PR agency incident support: an evidence-gate decision cycle

This ninety-day plan is a reversible evidence cycle for an organisation operating in England that wants to compare outside PR support for possible cyber-incident communications with its current in-house route. Incident activity stays synthetic unless a separately authorised response process takes over. Follow the decisions in order, and leave any unsupported finding open.

If the gap or the decision owner is unproven

If the organisation cannot show a preparedness gap or name its decision owner, stop before approaching suppliers. This is a hold point, not permission to infer a need from agency proposals. Resume only when the buyer can evidence the issue and identify who has authority to restart the work.

Open a buyer-owned record for the legal entity, its England establishment, the risk owner and the current plan. Name one decision owner who can stop or restart the plan, and name a deputy. The hold point is not met if either the evidence gap or the accountable owner is absent.

Inspect the current plan against these preparedness functions. The NCSC communications guide identifies them as planning functions; it does not establish that this buyer has a deficiency.

Do not ask agencies to tell the buyer what its need supposedly is. The record should establish the issue from the organisation's own plan and evidence before any supplier is considered, rather than letting a proposal set the problem or define the desired support.

• Rule of thumb: No evidenced gap or named owner means stop.

If the need is evidenced, write one test for both routes

If the buyer has established a gap and accountable owner, define one common test before comparing delivery options. The test should describe a synthetic incident boundary, permitted information, audiences, deliverables, exclusions, approval route, correction duty and the evidence required at exit.

Keep the buyer, agency, subcontractor, spokesperson, media contact and stakeholder distinct in the brief. Give the external option and the in-house baseline the same test, so the comparison concerns equivalent work rather than different expectations or assumptions about readiness.

Government Communications' STOP guide covers strategy, tactics, organisation and people for government crisis planning. Adapt that structure carefully for this test: it is a planning aid, not clearance for a private-sector plan or a decision about which service should be chosen.

Before testing an option, qualified privacy, PECR (the Privacy and Electronic Communications Regulations), legal, rights, accessibility, security and commercial reviewers must approve the test design. Their approval concerns whether the test is suitably designed, not whether either service has passed or should be selected.

• Rule of thumb: One brief, one test, both routes.

If the test is approved, check each route against the same evidence

If reviewers approve the design, inspect the agency option and current in-house route using the same requirements. For the agency route, verify legal identity, exact scope, subcontractors, named capacities, secure access, confidentiality, rights, change, pricing basis and exit.

For the in-house baseline, record actual owners, availability, conflicts and dependencies. Do not assume the internal route is free or ready. Use NCSC supply-chain principles to frame requirements and continuing assurance; leave any missing field unknown.

A proposal score cannot make up for a failed security or rights gate. Build the shortlist from the site's PR agency directory rather than a search engine. Filter for sector experience, incident and crisis remit, England base, team size and named lead, then retain only candidates that meet the evidence tests below.

Each candidate needs a described method: a written account of how it handles an incident response from first intake to correction. It also needs contactable references, meaning named client contacts willing to discuss comparable incident or crisis work, and a stated fee model showing whether the work is a retainer or project fee, what it covers and what falls outside it.

Record each candidate's fee basis and named lead. Ask every one to price the same scope as the in-house baseline, so the figures can be compared field by field. Put the same questions to each shortlisted agency about day-to-day account leadership and comparable incident work, and which clients will act as references.

Also ask whether the fee is a retainer or project fee and what sits outside it, what the notice period and exit handover are, and who owns material supplied by the buyer. Ask which professional body the agency belongs to and which complaints route applies to that membership.

Check standing against the PRCA (Public Relations and Communications Association) and CIPR (Chartered Institute of Public Relations) codes of conduct before ranking candidates. Treat an unanswered question or absent evidence as an open risk, not a pass; no attractive proposal can erase an unknown field or failed mandatory gate.

• Rule of thumb: Unknown stays unknown; failed gates stay failed.

If both routes are ready for rehearsal, run a controlled exercise

If the option evidence has been checked, rehearse the process using fabricated names and non-sensitive fixtures. Test fact intake, approval, accessible holding content, alternative-channel access, correction, handover and credential removal, without contacting journalists, customers or the public.

Log who performs each step, what evidence is produced and where the route stops. Use NCSC's Exercise in a Box tabletop format with a scenario that matches the synthetic boundary, keeping the names fabricated and recording every step as exercise evidence.

If the test exposes personal or confidential material, end the exercise, contain the record and follow the buyer's incident route. Restart only after the named owner approves a corrected fixture and control; do not carry exposed material forward as though it were an ordinary test finding.

• Rule of thumb: Rehearse with fabricated material; stop on exposure.

If the exercise finishes, compare observed evidence rather than preference

If the controlled exercise completes without an unresolved exposure, compare observable process evidence only. Government Communications' Evaluation Cycle separates inputs, outputs, audience response, outcomes and impact; this synthetic exercise has no live audience response or causal outcome to assess.

Record buyer-approved cost fields, internal labour assumptions, unresolved change exposure and exit work without inventing amounts. For every field, note the route, evidence held by the buyer, named owner and a pass, hold or fail status with its reason; compare results by gate, never by averaging them into one score.

Rank the routes on gate results and named facts, not preference. The agency option advances only if it passes the same security, rights and accessibility gates, names its lead, supplies references and prices the same scope as the baseline. Otherwise, the in-house route holds and the next ninety days use evidence already retained.

A 2027 plan must not proceed on a 2026 assumption that has changed. Keep the results tied to their evidence and date, and do not treat a completed rehearsal as proof of live audience response, a causal outcome or a general service result.

• Rule of thumb: Compare gate by gate; never average away a failure.

If the evidence supports a decision, preserve the option to reverse it

If the evidence is sufficient at days 86 to 90, choose external support, retain the in-house route, run a narrower retest or hold. Document the rationale, dissent, expiry, open risks, retained evidence and who has authority to restart the decision.

Before any future live channel, check the Committee of Advertising Practice's explanation of its remit and the Information Commissioner's Office business-contact guidance against that channel. A synthetic exercise supplies neither advertising clearance nor marketing permission, so neither should be inferred from a successful rehearsal.

Archive test data according to the approved retention rule, remove temporary access and schedule a source recheck. Every result field stays empty until the buyer's authorised team produces the evidence; the plan supplies the record, gates, selection criteria and questions, while completed findings remain with the buyer.

• Rule of thumb: Decide narrowly, date the decision and retain restart authority.