jersey Business Action Center
  39. US Small Business Administration: New Jersey district
  40. USA.gov: business resources
  41. Google Ads: location targeting settings
  42. Google Ads: about negative keywords
  43. Google Ads: about Quality Score
  44. Google Ads: importing offline conversions
  45. Google Ads: about Smart Bidding
  46. Google Ads: about Performance Max
  47. Google Local Services Ads: eligibility and screening
  48. Google Ads: keyword match types
  49. Google Analytics 4: about conversions
  50. Google Analytics 4: attribution models
  51. web.dev: Core Web Vitals explained
  52. web.dev: Largest Contentful Paint
  53. web.dev: Cumulative Layout Shift
  54. web.dev: Interaction to Next Paint
  55. Google PageSpeed Insights
  56. Google Rich Results Test
  57. Google Search Console
  58. W3C Markup Validation Service
  59. Schema.org: LocalBusiness type
  60. Schema.org: Service type
  61. Schema.org: FAQPage type
  62. Schema.org: HowTo type
  63. W3C: WCAG 2.2 quick reference
  64. TikTok for Business
  65. TikTok Creative Center
  66. TikTok Ads Help Center
  67. TikTok Community Guidelines
  68. TikTok Terms of Service
  69. TikTok Privacy Policy
  70. TikTok Safety Center
  71. TikTok Transparency Center
  72. TikTok Creator Portal
  73. TikTok Newsroom
  74. TikTok for Developers
  75. TikTok advertising solutions
  76. TikTok Creator Marketplace
  77. TikTok Business Center
  78. TikTok for Business blog
  79. TikTok Creative Center: top ads
  80. TikTok Branded Content policy
  81. TikTok Shop for sellers
  82. Instagram for Business
  83. Instagram for Creators
  84. Instagram Help Center
  85. About Instagram
  86. Meta Business Suite
  87. Meta Business Help Center
  88. Meta Transparency Center
  89. About Meta
  90. Meta: Instagram platform docs
  91. YouTube Creators
  92. YouTube Official Blog
  93. YouTube Shorts help
  94. How YouTube Works
  95. YouTube Studio
  96. LinkedIn Marketing Solutions
  97. LinkedIn Help
  98. Pinterest Business
  99. Pinterest Business Help
  100. Snapchat for Business
  101. X for Business
  102. Reddit communities
  103. Reddit for Business Help
  104. ASCAP
  105. BMI
  106. SESAC
  107. Global Music Rights
  108. PRS for Music (UK)
  109. PPL (UK)
  110. SOCAN (Canada)
  111. APRA AMCOS (Australia)
  112. GEMA (Germany)
  113. SACEM (France)
  114. SIAE (Italy)
  115. JASRAC (Japan)
  116. IFPI
  117. RIAA
  118. National Music Publishers Association
  119. Harry Fox Agency
  120. SoundExchange
  121. Music Reports
  122. Epidemic Sound
  123. Artlist
  124. Soundstripe
  125. PremiumBeat
  126. AudioJungle
  127. Free Music Archive
  128. Creative Commons
  129. Incompetech
  130. FTC: advertising and marketing
  131. FTC: disclosures 101
  132. FTC: endorsement guides
  133. FTC: consumer reviews rule
  134. FTC: advertising FAQs
  135. US Copyright Office
  136. US Copyright Office: DMCA
  137. US Copyright Office: music FAQ
  138. US Copyright Office: fair use FAQ
  139. USPTO: trademarks
  140. UK Advertising Standards Authority
  141. ACCC (Australia)
  142. Competition Bureau Canada
  143. GDPR overview
  144. California Consumer Privacy Act
  145. COPPA
  146. FTC: children’s privacy
  147. W3C Web Accessibility Initiative
  148. W3C: WCAG
  149. W3C: captions
  150. W3C: making audio and video accessible
  151. ADA.gov
  152. WebAIM
  153. Epilepsy Foundation
  154. Pew Research: internet and technology
  155. DataReportal
  156. US Census Bureau
  157. US Bureau of Labor Statistics
  158. Interactive Advertising Bureau
  159. Think with Google
  160. Google Trends
  161. Nielsen insights
  162. Schema.org: VideoObject
  163. Schema.org: SocialMediaPosting
  164. Schema.org: MusicRecording
  165. Schema.org: HowTo
  166. Schema.org: FAQPage
  167. Schema.org: Organization
  168. Google: video best practices
  169. Google: video structured data
  170. CapCut
  171. Adobe Premiere Rush
  172. DaVinci Resolve
  173. Canva
  174. Descript
  175. VEED
  176. Kapwing
  177. Otter.ai
  178. Later
  179. Buffer
  180. Hootsuite
  181. Sprout Social
  182. Google Analytics
  183. Google Search Console
  184. Google Analytics developer docs
  185. GA4: events and conversions
  186. Matomo
  187. Plausible Analytics
  188. Similarweb
  189. UK Information Commissioner’s Office
  190. Office of the Privacy Commissioner of Canada
  191. Australian OAIC
  192. European Data Protection Board
  193. EU data protection
  194. EU Digital Services Act
  195. Ofcom
  196. FCC
  197. AIGA
  198. Nielsen Norman Group
  199. Smashing Magazine
  200. web.dev
  201. MDN: web media
  202. MDN: the video element
  203. ISO 21001 (reference)
  204. Buma/Stemra (Netherlands)
  205. STIM (Sweden)
  206. Teosto (Finland)
  207. Koda (Denmark)
  208. TONO (Norway)
  209. IMRO (Ireland)
  210. SGAE (Spain)
  211. ZAiKS (Poland)
  212. KOMCA (South Korea)
  213. MCSC (China)
  214. CISAC
  215. World Intellectual Property Organization
  216. TikTok: creating videos
  217. TikTok: exploring videos
  218. TikTok: privacy settings
  219. TikTok: growing your audience
  220. TikTok Creator Academy
  221. TikTok Effect House
  222. TikTok for small business
  223. Instagram: Reels help
  224. YouTube: Shorts best practice
  225. How YouTube recommends
  226. Pinterest Predicts
  227. Snapchat for Business
  228. Hootsuite blog
  229. Social Media Examiner
  230. Marketing Week
  231. Adweek
  232. Public Relations Society of America
  233. PRSA Code of Ethics
  234. FTC — data breach response guide
  235. FTC — privacy and security guidance
  236. HHS — HIPAA breach notification rule
  237. CISA — cyber threats and advisories
  238. CISA — cyber incident response
  239. NIST Cybersecurity Framework
  240. US Securities and Exchange Commission
  241. US Occupational Safety and Health Administration
  242. Ready.gov — business continuity planning
  243. FEMA
  244. USA.gov — state consumer protection offices
  245. Muck Rack
  246. Cision

Get a free marketing proposal

Tell us what you are trying to grow and we will come back with a plan, not a pitch deck. Same-day reply on weekdays.

Privacy Preferences
When you visit our website, it may store information through your browser from specific services, usually in form of cookies. Here you can change your privacy preferences. Please note that blocking some types of cookies may impact your experience on our website and the services we offer.