8.4 Crisis Communications & Situational Crisis Communication Theory

ASIS Associate Protection Professional APP

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Introduction & Exam Strategy

1.1 About the ASIS APP Exam 1.2 How to Study & Timed Simulation Strategy

2 Chapter 2: Security Fundamentals — Foundations & Physical Protection

2.1 History & Evolution of Security Management 2.2 Security Disciplines & Asset Categorization 2.3 Physical Security Principles & Defense-in-Depth 2.4 Crime Prevention Through Environmental Design (CPTED)

3 Chapter 3: Security Fundamentals — Information, Personnel & Professional Standards

3.1 Information Asset Protection & Access Controls 3.2 Personnel Security & Executive Protection 3.3 ANSI/ASIS Standards & Return on Security Investment (ROSI) 3.4 Security Professional Ethics & Code of Conduct

4 Chapter 4: Business Operations — Governance, Projects & Finance

4.1 Business Case Development & Strategic Alignment 4.2 Security Project Management & PMBOK Principles 4.3 Financial Management & Budgeting (CapEx vs. OpEx) 4.4 Performance Measurement: KPIs, KRIs, and Metrics

5 Chapter 5: Business Operations — Workforce, Vendors & Training

5.1 Human Resource Management & Legal Compliance 5.2 Security Training & Instructional Design 5.3 Records Management & Chain of Custody 5.4 Vendor & Procurement Management

6 Chapter 6: Risk Management — Frameworks & Assessment Methods

6.1 Enterprise Security Risk Management (ESRM) Framework & Cycle 6.2 Threat, Vulnerability, and Consequence (T×V×C) Analysis 6.3 Quantitative vs. Qualitative Risk Assessment 6.4 Risk Assessment Models: CARVER, NIST SP 800-30, ISO 31000

7 Chapter 7: Risk Management — Mitigation, Continuity & Reporting

7.1 Risk Treatment Options: Avoidance, Transfer, Mitigation, Acceptance 7.2 Business Impact Analysis (BIA) & Continuity Objectives 7.3 Risk Reporting: Heat Maps, Risk Registers, Appetite & Tolerance

8 Chapter 8: Response Management — Incident Command & Crisis Leadership

8.1 Incident Response & Incident Command System (ICS/NIMS) 8.2 Emergency Operations Centers (EOC) & Crisis Management 8.3 Business Continuity & Disaster Recovery Standards 8.4 Crisis Communications & Situational Crisis Communication Theory

9 Chapter 9: Response Management — Workplace Threats, Insider Risk & Investigations

9.1 Workplace Violence Prevention & Intervention 9.2 Active Assailant Preparedness & Response Standards 9.3 Insider Threat Detection & Mitigations 9.4 Security Investigations, Digital Forensics & After-Action Reviews

8.4 Crisis Communications & Situational Crisis Communication Theory

Key Takeaways Explain This Topic AI

Situational Crisis Communication Theory (SCCT), developed by W. Timothy Coombs, categorizes crises into three clusters based on organizational responsibility: Victim, Accidental, and Preventable clusters.

SCCT response strategies range from Primary Strategies (Denial, Diminish, Rebuild) to Secondary/Supporting Strategies (Bolstering), matched to reputational threat level and crisis history.

Core crisis communication rules demand rapid initial statements, strict factual accuracy, complete transparency, rumor control, and designated spokesperson control.

Internal crisis communications prioritize employee safety, operational instructions, EAP resources, and media conduct guidelines, whereas external communications focus on public safety, media management, and regulatory disclosures.

Establishing rumor control mechanisms and pre-drafted holding statements prevents information vacuums and suppresses speculative panic during unfolding critical incidents.

Last updated: July 2026

8.4 Crisis Communications & Situational Crisis Communication Theory

When a crisis strikes an enterprise, information moves faster than physical response assets. Ineffective, delayed, or contradictory communications can cause greater long-term damage to an organization's brand, valuation, and stakeholder trust than the physical incident itself. Security leaders must combine disciplined operational message control with proven theoretical communication frameworks.

Situational Crisis Communication Theory (SCCT)

Developed by Dr. W. Timothy Coombs, Situational Crisis Communication Theory (SCCT) provides an evidence-based framework for selecting crisis response strategies based on the level of reputational threat and the degree of crisis responsibility attributed to the organization by stakeholders.

Key Determinants of Reputational Threat

Initial Crisis Responsibility : How much stakeholders believe the crisis was caused by organizational failure or intentional misconduct.

Organizational Performance History : The organization's past record regarding compliance, safety, and ethics.

Crisis History : Whether the organization has experienced similar crisis incidents in the past.

The Three SCCT Crisis Clusters

SCCT categorizes crises into three distinct clusters based on stakeholder attribution of responsibility:

1. The Victim Cluster (Low Crisis Responsibility)

The organization is viewed as a victim of circumstances outside its direct control. Reputational threat is minimal.

Examples : Natural disasters, workplace violence perpetrated by an external actor, product tampering by a third party, unfounded malicious rumors.

2. The Accidental Cluster (Moderate Crisis Responsibility)

The crisis occurred due to unintentional technical glitches, equipment failures, or unforeseen operational complications.

Examples : Technical system outages, industrial equipment malfunctions, accidental chemical spills caused by mechanical valve failure.

3. The Preventable Cluster (High Crisis Responsibility)

The crisis resulted from human error, deliberate safety shortcuts, regulatory non-compliance, management misconduct, or ignoring known security hazards. Reputational threat is severe.

Examples : Executive fraud, deliberate safety rule violations, building collapse due to ignored structural inspection warnings.

SCCT Crisis Response Strategies

SCCT outlines strategic options categorized into Primary Response Strategies and Secondary (Bolstering) Strategies : +--------------------------------+

| SCCT RESPONSE STRATEGIES |
+---------------+----------------+
|
+---------------------------------+--------------------------------+
| |
+-------+--------------------+ +----------------+---------------+
| PRIMARY STRATEGIES | | SECONDARY (BOLSTERING) |
+----------------------------+ +--------------------------------+
| • Denial (Attack/Scapegoat)| | • Reminding (Past good works) |
| • Diminish (Excuse/Justify)| | • Ingratiation (Praise others) |
| • Rebuild (Apology/Restitution) | • Victimage (We are victims too)
+----------------------------+ +--------------------------------+
Primary Response Strategies

Denial Strategies : Attack the Accuser , Denial , or Scapegoating . Used only when accusations are demonstrably false or malicious. Incorrectly using denial when the organization is at fault destroys credibility.

Diminish Strategies : Excuse (arguing lack of intent or control) or Justification (minimizing the perceived damage). Used during Accidental Cluster events to reduce attribution of responsibility.

Rebuild Strategies : Compensation (offering financial or material restitution) and Apology (taking full responsibility and asking forgiveness). Mandatory for Preventable Cluster crises where the organization bears clear fault.

Secondary (Bolstering) Strategies

Reminding : Highlighting the organization's past good deeds, charitable work, or safety record.

Ingratiation : Praising emergency responders, employees, or community members for their support.

Victimage : Reminding stakeholders that the organization itself suffered losses during the event (appropriate for Victim Cluster events).

SCCT Framework Summary

Crisis Cluster Attribution of Responsibility Reputational Threat Recommended Primary Strategy

Victim Cluster Very Low Minimal Denial / Scapegoating (if false) or Victimage / Ingratiation.

Accidental Cluster Moderate Medium Diminish (Excuse / Justification) + Corrective Action.

Preventable Cluster High Severe Rebuild (Full Apology + Restitution + Systemic Reform).

Core Rules of Crisis Communications

To maintain control and credibility during an active incident, security professionals must enforce five cardinal rules of crisis communication:

Speed & First-Impression Control : Release an initial statement within 15 to 30 minutes of incident verification. If full details are unavailable, issue a pre-approved holding statement confirming awareness, ongoing emergency response, and scheduled press updates.

Accuracy Over Speculation : Never speculate on cause, death tolls, or financial damage. State only confirmed, verified facts. Unverified speculation creates legal liability and severe reputational fallout when disproven.

Single Official Spokesperson : All public and media inquiries must funnel through a single trained Public Information Officer (PIO) or corporate spokesperson. Uncertified employees speaking off-the-cuff generate conflicting narratives.

Transparency & Empathy : Maintain honesty regarding known facts while demonstrating genuine compassion for affected victims and families. Avoid clinical corporate jargon.

Rumor Control : Actively monitor traditional news media and social channels. Establish a centralized rumor control protocol to immediately correct misinformation before panic escalates.

Internal vs. External Communications Alignment

Crisis messaging must address two distinct stakeholder audiences simultaneously without sending conflicting signals:

Internal Communications (Employee Safety Focus)

Priority : Employee life safety, building evacuation/shelter status, remote work directives, EAP mental health support, and payroll continuity.

Conduct Mandate : Explicitly remind employees of corporate policy regarding media contact: "Do not speak to reporters or post unverified incident photos on personal social media accounts; direct all press to the PIO."

External Communications (Public & Regulatory Focus)

Priority : Public safety warnings, operational status updates, investor transparency, and regulatory compliance notifications.

Regulatory Authorities : Mandatory, time-sensitive disclosures required by agencies such as the SEC (Form 8-K for material events), OSHA (reporting fatalities within 8 hours), or environmental agencies (EPA notification for toxic spills).