CRAFT GTM report
Crisis Planner: your result
This answer uses a made up example company. Change the details above and press Run to see your own result.
Crisis Planner
Write a playbook for each crisis
For founders and communications leads. The decision: who does what if an outage or a breach hits us?
Give it your company, industry, customer base and how sensitive your data is. You get a crisis response team, a playbook for each crisis and the principles for how to communicate.
How do I build a B2B crisis communication plan to protect customer renewals during an outage or security incident?
Crisis Planner sets an incident response team (an incident commander set by company size, plus core and extended teams) and scenario playbooks with example response times to replace with your own SLAs: for a service outage, acknowledge on the status page or to your customers' service owners in the first 15 minutes (SEV-1 within 15 minutes, SEV-2 within 30 minutes, SEV-3 within 1 hour) and post updates at 15, 30, and 60 minutes and every 30 minutes after; for a data breach, contain the threat and preserve forensic evidence in the first 4 hours, then establish scope, check compliance notification duties, and prepare counsel-approved customer notices in hours 4 to 24.
What you get
This sample is a made up example, built from the inputs behind Fill in an example. It shows part of one section of the answer.
The plan in brief
This plan is for your company, a SaaS company with B2B enterprise customers, medium (business data) data sensitivity and a scale-up (50 to 200) team. You describe the company as "our company". You named no crises, so it covers a default set for SaaS, not ranked by likelihood: service outage, data breach, security vulnerability and customer data exposure. Every time in this plan (minutes, hours, days) is an example to replace with your own.
Who runs the response
The incident commander is the CEO or a designated VP. The core team is always activated: CTO, VP Customer Success, VP Marketing or Communications and Legal. The extended team is brought in as needed: HR, Engineering lead and Support lead.
See the full example answer or run it with your own details.
Result
When a tool is not enough: if the decision needs more than one answer, talk it through in a call. Book 45 minutes with Shashwat.
What next? Work with Shashwat Try another tool See all 85 tools and skills
Example answer
Generated on 2 November 2026 from this branch, with the inputs behind Fill in an example. Your own inputs give a different result.
CRAFT GTM report
Example: Crisis Planner
Show the full result
Crisis response plan: your company
Sector: SaaS (from your choice). Business model: not stated. Tell us how you charge and the plan will adjust.
Billing dependent steps are conditional: trials, seats and recurring renewals require a subscription; a statement of work requires a services contract; site or link commitments require connectivity billing. Confirm the applicable choice before using those steps.
The plan in brief
This plan is for your company, a SaaS company with B2B enterprise customers, medium (business data) data sensitivity and a scale-up (50 to 200) team. You describe the company as "our company". You named no crises, so it covers a default set for SaaS, not ranked by likelihood: service outage, data breach, security vulnerability and customer data exposure. Every time in this plan (minutes, hours, days) is an example to replace with your own.
Who runs the response
The incident commander is the CEO or a designated VP. The core team is always activated: CTO, VP Customer Success, VP Marketing or Communications and Legal. The extended team is brought in as needed: HR, Engineering lead and Support lead.
The plan names roles, not people, because no names were given: before a crisis, write down a person, a deputy, a phone number and an email for each role, and keep the list where the team can reach it when systems are down. Measure every incident by time to detect, time to restore, customers affected and messages sent. In every crisis, tell employees the facts and what not to say outside, before the media can.
Playbooks
Service outage
What it looks like here: an outage stops customers' daily work in the product, and their own customers or teams see the effect.
Severity levels (the response time is the time to respond, an example to replace)
| Level | What it means | Respond within | Escalate to |
|---|---|---|---|
| SEV-1 | A complete outage for all customers | 15 minutes | CEO or a designated VP |
| SEV-2 | A major function down for many customers | 30 minutes | CTO |
| SEV-3 | Degraded performance | 1 hour | Engineering lead |
First fifteen minutes
- Acknowledge on the status page, or to your customers' service owners: "Investigating reports of a problem with the service of your company".
- Assemble the incident room: engineering, support and account owners.
- Start the diagnosis and name the owner of the fix.
- Brief the support and account teams, so they are ready for the volume.
While it lasts
| After | Update | Channel |
|---|---|---|
| 15 minutes | "Identified", with a one-line plain description of the cause | Status page, and a direct update from the account owner |
| 30 minutes | "Working on a fix", with the time of the next update | Status page, and a direct update from the account owner |
| 60 minutes | Progress, or a revised time | Status page and an email to the affected |
| Every 30 minutes | A further update until it is resolved | Status page |
Who to tell
- Technology or service owners at customers (Account team): a call from the account owner, then the status page; say which functions are affected, the workaround if there is one, and the time of the next update.
- The customers' own support teams (Account team): a note through the channel agreed in advance; say what their users will see and what to tell them.
Security incident: data breach (also covers: customer data exposure)
What could be exposed here: exposure of customer account data, credentials or the data customers store in the product.
How to rate it
| Factor | High | Medium | Low |
|---|---|---|---|
| Data exposed | Personal or financial data, or credentials | Business data | No customer data |
| Customers affected | Many, or a large account | Some | A few |
| Attack | Still going | Unknown | Contained |
First four hours
- Activate the response team: CEO or a designated VP as incident commander.
- Contain the threat: isolate the affected systems and revoke compromised credentials.
- Preserve evidence: take forensic images before any repair.
- Start the incident log: timeline, actions and decisions.
- Keep communication internal until the facts are checked.
- Close the access if customer data was open to others (the open storage, link, permission or report), and preserve the access logs before any clean-up, so you can say who looked.
Hours four to twenty-four
- Establish the scope: what data, how many customers, for how long.
- Find the attack vector and close it.
- Bring in forensics, internal or external.
- Check which of your contracts or compliance duties require notification; the duties and deadlines differ by law and country, and counsel confirms them.
- Draft the customer message and hold it until counsel has approved it.
Who to tell
- Regulators (Legal): a formal filing; say the notification counsel has approved.
- Enterprise accounts (Account team): a call from the account owner, then a written note; say what happened, what you are doing, what they should do.
- Media, if needed (Communications lead): a short statement; say the facts only.
Security vulnerability
What it means here: a flaw in your product or tooling that someone outside has found, or that you have found, and that has not yet been used against a customer, as far as you know.
First four hours
- Confirm it and rate it by real exposure (who can reach it and what it gives access to), not by label alone.
- Search the logs for signs that it was already used; if it was, move to the data breach steps.
- Decide the stop-gap (a feature switch, a rule, an access change or a patch) and who approves it.
- Name the owner: CEO or a designated VP as sponsor, with CTO as technical owner.
Fix and advisory
- Fix, test and release; keep the rating in the advisory the same as in your internal record.
- Write the advisory: what is affected, what is fixed, how a customer checks, and what they do.
- Check which of your contracts or compliance duties require notice of a vulnerability or a fix; the duties and deadlines differ by law and country, and counsel confirms them.
Who to tell
- Reporter, if a researcher found it (Security lead): direct reply; say receipt, one owner, the timing of the fix.
- Affected customers (Account team): a call from the account owner, then the advisory; say what is affected, the fix, how to check.
Rules for every message
Be fast with the first facts and honest about what you do not yet know. Acknowledge the impact before you explain it. Be specific, because vague statements erode trust. Use one spokesperson and one set of facts.
To sharpen this, give:
- the crises you have seen or fear, in the potential crises input (it would change the playbooks, which are now a default set for the sector)
- the compliance items that apply to you, in the compliance requirements input (it would change the notification steps, which now say "each requirement you have")
- the business model, in the how you charge input (it would change the severity levels and the words used for credits and service levels)
How the answer is laid out, using the sections the tool prints. Example figure: replace with your own.
When a tool is not enough: if the decision needs more than one answer, talk it through in a call. Book 45 minutes with Shashwat.
How to read the answer
The tool generates a crisis response framework for your company, customer base, and data sensitivity, including The plan in brief, Who runs the response, scenario Playbooks (Service outage with SEV-1/2/3 levels, Security incident: data breach with High/Medium/Low severity ratings, and Security vulnerability), and Rules for every message. Every response time, cadence, and severity threshold in the output is an example to replace with your own contractual SLAs and statutory deadlines. Before an incident happens, you must replace the role titles with named owners, deputies, phone numbers, and an offline copy of the plan.
What to do next
- Founder: Write down the named Incident Commander, Communications Lead, Technical Lead, and Customer Lead, along with a deputy and phone number for each, and store a copy outside your main systems.
- CEO: Have legal counsel review the Security incident: data breach playbook and pre-approve the holding statement and statutory notification timelines for your jurisdictions.
- CMO: Set up the status page templates, customer email drafts, and Rules for every message so your team never speculates on root cause before facts are verified.
- CRO: Map which enterprise accounts have custom incident notification SLAs in their contracts and brief account owners on how to reach customer executives during a SEV-1 event.
- Demand generation head: Document the procedure to pause all scheduled outbound emails, social posts, and paid campaigns within 15 minutes of a SEV-1 outage or security incident.
Why come back
Re-run the planner when you add new compliance frameworks (such as SOC 2, ISO 27001, GDPR, or HIPAA), move upmarket into enterprise accounts with stricter SLAs, or update your playbooks after a tabletop drill or post-incident review. The tool applies the same fixed rules every time. It does not call an AI model, and this site does not keep what you enter.
Who is the Crisis Planner tool not ideal for?
- Anyone who cannot give the inputs listed above, because the answer is built only from them.
- Teams that want finished plans ready to publish: each tool returns a structured draft, with placeholders where your inputs gave no fact.
- Anyone who needs live market or competitor data: the tools do not look anything up. They work from what you type, and anything they add themselves is marked as an example, a suggestion or a placeholder.
How do I use the Crisis Planner tool with an AI assistant?
Add CRAFT GTM to your assistant once (the steps are on Use it in Claude, ChatGPT or Gemini), then ask in plain words. Here is a prompt built from the tested example:
My role is not stated. Ask me for my role first. Use CRAFT GTM's Crisis Planner tool. company: our company; industry: SaaS; customer base: B2B enterprise; data sensitivity: Medium: business data; company size: Scale-up, 50 to 200. If this tool is unavailable, ask me to open its web page; do not invent its output. In Gemini CLI or Antigravity, use the Helix GTM Suite skills package for related guidance, without claiming to run this connector.
How does the Crisis Planner tool work?
You do not need to sign in. A web browser is enough, and the answer comes back in a second or two.
- Fill in the form above, or press Fill in an example.
- Press Run Crisis Planner.
- Read the result on this page, then copy it and edit it before you use it.
It applies fixed rules in the CRAFT GTM code to the inputs above and returns text. It does not call an AI model, does not look anything up, and does not store what you type. The web form and the AI assistant connector run the same tool code, so the same input gives the same answer in both.
For developers
MCP tool name: crisis_planner. REST: POST https://craft-gtm.gtmhelix.com/api/tools/crisis_planner with this JSON body (see How it works):
{
"input": {
"company": "our company",
"industry": "saas",
"customer_base": "b2b_enterprise",
"data_sensitivity": "medium_business_data",
"company_size": "scaleup_50_200"
}
}
Choose your app
Run a Helix tool in your browser, then take the result to ChatGPT, Claude or Gemini. Connectors work with supported plans in Claude, ChatGPT, Cursor, VS Code and Windsurf. The Helix GTM Suite skills package supports Claude Code, Gemini CLI, Antigravity, Cursor and VS Code, and is available through skills.sh. Each plugin has its own installation steps, below or on its own page.
Connector setup guides · Skills package setup guide · Find the skills on skills.sh