How Do You Maintain Crisis Communication When Infrastructure Fails?

Your crisis communication plan needs three operational levels, not one.

By Philippe Borremans, Crisis, Risk and Emergency Communication Consultant at RiskComms FZCO and publisher of the Wag The Dog Newsletter, 2025

Most crisis plans fail because they assume infrastructure will remain intact. Your 87-page crisis communication plan sitting in SharePoint becomes useless not because it's poorly written or lacks detail, but because when your network crashes, half your team becomes unreachable, and regulators start calling, you won't have time to find page 43 about stakeholder mapping.

Infrastructure fails in layers, not all at once. A cyber attack doesn't kill everything instantly. Power outages cascade. Networks degrade. Systems flicker in and out.

PwC's "Minimum Viable Company" framework asks a brutally simple question: What is the absolute minimum your organisation needs to survive a major shock? Apply that thinking to crisis communication.

Your response needs three gears, not one. This isn't about having backup systems—it's about accepting that different levels of infrastructure failure require fundamentally different communication tactics. Organizations that pre-define their minimum viable operations during peacetime show dramatically faster recovery rates than those attempting to make these decisions during the crisis itself.

Level 1 represents your best-case bad day. The crisis is real, but your infrastructure holds.

Phones work. Internet's up. Email flows. Your emergency notification system fires on all cylinders. You can execute your full communication protocol with holding statements in minutes, follow-up updates every 2-4 hours, responsive and strategic messaging.

Your stakeholder communication functions normally. Employees receive SMS alerts through your emergency notification platform. Critical customers get email updates to pre-registered contacts. Regulators receive direct phone calls from your crisis lead. Media outlets receive official statements via your digital channels.

Your three decision-makers — Crisis Lead, Legal, Communications — connect instantly. Video calls work. Document sharing works. You can refine messaging beyond the holding statement in real-time. This is crisis communication as planned.

But here's the danger: complacency.

Just because systems work now doesn't mean they'll keep working. The minimum viable approach means activating your MVCC framework anyway, ready to cascade down as infrastructure degrades.

Organizations that wait until infrastructure fails to activate contingency protocols lose hours in response time—often the difference between containing a crisis and watching it spiral beyond control.

This is where most organisations fail.

Systems are compromised, intermittent, or unreliable. Maybe it's a cyber attack. Maybe it's infrastructure damage. Maybe your IT department is fighting fires and can't guarantee anything. Your ENS might work. It might not. Email is unreliable. Calls may not go through.

This is the fog of war, and it requires different tactics:

Your dark site goes live. This simple, separately-hosted webpage becomes your single source of truth. You've tested the activation process. You know it works. Critical stakeholders know to check it.

Your out-of-band phone line activates—a dedicated line separate from your main system, with a recorded message that updates every few hours. You've shared this number in advance with your critical stakeholders. Anyone can call it.

Text messaging becomes primary. But not through your corporate system—through personal phones if necessary. Your skeleton crew has pre-loaded contact lists for critical stakeholders. Yes, this means using personal devices. Yes, this violates your normal protocols.

Normal is gone.

Your pre-printed call tree activates. Your crisis lead carries a laminated card with 20 critical numbers. Old school? Absolutely. But it works when digital fails.

Of course, your three decision-makers may not be able to video conference. Fine. One of them is designated as the final authority in Level 2. That person approves the pre-written holding statement via text message. Speed trumps consensus.

You don't have time or capability for custom messaging. You activate one of your five pre-approved holding statements, fill in the blanks, and push it through whatever channels still function. Then you move on to the next critical task.

This level requires accepting imperfection. Your message won't reach everyone. Some stakeholders will be frustrated. But you're maintaining the minimum viable connection with the people who matter most.

Total infrastructure failure. No phones. No internet. No email. No emergency systems.

Everyone ignores this scenario because it seems impossible. Until it happens. I've been in this situation during infrastructure collapse. It's chaos. But chaos with a plan beats chaos without one.

You cannot reach everyone. You can barely reach anyone. So you focus on the absolute minimum:

Employees on-site get face-to-face briefings at pre-designated assembly points. Physical bulletin boards. Yes, bulletin boards—with paper and tape.

Critical customers get a designated person who physically travels to their location if they're nearby. This person has decision-making authority to speak for your organisation.

Regulators get the same approach—physical presence if possible, or any available method. Borrowed phones. Neighbouring facilities. Whatever it takes.

Your "technology" is now a 2,000-year-old invention: paper, physical presence, and persistence. Your crisis lead carries printed copies of the five holding statements. Your skeleton crew has pre-arranged physical meeting locations.

You've identified alternative facilities with working communications: a neighbouring business, a nearby hotel, a government emergency operations centre that might share resources.

In a blackout, your Crisis Lead has full authority. Period. No approvals needed. No sign-offs required. They activate the pre-approved holding statement and make real-time decisions to keep the organisation viable.

Not ideal. But ideal is a luxury you don't have.

You have one message, pre-approved for exactly this scenario. You post it physically. You share it verbally. You have people repeat it to others. It spreads through human networks because digital ones are gone.

Level 3 is about survival, not sophistication. You're buying time to restore infrastructure while maintaining the minimum connection to critical stakeholders.

Most organisations make two mistakes. First, they plan only for Level 1. Second, they try to execute Level 1 tactics at Level 2 or 3.

Your MVCC framework prevents both.

You identify your three critical stakeholder groups once. They're the same across all levels. What changes is how you reach them. You prepare your five holding statements once. They work across all levels. What changes is how you distribute them.

You designate your skeleton crew once. They're the same three people. What changes is how they coordinate.

For Level 1:

For Level 2:

For Level 3:

Then test this. Not a tabletop exercise with perfect conditions—a real test with simulated infrastructure failure. Turn off your email. Disable your video conferencing. See if your Level 2 plan actually works.

Because the time to discover it doesn't is not during the actual crisis.

I've watched organisations collapse not because the crisis was unsurvivable, but because they couldn't communicate during the crisis.

Employees panicked because they heard nothing. Customers defected because they got no updates. Regulators intervened because silence looked like negligence.

The MVCC framework with three levels gives you a realistic, tiered response. You hope for Level 1. You prepare for Level 2. You survive Level 3.

Most importantly, you've already made the hard decisions about who matters most and what you'll say when systems fail. Making those decisions during the crisis? That's when organisations break.

Build your MVCC framework. Keep it simple. Test it at all three levels.

When everything collapses, simple is the only thing that works. And knowing which playbook to grab when the fire starts? That's what separates organisations that survive from organisations that don't.

The MVCC framework is a three-tiered crisis communication system that operates at Level 1 (full infrastructure), Level 2 (compromised infrastructure), and Level 3 (total infrastructure failure). Unlike traditional plans that assume working systems, MVCC pre-defines communication methods, stakeholder priorities, and decision authority for each infrastructure scenario.

Traditional plans assume telecommunications infrastructure will remain intact and focus on message refinement and stakeholder mapping. MVCC assumes infrastructure will fail in layers and prioritizes maintaining minimum stakeholder connection through progressively simpler communication methods as systems degrade.

Your skeleton crew should consist of three decision-makers: Crisis Lead, Legal, and Communications. At Level 1, all three collaborate on messaging. At Level 2, one person (pre-designated) has final authority to approve holding statements. At Level 3, the Crisis Lead has complete authority to make real-time decisions.

Out-of-band methods are communication channels that operate independently of your primary infrastructure. Examples include: dedicated phone lines separate from your main system, personal mobile phones with pre-loaded contact lists, physical bulletin boards, printed call trees, and alternative facilities with working communications.

Organizations should conduct quarterly tests with progressive infrastructure failure simulation. Test Level 2 annually by actually disabling email and video systems during a drill. Test Level 3 every two years with physical communication exercises. Update pre-approved holding statements after each major organizational change.

While specific statements vary by organization, the five categories typically cover: (1) cybersecurity incident, (2) operational disruption, (3) regulatory investigation, (4) safety incident, and (5) senior leadership transition. Each statement includes fill-in-the-blank sections for incident specifics while maintaining pre-approved legal and regulatory language.

Yes. Small organizations need MVCC even more than large enterprises because they have fewer redundancies. The framework scales down to a single decision-maker with pre-identified critical stakeholders (customers, suppliers, employees), three communication methods (phone, text, physical presence), and two holding statements (operational issue, external incident).

Critical stakeholders are those whose immediate disconnection would threaten organizational survival within 72 hours. This typically includes: regulators who could shut down operations, key customers representing >20% of revenue, essential suppliers for core operations, and employees with unique technical knowledge. Everyone else is important but not critical.

Non-critical stakeholders receive updates through your dark site and public channels as infrastructure allows. They're not ignored—they simply don't receive the resource-intensive personal contact reserved for critical stakeholders during infrastructure failure. Once systems restore to Level 1 or 2, communication expands to all stakeholder groups.

Share the existence of the framework and your commitment to maintaining communication during infrastructure failure. Share your dark site URL, out-of-band phone number, and physical assembly locations with critical stakeholders in advance. Don't share your complete decision tree, authority assignments, or specific crisis response protocols.

About the Author: Philippe Borremans is a crisis communication consultant and founder of RiskComms consulting, specializing in crisis, risk, and emergency communication. He has developed frameworks including the Universal Adaptive Crisis Communication (UACC) Framework and the AI-Augmented Crisis Decision Matrix (ACDM).