10 min read
Incident Communication Runbook: Template, Roles, and Message Flow
An incident communication runbook settles, before anything breaks, who says what, to whom, on which channel, and how often during an IT or service...
6 min read
Steve Wilson
:
Updated: Sep 16, 2026

An emergency communication plan answers three questions before anything happens: who tells whom, through which channels, and how you will know the message arrived. This guide gives you the six components every working plan shares, a copy-paste template, and the part most plans postpone until it hurts – how to choose a delivery layer that can still reach people mid-incident.
Use it two ways: build your first plan section by section, or hold your existing plan against the checklist and patch the gaps.
Table of contents
1. What is an emergency communication plan?
2. The six components of a working plan
3. Emergency communication plan template
4. Message templates by scenario
5. How to choose the delivery layer
6. Testing the plan before reality does
7. The mistakes that break plans
An emergency communication plan is the written part of your emergency response that covers information flow. It fixes who has authority to send alerts, which audiences must be reached in which scenarios, what the first message says, which channels carry it, and what record proves delivery. It is narrower than a full emergency action plan – and that is its strength. Evacuation routes and response procedures belong to the action plan; the communication plan owns a single job: the right people hear the right instruction fast, and you can prove it.
In short: the action plan says what people should do. The communication plan is how they hear it in time – and leaves a record that they did.
The U.S. regulatory floor here is concrete. OSHA requires an emergency action plan “whenever an OSHA standard in this part requires one” (Part 1910, general industry), in writing for employers with more than ten employees (29 CFR 1910.38) – and the same section requires an employee alarm system that uses “a distinctive signal for each purpose.” The alarm rules are specific: the signal must be “capable of being perceived above ambient noise or light levels by all employees in the affected portions of the workplace,” and tactile devices may be used for employees who cannot recognize an audible or visual alarm (29 CFR 1910.165). A communication plan that names channels, audiences, and proof of delivery is how those requirements become operational instead of laminated.
Plans differ in format; the working ones share these six pieces.
Copy the skeleton and fill the brackets. One page per scenario is enough – a plan nobody can hold in their head is a plan nobody follows.
Plan skeleton – per scenario
The first message is not prose – it is instruction: what happened, what to do now, where updates will appear. Four first messages and one all-clear follow as starting points: fill the brackets, have them approved in calm weather, and give each the template ID the skeleton points to.
Copy-paste first messages – one per scenario
More wording, longer form: the severe weather notices guide (with downloadable samples), our IT outage templates, and the heat-day protocols in the OSHA heat rule guide. Ten more are packaged as a downloadable set of emergency message templates. Write yours once, load them into your alerting system, and the emergency send becomes a two-step choice, not writing.
The plan is paper until a system carries it. Judge candidates on five questions – the checklist that decides outcomes mid-incident:
Start the vendor comparison from criteria like these rather than feature lists – our side-by-side comparison lays out DeskAlerts against AlertMedia, SnapComms, Everbridge and others on exactly this axis, and the emergency notification software page shows how DeskAlerts handles interruption, targeting, and confirmation.
DeskAlerts carries emergency communication plans into practice: pop-ups over any application, mobile push, signage and more – with per-person delivery and acknowledgment records for the review that follows every incident.
A plan that has never run is a hypothesis. Three levels of proof, cheapest first: a tabletop exercise walks decision-makers through the scenario around a table; a workplace drill puts the notification path and the people in motion; and the after action report turns whatever the test exposed into fixes with owners and deadlines. The communication section of that report is the easy one – if your delivery layer logs sends and acknowledgments, the evidence writes itself.
Five failures account for most plans that did not work when they were needed. Each traces back to one of the six components above.
The action plan covers procedures – evacuation, shelter, response roles. The communication plan covers information flow: who sends what to whom, through which channels, with what confirmation. The communication plan is a section of, or companion to, the action plan, and it is the part you can test cheaply and measure precisely. For slower events measured in hours and days, with customers and media among the audiences, the crisis communication plan template is the companion document.
Three things, in order: what happened (one plain sentence), what to do right now (the single instruction), and where updates will appear. Everything else – causes, reassurance, detail – belongs to the updates, not the first message.
At least two independent push channels per audience – for example desktop pop-ups plus mobile push, backed by signage or voice for areas without screens. Email can carry the detailed follow-up; it should never be the only path for the first message.
A workable annual pattern: one tabletop exercise for decisions and messaging, one drill that exercises the notification path with real people, and a short unannounced test of the alerting channel alone. Every test ends in an after action report so findings become fixes.
A small named list per scenario – typically safety or security leads for physical events and IT leads for outages – each with a named backup. Authority should live with people close to the facts, not only at the top of the org chart.
Send urgent notifications to PCs, phones, tablets, digital signage, and other corporate devices.
Display high-visibility alerts directly on employees' screens to help ensure critical messages are seen and acknowledged. Reach employees even when computers are locked, in screensaver mode, or idle.

10 min read
An incident communication runbook settles, before anything breaks, who says what, to whom, on which channel, and how often during an IT or service...
10 min read
An emergency communication plan answers three questions before anything happens: who tells whom, through which channels, and how you will know the...
10 min read
A crisis communication plan template is only useful if you can fill it in an afternoon and follow it at 2 a.m. This one is built for both: the roles,...
7 min read
Major incidents are events that occur in an organization that are generally critical in nature and require urgent attention in order to remediate the...
13 min read
When your company faces a crisis, it is important that you are prepared for both business continuity and disaster recovery so that you can resume...
5 min read
Companies need to be prepared for a range of scenarios that can eventuate where their business is disrupted in some way. These are known as...