A security incident rarely fails because nobody has a communications plan.
It fails because the plan has never been tested against the confusion, incomplete information and competing priorities that emerge in the first few minutes. Testing security incident communications shows whether people can turn a written process into useful action when it matters.
For organisations preparing for serious incidents, including those strengthening readiness under Martyn’s Law, communications cannot be treated as an administrative afterthought. It shapes protective action, staff confidence, public behaviour, operational control and the credibility of the organisation after the event. A late, vague or contradictory message can create problems that the original incident did not.
The uncomfortable reality is that many exercises test evacuation, access control or incident command, then assume communication will follow. It will not necessarily follow.
It is a separate capability that needs to be rehearsed, assessed and improved.
Why communications plans fail under pressure
Most plans are written in calm conditions by people with time to consider every word. Incidents do not offer that luxury.
The duty manager may be receiving conflicting reports. A venue operator may be trying to account for staff. Security may be focused on an immediate safety decision. Senior leaders may want answers before anyone has established the facts.
At that point, the problem is not simply drafting a message. It is deciding what is known, what is assumed, who has authority to speak, which audience needs information first and what action each audience needs to take.
A plan that says inform staff and stakeholders does not answer these questions. Nor does a prewritten holding statement, useful though one can be. Templates can give a team a starting point, but they cannot replace judgement. If the people responsible cannot distinguish verified facts from early reports, or cannot agree on a clear protective instruction, a polished template will only distribute uncertainty faster.
Communications also break down when responsibility is too diffuse. Operations believes security is leading. Security expects the communications team to issue the message. Communications waits for executive approval.
Meanwhile, staff hear fragments through personal calls, group chats or social media. The organisation has lost control of the message before it has sent one.
What testing security incident communications should prove
A worthwhile test is not a demonstration that messages can be sent. Almost every organisation can send an email, text alert or update through an internal platform. The test should establish whether the right people can make decisions and communicate useful direction at the right time.
Start with the actual operational purpose of each message. Staff may need a simple instruction that tells them where to go, what to avoid and who to report to. Visitors may need calm, immediate direction in plain language. Families may need reassurance that the organisation is managing the situation and will provide a defined update point. Regulators, clients or partners may need a factual account that does not compromise the response or speculate beyond available evidence.
These audiences should not receive the same message with different branding. They have different needs, levels of knowledge and ability to act. A message that is appropriate for a senior leadership group may be confusing or unhelpful to front line staff.
Testing should also prove that the organisation can maintain a common operating picture. This means those communicating externally and internally are working from the same verified information, with clear times and sources.
It does not mean everyone must wait for perfect certainty. In many situations, early communication is essential. The discipline is to state what is known, give the immediate instruction, avoid speculation and identify when the next update will be provided.
That last point matters more than many teams realise. Silence creates an information vacuum. People will fill it, usually with the most alarming version available.
A short message that acknowledges an ongoing situation and gives a precise next update time is often more valuable than a delayed statement attempting to answer every question.
Build a test around decisions, not scripts
The strongest exercises introduce uncertainty gradually.
They do not hand participants a neat scenario with all the relevant facts laid out. Real incidents develop unevenly. Reports arrive from people with different perspectives and varying reliability. A good exercise reflects that reality without becoming theatrical or unnecessarily complex.
The team should have to decide when to issue the first message, who approves it and how it reaches the intended audience. They should then be tested on how they adapt as new information changes the position. For example, an initial report may require a precautionary staff instruction, followed by a correction once the situation is clarified. The test is not whether the first message was perfect. It is whether the team corrected it quickly, clearly and without defensiveness.
This is where capability becomes visible. Some teams become paralysed by a desire for certainty. Others communicate too early and make unsupported claims. Neither approach is reliable. The aim is proportionate action based on the best available information.
It is useful to include practical friction in the exercise. The normal approver may be unavailable. A communications platform may be inaccessible. A manager may have incomplete contact details for an overnight team, contractors or agency workers. These are not artificial complications.
They are the ordinary weaknesses that appear during disruption.
Exercise messages should be assessed for more than grammar or brand tone. Ask whether they gave the recipient a clear action, whether the action was safe and realistic, whether the language was understandable, and whether the message created confidence without offering false reassurance.
The best message is not always the longest or most carefully worded. Under pressure, clarity has greater operational value than polish.
Test the people who actually communicate
Senior crisis teams are usually included in exercises. The people who relay instructions to customers, colleagues, suppliers and contractors are often not. That is a mistake.
Reception staff, control room operators, supervisors, duty managers, customer service teams and line managers may be the first human contact for people affected by an incident. They need more than a copy of the formal statement. They need to know what they can say, what they must not guess, how to recognise escalating concern and where to direct questions they cannot answer.
Testing this layer often exposes an uncomfortable gap. A central team may have produced an accurate update, while local managers are still relying on rumours or giving inconsistent explanations. The consequence is confusion at the point where people need confidence and direction most.
Give these teams short, realistic communications tasks during an exercise. Ask a supervisor to brief a dispersed shift. Ask a reception team to respond to concerned visitors.
Ask a manager to explain a changing instruction without inventing reasons. Observe not only the words used, but whether people listen, check understanding and escalate uncertainty appropriately.
Communication is behaviour, not merely distribution.
Measure what the exercise revealed
A debrief that ends with communications worked well has little value. Record timings, decision points, versions of messages, approval delays, failures in contact data and points where participants lacked authority or information. This evidence turns an exercise into an improvement programme rather than a compliance record.
The findings should lead to practical changes. Perhaps the incident communications lead needs a deputy. Perhaps authority for an initial protective message should sit with the on scene duty manager rather than a distant executive. Perhaps contractor contact arrangements are unreliable. Perhaps the organisation needs shorter message formats for immediate use, supported by clear escalation arrangements.
Not every weakness needs a new policy. Often the answer is clearer roles, better rehearsal and realistic scenario based learning. Mildot Group’s approach to capability development is grounded in that distinction, documentation has value, but only if people can use it to make sound decisions.
There is also a trade off to manage. Testing too frequently can become routine and disengaging. Testing too rarely allows assumptions to harden. The right rhythm depends on the organisation’s risk profile, operating hours, staff turnover, public exposure and consequence of failure. A major venue, transport environment or critical service will need a different level of assurance from a small office based operation.
What matters is that the test is demanding enough to reveal genuine capability.
Make the next test useful
Do not wait for a large annual exercise.
Take one realistic scenario and test the first 20 minutes of communication. Can the right person identify the issue, validate what they can, authorise a protective instruction and reach the people who need it? Can line managers repeat that instruction accurately? Can the organisation issue a credible update before rumour becomes the primary source of information?
Those questions expose far more than a communications plan ever will.
They show whether people understand their role, trust the decision process and can act with discipline when certainty is unavailable.
That is the standard worth testing.
.
Useful Links:
.
