A social media crisis is not defined by a high comment count. It is a situation in which rapidly changing public information may create material harm to people, customers, operations, reputation, legal position, security, or public trust. The playbook should accelerate fact-finding and ownership without turning unverified urgency into public error.
Define severity before the crisis
Create severity levels tied to observable conditions, not emotion. A routine complaint may stay in community support. A coordinated misinformation spike, safety incident, data exposure, legal allegation, executive misconduct claim, product failure, or rapidly spreading customer harm may require incident leadership.
For each level, define who can declare it, response time, required functions, executive notification, legal or security involvement, approval path, monitoring cadence, and authority to pause scheduled content or automation.
Document triggers that immediately suspend publishing: uncertain facts, affected-person privacy, active security containment, regulator or law-enforcement instruction, conflicting business statements, or inability to verify the official account and spokesperson.
Triage the signal and preserve evidence
Open an incident record with a stable ID, detection time, source, screenshots or URLs, known facts, unknowns, affected people or systems, geography, languages, current spread, and named incident lead. Preserve evidence without redistributing harmful personal data.
Separate four categories:
- verified facts supported by accountable sources;
- credible but unverified reports requiring investigation;
- interpretation or public sentiment;
- false, manipulated, or irrelevant material.
Do not let a viral post become the sole source of truth. Check internal operations, security, customer support, legal, product, local staff, and relevant public authorities. Record who verified each fact and when.
Establish command, channels, and decisions
Name one incident lead, one communications lead, one final approver, one record keeper, and owners for customer support, community moderation, security or operations, legal, and executive coordination. Define a secure internal channel and a decision log.
Inventory every public surface: social accounts, website, status page, help center, email, in-product notice, spokesperson accounts, partner channels, advertising, scheduled posts, and automated replies. Decide which surfaces pause, continue, redirect, or publish an update.
The public source of truth should be stable and updateable. Social posts can point to it, but should not create different facts across channels. Record exact approved wording, version, destination, publish time, and owner.
Write holding statements and updates
A holding statement is useful only when it says what is known, what the organization is doing, what affected people should do now, and when another update will arrive. Do not fill uncertainty with reassurance that cannot be supported.
Use plain language. Acknowledge impact before defending intent. Avoid speculation, blame, legal conclusions, exposure of private individuals, or promises outside the incident team's control. Localize meaning, not merely words, for affected markets.
Every update should carry a timestamp and version. State what changed from the prior update. If earlier information was wrong, correct it clearly instead of silently editing the record where platform behavior would hide the correction.
Publish, moderate, and recover safely
Before publishing, confirm account identity, version, facts, legal and privacy review, affected-person safety, links, accessibility, localization, reply plan, and next update time. Disable or constrain automation that could publish irrelevant promotional content or unsafe replies.
Monitor questions, misinformation, threats, impersonation, affected-customer reports, and media requests. Use moderation rules consistently and preserve evidence for serious abuse. Do not delete criticism merely because it is uncomfortable; act on policy violations and safety risks.
After containment, publish the resolution or next durable state, resume scheduled content deliberately, and review what should remain paused. Conduct a retrospective covering detection, facts, decisions, approvals, publishing, community load, tooling, permissions, and affected-person outcomes.
Crisis response checklist
- Stable incident ID, severity, lead, detection time, and evidence recorded
- Facts, credible unknowns, sentiment, and false material separated
- Required legal, security, operations, support, and executive owners active
- Scheduled content, ads, automations, and public surfaces inventoried
- One updateable public source of truth selected
- Holding statement states known facts, action, guidance, and next update
- Every public version, approver, destination, and live URL logged
- Recovery, correction, resumption, and retrospective completed
The playbook should be adapted to the organization's legal, security, safety, regulatory, and geographic obligations. It is an operating framework, not professional legal or emergency advice.
