What Is a Crisis Holding Statement?
A crisis holding statement is a short, approved first statement an organisation issues when an incident is known but the facts are incomplete: it acknowledges what happened, says what is confirmed and what is being done, and says when more information will follow.
Its job is to fill the gap between the first questions and the full account. The U.S. Centers for Disease Control and Prevention's Crisis and Emergency Risk Communication manual (CERC) gives the reason in its first principle, Be First: “Crises are time-sensitive. Communicating information quickly is crucial. For members of the public, the first source of information often becomes the preferred source” (CDC CERC Introduction). Its second, Be Right, sets the content: “Information can include what is known, what is not known, and what is being done to fill in the gaps.” A holding statement is that sentence turned into a paragraph. If the crisis is a news story you dispute, see how to respond to a negative news article.
How to Write a Crisis Holding Statement at a Glance
| Step | Action | Expected result |
|---|---|---|
| 1 | Write down what you know, what you do not know and what you are doing | A one-page fact sheet, dated and timed |
| 2 | Open by acknowledging the people affected | One sentence of concern, before any explanation |
| 3 | State only the confirmed facts and your response | Two or three plain sentences |
| 4 | Tell people what they can do, if anything | Up to three actions, phrased positively |
| 5 | Say when and where the next update will come | A time and a URL |
| 6 | Approve and publish on a channel you control | The statement live on your newsroom page |
| 7 | Check legal clocks, then update or replace the statement | A schedule of updates tied to any required notices |
Time: aim to publish within the first hour of confirming an incident (our estimate; no rule sets it). Tools: a pre-approved template, a fact sheet, your newsroom page. Cost: none. Skill level: intermediate; the hard part is approval speed.
What You Need Before Starting
- A pre-approved template (below) and a named approver plus deputy. CERC lists “Draft and test messages” and “Determine approval process” as preparation-phase tasks.
- A page on your site where statements are published and updated; see how to create an online newsroom.
- One named spokesperson, briefed; see running a media training session for executives.
- Legal counsel's contact and a list of any notification duties that apply to you (data protection, sector regulators, securities).
- Monitoring on your company and product names; see how to monitor brand mentions.
Step 1: Write Down What You Know, What You Do Not Know and What You Are Doing
Start with a fact sheet, not the statement. Use the three headings from CERC's Be Right principle: known, not known, being done.
Process: note the time you learned of the incident, what has been confirmed and by whom, what is unconfirmed, and what actions are under way. Mark each item confirmed or unconfirmed. Only confirmed items go in the statement. Expected result: a one-page, timed fact sheet. Verify: a second person checks each confirmed item against its source. Common mistake: including the likely cause because everyone internally believes it. If it turns out wrong, the correction becomes the story.
Step 2: Open by Acknowledging the People Affected
Put people before process. CERC's guidance for the initial phase is to “Express empathy right away”, and its principle reads: “Crises create harm, and the suffering should be acknowledged in words.”
Process: write one sentence that names who is affected and acknowledges the effect on them. CERC also advises using personal pronouns, with phrases such as “We are committed to…”, and warns: “Humor is never a good idea in emergency communication.” Expected result: one plain sentence of concern. Common mistake: opening with the company's record (“Safety is our top priority”), which reads as self-defence.
Step 3: State Only the Confirmed Facts and Your Response
Keep it short. CERC's first rule for initial messages is to “Present a concise message”: “Keep the first messages simple and only include immediately relevant information. Do not start out with a lot of background. Avoid jargon and technical terms” (CDC CERC Messages and Audiences).
Process: write what happened, when and where, in one or two sentences, then one or two sentences on what you are doing. We suggest keeping the whole statement to a single screen; the template below is about 120 words before you fill it in. Expected result: facts and actions anyone can repeat accurately. Common mistake: technical language that only engineers or lawyers understand.
Pieces of information people tend to remember at a time, as stated by CDC
Source: CDC, CERC: Messages and Audiences (2018 update).
The normal-times bar is drawn at the upper figure of CDC's range. CERC is written for public health emergencies; we apply its message guidance to company statements.
Step 4: Tell People What They Can Do, if Anything
If there is an action that helps, say it. CERC's Promote Action principle says “Giving people meaningful things to do calms anxiety, helps restore order, and promotes some sense of control.”
Process: give no more than three actions. CERC says that in normal times people remember three to seven pieces of information, and that “In an emergency, this drops down to only three simple directions.” Phrase them positively where you can; CERC's example is “drink bottled water” rather than “do not drink the water”. Expected result: up to three clear actions, or none if there is nothing useful to do. Common mistake: inventing actions to look busy, such as “stay vigilant”.
Step 5: Say When and Where the Next Update Will Come
End with a time and a place. It is the line that makes a holding statement credible.
Process: give a specific next update time and the URL where it will appear. If there is information you cannot share yet, say why. CERC's guidance on openness: “If you have information you are unable to share, tell the public why the information is not available for release at the time (i.e., you are verifying information, or you are notifying your organization, or the information is not your organization's information to release).” Expected result: a committed update time. Common mistake: “We will provide updates as appropriate”, which commits to nothing.
Holding statement template
[Date, time, time zone]
We are aware of [plain description of the incident] at [location or service]
that began at [time]. [If people are affected:] Our first concern is
[the people affected], and we are sorry for the disruption and worry this causes.
What we know: [one or two confirmed facts].
What we are doing: [one or two actions under way, e.g. we have contacted
the relevant authorities / taken the system offline / paused deliveries].
[If there is something people should do:] If you [are affected], please
[action 1], [action 2]. [Contact route].
We do not yet know [the cause / the full extent]. We will update this
statement at [time] or sooner at [URL].
Media contact: [name, phone, email]Step 6: Approve and Publish on a Channel You Control
Publish the statement on your own site first, then share the link. CERC warns that silence is read as inaction: “If you do not communicate about your response, as far as the public knows, you are not responding.”
Process: send the draft to the pre-named approver and legal counsel together, with a short deadline. Publish on a dated newsroom page, send the link to journalists who have asked, post it on your main social channels, and give it to front-line staff first so they are not surprised. A short company boilerplate at the foot helps readers who do not know you. Expected result: one URL with the current statement. Common mistake: issuing different wording on each channel.
Step 7: Check Legal Clocks, Then Update or Replace the Statement
A holding statement is not a regulatory notice, but regulatory deadlines may be running while it is live. The chart shows some common ones. They apply only to certain organisations and incidents, and counsel should confirm which, if any, apply to you.
Maximum time allowed, in days (hours converted to days; SEC figure is business days)
Source: GDPR Article 33(1); NIS2 Directive Article 23(4); SEC press release 2023-139; 45 CFR 164.404 and 164.406.
Each rule applies only to certain organisations and incidents, and each starts its clock at a different moment (awareness, discovery or a materiality decision). GDPR and HIPAA also say “without undue” or “unreasonable delay”, so the figure is a ceiling, not a target. This is not legal advice.
The GDPR requires a controller to notify a personal data breach to the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it” (GDPR Article 33). The NIS2 Directive requires an early warning “within 24 hours of becoming aware of the significant incident” and an incident notification within 72 hours (NIS2 Article 23). The SEC says an Item 1.05 Form 8-K “will generally be due four business days after a registrant determines that a cybersecurity incident is material” (SEC). HIPAA requires notice to individuals “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach”, and notice to “prominent media outlets” where a breach involves more than 500 residents of a state or jurisdiction (45 CFR 164.404 and 164.406).
Process: keep the public statement consistent with any formal notice, publish updates at the times you promised, and replace the holding statement with a full statement once the facts are established. Keep earlier versions on the page with their times. Expected result: a dated trail of statements. Common mistake: leaving the holding line live for days with no update.
How to Verify It Worked
- Published fast: the time between confirming the incident and publishing is recorded, and short.
- Accurate: nothing in the holding statement later needed correcting.
- Repeated correctly: coverage quotes or paraphrases your facts as written; see how to request a correction if not.
- Updates kept: every promised update time was met.
How to Choose a First Response
| Situation | Recommended route | Why |
|---|---|---|
| Facts still unclear, questions arriving | Holding statement now, full statement later | CERC: if you say nothing, people assume you are not responding |
| Facts confirmed and simple | Full statement straight away | A holding line adds a step people do not need |
| Personal data breach | Holding statement plus legal review of GDPR, HIPAA or other notices | Notification clocks may already be running |
| Possible material cybersecurity incident at a U.S.-listed company | Holding statement cleared by counsel and disclosure committee | Form 8-K Item 1.05 may be due four business days after a materiality decision |
| Story driven by one inaccurate article | Correction request and factual statement | See the negative news guide |
| Rumour with no incident behind it | Short factual denial with evidence, or no statement | A holding statement can confirm a crisis that does not exist |
Common Problems and Fixes
| Problem | Likely cause | Fix |
|---|---|---|
| Approval takes hours | No pre-agreed approval path | Pre-approve a template and name two approvers in advance |
| Statement speculates on cause | Pressure to explain | Say the cause is under investigation and when you will update |
| Reporters say it says nothing | No facts, no actions, no update time | Add the confirmed facts, the response and the next update time |
| Contradicts a regulator or partner | Statements not coordinated | Share the draft with them before publishing where possible |
| Old holding line still live days later | No owner for updates | Set the next update time in the statement and keep it |
| Staff post their own versions | Employees not briefed | Send staff the statement first, with who to refer questions to |
What Not to Do
- Do not say “no comment”. Consequence: CERC's warning applies; people assume you are not responding. Correction: a holding statement that says what you can.
- Do not speculate on cause or blame. Consequence: corrections later. Correction: “The cause is under investigation; we will update at [time].”
- Do not minimise. Consequence: lost credibility when the scale emerges. Correction: state what is confirmed, including what you do not yet know.
- Do not brief off the record to fill gaps. Consequence: unattributed versions of events in print. Correction: keep to the public statement; see on background vs off the record.
- Do not publish before legal review where notices apply. Consequence: a statement that conflicts with a regulatory filing. Correction: counsel approves alongside the communications lead.
For an example of how a company's public statements read during a product failure, see our explainer what Dyson said as its toothbrush failed.
Frequently Asked Questions
What is a holding statement in a crisis?
A short first statement issued when an incident is known but facts are incomplete. It acknowledges the incident and the people affected, gives confirmed facts and actions, and says when the next update will come.
How long should a holding statement be?
No rule sets a length. CDC's CERC guidance says first messages should be concise and only include immediately relevant information. We suggest one screen, roughly the length of the template in this guide.
How quickly should a holding statement go out?
As soon as you can confirm basic facts. CERC's Be First principle says the first source of information often becomes the preferred source. Pre-approving a template is what makes speed possible.
Should a holding statement apologise?
It should acknowledge the people affected and the effect on them, which CERC calls expressing empathy. Whether to accept fault is a separate decision that should wait for the facts and, where liability is possible, legal advice.
Is a holding statement the same as a breach notification?
No. Breach notifications are formal notices required by laws such as GDPR Article 33 or HIPAA, with set deadlines and content. A holding statement is public communication, and it should be consistent with any notice.
What should I avoid saying in a holding statement?
Speculation about cause, blame, unconfirmed numbers, minimising language, humour and vague promises such as updates as appropriate. Say what you know, what you do not know and when you will say more.
Sources and Methodology
This guide is built from two chapters of the CDC's Crisis and Emergency Risk Communication manual (2018 update), GDPR Article 33, NIS2 Article 23, the SEC's July 26, 2023 press release on cybersecurity disclosure and the HIPAA breach notification rule in the eCFR, read on October 10, 2026. We read the GDPR and NIS2 texts on reproduction sites (gdpr-info.eu and nis-2-directive.com) because the EUR-Lex pages did not load for us; the official texts are Regulation (EU) 2016/679 and Directive (EU) 2022/2555. CERC is written for public health emergencies; applying it to company statements is our judgement. The template, the one-hour aim and the length suggestion are ours. We did not test statements with audiences. Nothing here is legal advice.
- official Centers for Disease Control and Prevention, CERC: Introduction, CERC manual, 2018 update: the six principles and initial-phase guidance. Read October 10, 2026.
- official Centers for Disease Control and Prevention, CERC: Messages and Audiences, CERC manual, 2018 update: initial messages, credibility and trust. Read October 10, 2026.
- law Regulation (EU) 2016/679, Article 33 GDPR: Notification of a personal data breach to the supervisory authority, text read on gdpr-info.eu. Read October 10, 2026.
- law Directive (EU) 2022/2555, NIS2 Directive, Article 23: Reporting obligations, text read on nis-2-directive.com. Read October 10, 2026.
- regulator U.S. Securities and Exchange Commission, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, press release 2023-139, July 26, 2023. Read October 10, 2026.
- law U.S. Department of Health and Human Services, 45 CFR Part 164, Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information, sections 164.404 and 164.406, via the eCFR. Read October 10, 2026.