The first 60 minutes of a crisis: a leader's protocol

Why the first hour sets the price of the whole incident

Every serious incident opens with the same paradox: the decisions that shape its cost most must be taken before the facts arrive. In the first sixty minutes a leader decides who is in charge, whether an incident is declared, what staff are told and what customers hear — and the full picture will be available for none of it, because in hour one the full picture never is. What separates a company with a protocol from a company improvising is not composure or talent. It is that the first organisation made most of these decisions in peacetime — names, thresholds, message templates — and on the day merely executes them. Improvisation surfaces later as money: hours of downtime added while managers debated who was entitled to declare an incident, a contradictory promise to customers that took a quarter to walk back, an insurance claim weakened because nobody could show what was decided, by whom, at what time.

Minutes 0-15: confirm and classify

Three questions, in strict order. Is anyone hurt or in danger — everything else waits behind that answer. What has actually happened — separating what is known from what is assumed, because the first report is almost always partly wrong. And what is affected — which sites, systems, services and customers, even as a rough first sketch. The classification does not need to be elegant; it needs to be fast and honest about its own uncertainty.

The most important line in any first-hour protocol is a name. Somebody must hold the authority to declare an incident and convene the crisis team — a named person with a named deputy for nights, holidays and travel, not a committee and not a job grade. Where that line is missing, companies lose their first hour to a question nobody wants to answer alone: is this serious enough to wake the chief executive? One caveat before moving on: if the disruption is a cyberattack, declare the incident and then change playbooks — the first hours of ransomware follow their own decision logic, and we cover them separately in Ransomware: the first hours.

Minutes 15-30: activate the crisis team

The team that functions under pressure is small and named. Four roles are enough to start: a leader who takes decisions and owns priorities; an operations lead who works the problem itself; a communications lead who owns every word that leaves the company; and a log-keeper. One room or one channel — a crisis managed across five parallel chats is five different crises with five versions of the truth.

The golden rule of the half-hour mark: the log starts now. Every decision, every incoming report, every instruction — time-stamped, in one place, kept by one person whose only job that is. The decision log is short-term memory for a team that would otherwise re-argue settled questions; it is evidence for insurers and regulators, who will ask precisely what you knew and when; and it is the raw material for learning once the smoke clears. Ten seconds per entry during the incident saves weeks of dispute after it.

Minutes 30-60: first communications

Internal before external, without exception. Employees who learn of the incident from social media stop trusting internal channels at exactly the moment you need those channels most, and an uninformed workforce becomes an accidental source of leaks and rumour. Two paragraphs to staff — what happened, what we are doing, where the next instructions will come from — buy more order than any press release.

Externally, hour one belongs to the holding statement: a short text drafted and approved in peacetime, saying that the situation is known, that a named team is acting, and when the next update will come. Just as important is what hour one must not contain: no causes before they are established, no restoration deadlines, no guarantees that data is safe. Every promise broken in hour one is repaid with interest in week two. How crisis governance, escalation and communications fit into a wider resilience system is the subject of module M4 of the ERGP programme.

The five classic first-hour mistakes

1. Waiting for the full picture. The picture matures over days while the cost accumulates by the hour; acting at seventy percent certainty is the discipline, not the exception.
2. The leader diving into technical detail. While the chief executive studies server logs, nobody is deciding, prioritising or communicating — the one function no one else can cover stands vacant.
3. Promising customers deadlines. "Back by 6 pm" said at 9 am converts a service failure into a credibility failure at one minute past six.
4. Silence toward staff. Rumour fills every vacuum within the hour, and rumour retold to customers by your own employees becomes the public story.
5. Running the hour without a log. Every later argument — with the insurer, the regulator, the board — is then settled by memory against memory, and memory loses.

Rehearsed, not improvised

A protocol opened for the first time during a real fire is scenery. The first hour becomes fast only when the named people have actually walked it — declared a fictional incident, convened, kept the log, released the holding statement — around a table, against the clock, before anything burns. That takes a ninety-minute tabletop exercise once or twice a year; the method, scenarios and typical findings are described in our tabletop exercise guide. Companies that rehearse the hour do not become immune to crises. They become quick — and in hour one, quick is what money looks like.