Crisis Communications, Notification & Exercises

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

Crisis Communications, Notification & Exercises

Key Takeaways Explain This Topic AI

NIMS mandates common operating terminology (plain language) over agency-specific codes so that multiple responding agencies understand each other without translation.

Effective mass notification systems combine channel redundancy, two-way acknowledgment, pre-scripted messages, and geo-targeting to reach only the affected population quickly.

Recognized crisis communication principles include speed, accuracy, consistency, transparency, empathy, and delivering messages through a single designated spokesperson.

A tabletop exercise is a low-stress, discussion-based walkthrough of roles and decisions with no resource deployment, distinguishing it from operations-based drills and full-scale exercises.

Every exercise, regardless of type, should conclude with an After Action Report and a documented Improvement Plan to track corrective actions to completion.

Last updated: July 2026

Crisis Communications, Notification & Exercises

A crisis is won or lost as much in how it is communicated as in how it is physically managed. Domain 7's third task area covers the protocols that let responding parties talk to each other, the principles that govern what an organization says to the outside world, and the exercise program that proves — before a real event — whether people, plans, and technology actually work together.

Communication and Notification Protocols

Interoperability is the ability of different agencies, departments, or systems to communicate and exchange information seamlessly during a response, regardless of which radios, software, or terminology each normally uses. Interoperability failures — responders who cannot reach each other on incompatible radio frequencies, or agencies that use conflicting terms for the same resource — have repeatedly been identified as root causes of delayed or uncoordinated response in major incidents.

The fix mandated by the National Incident Management System (NIMS) is common operating terminology , often called plain language : replacing agency-specific codes such as ten-codes and jargon with clear, common words that any responding agency understands without translation. "Structure fire, second floor, northeast corner" is common terminology; a department-specific radio code describing the same event is not. This same discipline extends to a shared Common Operating Picture (COP) — a single, continuously updated view of the incident status available to every responding party, so decisions are based on the same facts rather than fragmented, agency-specific information.

Emergency/mass notification systems (MNS) deliver alerts to employees, stakeholders, and the public quickly across multiple channels — text, email, voice calls, mobile app push alerts, and physical sirens or public-address systems. Effective mass notification systems share several design features:

• Feature Why it matters
• Redundancy across channels A single failed channel does not silence the alert
• Two-way acknowledgment Confirms the message was received, not just sent
• Pre-scripted templates The first alert goes out in seconds, not after drafting under pressure
• Geo-targeting Alerts only the population actually affected, avoiding message fatigue elsewhere

Notification protocols should also define escalation timing — who is notified within the first five minutes versus the first hour — since a technically capable mass notification system still fails if the trigger to activate it is unclear or delayed.

Crisis Communication Principles

How an organization communicates during a crisis shapes public trust as much as the underlying facts do. Recognized crisis communication principles include:

Speed — being the first credible source to speak fills the information vacuum before rumor or misinformation does

Accuracy — never releasing information that has not been verified, even under pressure to respond quickly

Consistency — delivering the same core message across every channel and spokesperson, so the organization does not appear to contradict itself

• Transparency — acknowledging what is known, what is not yet known, and what is being done to find out
• Empathy — leading with concern for those affected before organizational or legal positioning

One voice — designating a single spokesperson, or a small tightly coordinated team, as the sole source of official statements, preventing conflicting accounts from multiple untrained sources

A crisis communication plan operationalizes these principles in advance: it names the spokesperson(s) and their backups, maintains pre-approved holding statements for common scenarios, maps every stakeholder group that must be reached (employees, families, media, regulators, customers, shareholders), and identifies the channel used to reach each group. Modern crisis communication also includes real-time monitoring of social media and news coverage, since an inaccurate narrative can spread faster than an official statement can be drafted, making the speed principle inseparable from a dedicated monitoring capability.

Training and Exercises

Plans and protocols are only as good as the people executing them, which is why Domain 7 places heavy weight on a structured exercise program. Recognized exercise types run along a continuum from low-stress and discussion-based to high-fidelity and fully operational:

• Exercise Type Format Purpose
• Seminar/Workshop Informal discussion or plan-development session Orient participants, build or validate plans

Tabletop Exercise (TTX) Facilitated discussion around a table, no resource deployment Walk key personnel through roles and decisions in a low-stress setting

Drill Single-function, supervised activity Test one specific operation, such as an evacuation drill

Functional Exercise Simulated, real-time response at the coordination/command level Test coordination, command, and communications without deploying to a real site

Full-Scale Exercise (FSE) Real-time, resource-intensive, multi-agency deployment Test the entire response at high fidelity, as close to a real event as practical

A tabletop exercise is the workhorse of most organizational preparedness programs: low-cost, low-disruption, and effective at surfacing plan gaps and role confusion. A full-scale exercise is the most resource-intensive and realistic option, actually deploying personnel and equipment and typically involving multiple outside agencies, but it is also the most expensive and disruptive to run, so most programs build up to one only after tabletop and functional exercises have already validated the plan. Every exercise, regardless of type, should conclude with an After Action Report (AAR) and a documented Improvement Plan , so lessons learned are captured and corrective actions are tracked to completion rather than lost once the exercise ends.