It is 5:40 on a Friday. A reporter emails the general counsel and the head of communications at once. She has internal documents. She names a number, a date, and a former employee. She wants comment by Monday at nine, and she says publication will proceed either way. Six questions. One is wrong. One is close enough to do real harm. One points to a problem the company has not yet found.
That email starts the clock. Not the one running in your head all weekend. Several real clocks, legal and operational, that begin the moment a company knows what it knows. The first day rarely decides the outcome. It almost always sets the terms on which the rest of the matter is fought.
Establish what is actually true
Before anyone drafts a sentence for the public, the company has to know, with some confidence, what happened. That work should be directed by counsel, for the purpose of giving legal advice. We are careful here, because a common belief is wrong. Putting a lawyer in the room does not turn every page of working notes into a privileged document. A loose internal email, a Slack thread, a fact-finder’s careless summary written without legal direction can still be discoverable later. Speculation written in the first hour often becomes Exhibit A two years on.
So structure the early work for that reality. Counsel should define the questions, assign who collects facts, and separate what is confirmed from what is assumed. A clean first-day fact log helps: source, time, confidence level, open question. “Confirmed by [name] at [time]” is a different thing from “team thinks.” The difference is small on a screen and large under oath.
Get the facts first. The temptation is to reverse the order, to decide what you want to say and then look for support. That is how companies end up correcting themselves in week two, which is far worse than saying little in hour one.
Know the clocks before they run you
Several deadlines may start running on day one, and they do not run together.
For a public company, a material cybersecurity incident triggers a Form 8-K under Item 1.05, generally due within four business days of the determination that the incident is material. The clock attaches to the materiality decision, not to the first alert from IT. That is not license to drift. It means the materiality assessment itself has to be deliberate, documented, and dated.
Under the GDPR, Article 33 requires notice to the supervisory authority without undue delay and, where feasible, within 72 hours after the controller becomes aware of a personal-data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Article 34 is separate. Notice to affected individuals is triggered by the risk to those individuals; it is not the same 72-hour clock. Treating the two as one deadline is a frequent and expensive mistake.
Other clocks sit in contracts, consent decrees, exchange rules, credit agreements, customer terms, and your insurance policies. Someone should own the list in the first meeting. Name the person. Put times next to each item. Revisit it as facts change.
Preserve before people improvise
A litigation and preservation hold is a process, not a one-line memo sent and forgotten. The duty to preserve can arise before any complaint is filed, once litigation is reasonably anticipated. After that point, deletion is the thing that creates the new problem, often larger than the original one.
The risk is rarely the archive nobody touched. It is the auto-delete rule nobody paused, the text thread someone “cleaned up,” the shared drive renamed in a panic, the laptop reimaged after the hold should have been in place. Counsel should identify the likely custodians, systems, devices, chat tools, and backup practices. IT belongs in the room early. So does HR if employees or workplace conduct are part of the matter. The hold has to reach the actual people and the actual systems, and someone has to confirm it landed.
Notice to your insurers
Your D&O and cyber policies almost certainly carry notice provisions. Late notice can jeopardize coverage. We say jeopardize rather than void, because the consequence varies by policy language, by jurisdiction, and by whether the insurer can show prejudice. The safe assumption is simple: notify early, in writing, through the channel the policy specifies. A coverage fight you could have avoided is a self-inflicted wound on top of the original one.
Decide who speaks, and who decides
Name one spokesperson and one decision-maker, and keep them distinct. The spokesperson holds the public line. The decision-maker can move the company and approve a statement at 2:00 a.m. without waiting for a full board vote. Confuse the two and you get mixed signals at the worst time. Route every stakeholder through commas in a press release and you burn the hours you need.
Brief your own employees early, before they read it from the reporter. They are the largest group of unofficial spokespeople you have, and they talk to customers, vendors, and one another. They do not need every privileged fact. They need to know what happened at a high level, what they can say, where to send inquiries, what not to delete, and when they will hear more. An informed workforce is steadier. An ambushed one leaks.
Say something before you can say everything
You will not have all the facts in the first day. You can still say something true. Acknowledge that you are aware of the matter, that you are reviewing it with counsel, that you take it seriously if you do. Silence reads as evasion. A holding statement, accurate and short, buys the time the fact-finding needs without committing the company to a version of events it may have to retract. Do not guess at motive. Do not blame a vendor without proof. Do not use legal phrasing that sounds evasive to ordinary people.
This is the part most firms get backwards, and it is where the legal and communications problems turn out to be the same problem. Every public sentence is a potential exhibit. Every legal filing sends a message to the market and the press whether you intend it or not. A poorly drafted apology can waive privilege or admit fault. A legally sanitized statement can sound so defensive that it does its own damage. The statement and the exposure cannot be managed in separate rooms. Integrating them is the core of litigation communications, and it is the work we are built to do.
People before press
The affected people come first, ahead of the reporter’s deadline. Customers whose data moved, patients, employees, investors, families. Reaching them, plainly and quickly, is the decent course and usually the legally required one. Where they face a concrete risk, the statement should say what the company is doing for them first. A company that protects its statement and neglects the people it harmed will lose on both fronts.
The costly reflexes
Some first-day mistakes repeat.
Do:
- Put counsel in charge of the fact-finding, and treat every working note as if it may be read aloud in court.
- Keep a fact log that separates what is confirmed from what is assumed.
- Preserve documents, messages, devices, and systems before deletion becomes the issue.
- Calendar the real deadlines with their triggers, and notify insurers in writing.
- Name one spokesperson and one decision-maker, and brief employees early.
Don’t:
- Call a matter “baseless” before the facts are known, or say “no evidence” when the company has not looked.
- Let executives text strategy through side channels after a hold should be in place.
- Promise a review is “independent” unless the structure supports the word.
- Guess at the scale. If you do not know how many records moved, say the work is ongoing.
- Declare the problem solved before you have proof it is contained.
The alignment test
Before the company says anything, run it through one question. Does what we did line up with what we are now saying?
If the statement says people come first, did the company reach affected people before it worked the reporter list? If it says the company is cooperating, did it preserve and organize the records a regulator will ask for? If it says leadership takes the matter seriously, did leadership make decisions, or only approve adjectives? Where the conduct and the words match, the statement holds under pressure. Where they diverge, the gap is the story, and it will be found.
The first day will not save you. Handled well, it stops you from losing on the second. Anchor the strategy in facts you can prove. Respect the clocks. Put the people affected by the crisis ahead of the people covering it.
Jonathan Franks is the founder and president of LUCID Strategies, a boutique crisis and issues management firm. He has spent two decades advising clients through their hardest moments; his work and cases have been covered by ABC News, CNN, The New York Times, The Washington Post, and PBS NewsHour.
Frequently asked questions about the first 24 hours
Who should speak first in a corporate crisis?
Usually one accountable person should speak, after counsel and communications have aligned on what is confirmed and what is not. Multiple voices create avoidable contradictions.
Should a company say no comment?
Sometimes the answer must be narrow, but silence has a public meaning. The goal is a true, durable statement that does not outrun the facts.
What should the board do first?
The board should confirm who owns the response, where the facts are being gathered, and how legal and communications decisions will stay aligned.
When should outside crisis counsel be called?
Before the first public statement, or as soon as the company sees that a legal, operational, or reputational issue may become public.