Crisis Management PR Firm: What to Buy, When to Buy It

Updated September 2026 · Written and maintained by the Progression Agency strategy team

Every firm worth hiring will tell you the same thing, and almost nobody acts on it: retain a crisis team before you need one. A crisis PR firm engaged on day one of an incident spends that day learning your business instead of managing it, and the first hour is the hour that decides whether the story is about what happened or about how you responded. This page covers what crisis management actually costs, how the standby-plus-day-rate structure works, what to do in the first sixty minutes, how to judge a firm in one call, and the long tail nobody plans for.

Why you hire before, not during

Answer first: because activation without a standby relationship costs you the first day. A team that already knows your business, your spokespeople, your regulator and your legal posture starts work in the first hour. A team hired that morning starts work the following morning.

What a standby retainer actually buys

• A briefed team. People who have read your risk register, met your spokespeople and understand your sector’s regulator.
• Pre-drafted holding statements for your three or four most likely scenarios, ready to be adapted rather than written under pressure.
• An agreed escalation route with names and numbers that work at three in the morning.
• Priority access. A retained client is answered first when a firm has several incidents at once, and firms frequently do.
• Media training kept current, because a spokesperson trained four years ago is effectively untrained.

What it costs not to have one

The activation day rate is higher without a standby arrangement, but that is the smaller cost. The larger one is the twenty-four hours spent briefing a team while the story forms without you. In that window the narrative is set by whoever is talking, and if that is not you it is somebody else.

What a crisis management PR firm costs

Answer first: a standby retainer of roughly $2,500 to $6,000 a month, a preparedness project at $10,000 to $25,000, and activated day rates from $5,000 to $50,000 depending on severity, sector and whether counsel is coordinating.

The conclusion: the standby retainer is the line almost nobody buys and the one that changes the outcome most. It costs a fraction of a single activated day.

The first hour

Answer first: establish the facts, name one decision-maker and one spokesperson, put legal and communications in the same room, issue a holding statement, notify affected people before the press, and start a time-stamped log. In that order.

Why the holding statement matters more than the full statement

A holding statement acknowledges that something has happened, says what you are doing about it, and states when you will update. It costs almost nothing, it can be issued before you know everything, and it buys hours. Silence in the first hour is read as guilt or incompetence, and both are harder to correct later than an incomplete statement is to update.

What a holding statement should and should not contain

Why ‘no comment’ is the worst available answer

It is a comment, and it reads as a refusal. If you cannot say something, say why you cannot say it — an active investigation, a duty to notify affected people first, a legal constraint. Explaining the constraint is transparent; refusing to engage is not, and audiences do not distinguish between cannot and will not unless you do it for them.

Legal and communications: the tension that is the work

Answer first: counsel usually wants to say less and communications usually wants to say more, and the correct answer is almost never either extreme. Put both in the room from minute one rather than consulting them in sequence.

• Privilege is real and how communications are handled can affect it. Ask counsel early how to structure the working arrangement.
• Notification duties are set by law, not by strategy. Data breach timelines in particular are statutory, and communications strategy operates inside them rather than around them.
• An admission and an apology are not the same thing in most jurisdictions, and the distinction is worth understanding before you need it. Take advice on it in advance.
• Regulators frequently expect to hear from you before the press does. Know which of your regulators do.
• Insurance may cover crisis communications costs. Check the policy before an incident, not during one.

Not every bad day is a crisis

Answer first: match the response to the severity. Treating an operational incident like a full crisis manufactures the story you were trying to avoid. Treating a safety incident like an operational one is considerably worse.

The conclusion: escalation should be a decision made against written criteria, not a judgment made under pressure by whoever picks up the phone. Write those criteria while nothing is happening.

How a crisis actually unfolds

The second wave

Answer first: most crises have one, and it is caused by new facts emerging after the first response has closed. It is almost always worse than the first wave, because the story becomes what you knew and when — which is a story about honesty rather than about the original incident.

How to avoid causing your own second wave

1. Never say more than you have verified, however much pressure there is to fill the silence.
2. Distinguish clearly between what you know, what you believe and what you are investigating.
3. If you are uncertain whether something will come out, assume it will.
4. Update proactively when new facts emerge rather than waiting to be asked.
5. Keep the log, because the sequence of what you knew will be reconstructed by others if you cannot produce it yourself.

Six incident types and what each one demands

Answer first: the response is shaped by the type of incident far more than by the size of the organization. These six cover most of what actually happens.

Product recall

Answer first: the notification and safety mechanics lead, and communications operate inside them. Direct customer contact matters more than press coverage, and the recall process itself sets the timeline you must communicate against.

Service outage

Answer first: a status page updated frequently beats any statement. Customers want to know whether it is fixed and when, and an outage handled with visible frequent updates rarely becomes a reputational event at all.

Data breach

Answer first: statutory notification timelines govern everything, and they are set by law rather than by strategy. Counsel leads, communications executes, and the schedule is not negotiable. The FTC publishes a data breach response guide worth reading before you need it.

Injury or safety incident

Answer first: people before reputation, without exception — and it is also the better strategy. Care for those affected, cooperation with authorities and visible seriousness are what shorten these, and any attempt to manage the perception before the substance makes it worse.

Misconduct allegation

Answer first: an internal-only review is not believed, by anyone. Where the allegation is serious, independence in the review is the thing that determines whether the response is credible, and it should be announced early rather than conceded later under pressure.

Organized public pressure

Answer first: this has a different arc from an incident — longer, quieter, and driven by a campaign rather than a news cycle. Engagement, not statements, is the instrument, and the mistake is treating a sustained campaign as though it will pass in three days.

How sector changes the playbook

Answer first: the sector determines who must be told first and what the statutory clock is, which in turn determines the sequencing of everything else. A restaurant’s timeline is set by the health department; a healthcare provider’s by breach notification rules; a school’s by an obligation to parents that overrides every other consideration.

Crisis management agencies, crisis PR firms and reputation firms: the labels

Answer first: crisis management agencies and crisis PR firms are the same thing, used interchangeably. Reputation management firms are a different product — slower, search and content led, and usually engaged after the news cycle rather than during it.

The conclusion: buy against the situation rather than the label. If the news cycle has ended and the search results have not, you need the fourth row, not the first.

Judging a crisis management firm in one call

Answer first: the fastest filter is whether they ask about your legal exposure in the first conversation. A firm that has handled serious incidents asks immediately, because in a serious incident that question governs everything else.

Six questions worth asking

1. What is our legal exposure here, and how do you work with counsel?
2. Who specifically would work this, and what is their background?
3. What is your structure — standby retainer plus activated day rate, or something else?
4. When would you advise us to say nothing at all?
5. Tell me about an incident where the response was wrong, and what you would do differently.
6. If I call at three in the morning, who answers and how quickly?

Answers that should end the conversation

The one that matters most: any firm offering to make the story go away, kill the coverage or guarantee suppression is either describing something you should not buy or promising something nobody can deliver. Both are disqualifying.

Best crisis management companies: why this page does not rank them

Answer first: because crisis work is confidential by nature, so the engagements that would tell you who is genuinely good are the ones nobody can discuss. Any ranked list of the best crisis management firms is built on the cases that became public, which are disproportionately the ones that went badly.

• The best work is invisible. An incident handled well frequently never becomes a story, which means it never appears in any assessment of the firm.
• Public case studies are self-selected. Firms publish what they are permitted to publish, which is a small and unrepresentative sample.
• Client lists tell you nothing about outcomes. A famous name on a website says a firm was hired, not that the engagement worked.
• Sector fit dominates. The best crisis management firm for a hospital and the best one for a restaurant group are not the same firm, and no general ranking captures that.
• Individual practitioners matter more than the firm. As in the rest of PR, the relationships and judgment belong to people who move between firms.

What this page offers instead is the diligence set above: the six questions, the structural expectations, and the answers that should end the conversation. Those are checkable by you, in one call, and they are more predictive than any list.

Monitoring: knowing before the journalist calls

Answer first: set alerts on your own organization name, your key executives, your products and your sector’s common failure terms. The worst way to learn about an incident is from a reporter asking for comment, because it means the story is already written.

• Your own name, in every spelling. Including common misspellings and the trading names customers actually use.
• Executive names. Personal stories become organizational ones quickly.
• Product and brand names, separately from the company name.
• Review platforms relevant to your sector. Consumer damage frequently appears there first.
• Your own employees’ public posts, to the extent that is appropriate and lawful in your jurisdiction.
• Regulator publications, where your sector has one that publishes enforcement.

What to do in the first week, after the first hour

Answer first: move from holding to substance, contact key journalists directly rather than only issuing statements, pursue corrections politely and in writing, and communicate remediation with named changes and dates.

1. Day one to two: the substantive statement. More than the holding statement, still only what is verified, with what changes as a result.
2. Direct outreach to the journalists who matter. A phone call to the reporter covering it is worth more than a press release to everyone.
3. Correct errors immediately, politely, in writing, with evidence. Most outlets correct genuine factual errors; almost none respond well to an aggressive approach.
4. Brief employees before or at the same time as the press. They are asked constantly and they are the most credible source anyone has.
5. Communicate remediation specifically. Named changes with dates, not commitments to do better.
6. Keep the log running. The sequence of what you knew will be reconstructed by others if you cannot produce it yourself.

Post-incident review, including for the small ones

Answer first: run a review after every incident, not only the serious ones. Small incidents are where a plan gets tested cheaply, and the failures they reveal are the same failures that would have mattered in a serious one.

Preparedness: what to build before anything happens

Answer first: a written plan, named roles with deputies, at least one trained spokesperson, monitoring on your own name, one tested scenario a year, and a review after every incident including the small ones.

Media training, and why it expires

A spokesperson trained four years ago is effectively untrained: the formats have changed, the questions have changed, and the muscle memory has gone. Refresh annually, and train a deputy — the single most common preparedness failure is that the one trained person is unreachable when it happens.

The long tail nobody plans for

Answer first: search results outlive coverage. The news cycle ends in days; what appears when somebody searches your name settles over six to twelve months and is shaped by what you publish afterwards.

1. Own the questions people now ask. Publish clear, honest answers to what actually happened and what changed. This is the single most effective post-crisis action available.
2. Communicate remediation specifically. Vague commitments to ‘do better’ do not move anything; named changes with dates do.
3. Do not argue in reviews. Respond once, factually, and move the conversation offline.
4. Remember employees. They read everything first, they are asked about it constantly, and they are the audience most often forgotten in a crisis response.
5. Expect six to twelve months before search results settle, and plan the content program across that period rather than hoping.

The rebuilding half of this is ordinary content and search work rather than crisis work, and it is covered in what SEO services involve and our PR services.

Spokesperson selection: who should actually speak

Answer first: the most senior person available who can speak plainly under pressure — which is frequently not the chief executive. Seniority signals seriousness, but a senior person who performs badly on camera does more damage than a credible director.

• Where people were harmed, seniority is not optional. A junior spokesperson reads as an organization hiding.
• For technical incidents, credibility beats rank. The person who can actually explain what happened is more reassuring than the person with the biggest title.
• Never make a junior employee the public face, and never name one as the cause. It reads exactly as it is.
• One voice, consistently. Multiple spokespeople produce contradictions, and contradictions become the story.
• Brief a deputy. The trained person will occasionally be unreachable, and that is when it happens.

Common mistakes, and what to do instead

Where a crisis PR firm sits alongside your other advisers

The conclusion: the crisis firm coordinates rather than commands. Where it adds the most value is in sequencing — deciding what is said, to whom, in what order — which is precisely the thing that cannot be worked out under pressure by people who have never done it before.

Rebuilding: the six to twelve months after

Answer first: publish clear honest answers to the questions people now ask, communicate remediation with dates, respond once to reviews rather than arguing, and expect search results to settle over six to twelve months rather than weeks.

Why search is the part that lasts

The news cycle ends in days. What appears when somebody searches your name persists, and it is shaped almost entirely by what you publish afterwards. An organization that says nothing after an incident cedes that space permanently to the coverage.

What to publish, specifically

1. A plain account of what happened, in your own words, on your own site.
2. What you found when you investigated, including anything uncomfortable.
3. What changed as a result, with names and dates.
4. Answers to the specific questions customers are now asking.
5. An update when the remediation is complete, rather than leaving the last word as the incident.

What not to do

• Do not attempt to suppress results. It is visible, it fails, and its discovery is a worse story than the original.
• Do not argue in reviews. Respond once, factually, and move it offline.
• Do not publish a triumphant recovery narrative. Understatement is more credible and considerably safer.
• Do not stop early. Six to twelve months is the realistic horizon and most organizations stop at six weeks.

Working with a crisis firm remotely

Answer first: crisis work is almost entirely remote-capable and always has been, because it is conducted by phone, message and document under time pressure. What matters is response speed and sector knowledge, not proximity.

• Test the response time before you sign. Call the out-of-hours number at an inconvenient moment and see what happens.
• Agree the working channel in advance — where the log lives, where drafts are shared, who is on the call bridge.
• Time zones matter more than distance. A firm three hours behind you is asleep during your first hour.
• In-person matters for two things: media training, and being physically present at a site during a serious safety incident.

Progression Agency works with organizations across all fifty states from New York City, and coordinates with the client’s own counsel rather than providing legal advice. Our wider communications work and published retainers are on the PR services page.

When you do not need a crisis firm

• Your downside risk is genuinely small. Some businesses cannot generate a serious incident. Write a one-page plan and train one person instead.
• The incident is operational and contained. Direct customer communication handles it, and escalating manufactures a story.
• You have in-house communications with crisis experience. Then buy the standby relationship for surge capacity rather than for the core work.
• The real problem is a legal one. Then counsel leads and communications supports. Buying comms to solve a legal problem does not work.

Communications and measurement, from the people who publish the platforms

Publicly available talks from Google Ads, Think with Google, Ad Age, HubSpot, Ahrefs and Neil Patel on measurement, search behavior and how coverage interacts with what people find afterwards — the long tail that outlives any news cycle. None of these are ours; each is credited to its channel by name and upload date, every identifier was verified live before publication, and each tile loads its player only when you click it.

The top crisis management firms are concentrated in a handful of markets, and crisis management firms in DC are a distinct cluster: Washington practices are built around regulatory, congressional and litigation-adjacent exposure, where the audience is a committee or an agency rather than a consumer. Crisis management firms in DC therefore staff differently — former government communications people and lawyers alongside media specialists. If your exposure is consumer or reputational rather than regulatory, that is the wrong specialism, competently delivered.

Taglines and advertising slogans

The shortest piece of copy a brand owns, and the most argued over.

Tagline advertising is the practice of attaching a fixed phrase to the brand across everything it runs. A tagline of ads that works has three properties: it is short enough to be repeated exactly, it says something a competitor could not credibly say, and it is held long enough to become shorthand. An advertising company slogan changed every campaign never becomes an asset.

Ad catchphrases and taglines are not the same thing, though they are used interchangeably. A catchphrase belongs to a campaign and can be retired; a tagline belongs to the brand and should not be. Confusing the two is how a company ends up abandoning a line that had finally started to work.

Advertising slogans conditional statements — the if-then construction, promising an outcome contingent on an action — are common because they imply a result without stating it flatly. That does not exempt them from substantiation: an implied claim carries the same obligation as an explicit one, which is worth knowing before the clever version goes to print.

Frequently asked questions