PR agencies planning template: a cyber exercise record

This record is for rehearsing incident communications with a PR agency you are considering, in one England case: a possible cyber incident, tested with synthetic facts. It captures who took part, which approvals ran, where the channels failed and what was retested. It contains no real incident, contact list, budget or recommendation, and the team completes every bracketed field from evidence.

What to take away

Run the same rehearsal for the agency route and the in-house route, then compare the two records rather than the two pitches.
A rehearsal produces evidence only if the record names the scenario version, participants, unavailable roles, message version and approval sequence.
Keep what a reviewer inspected apart from what the exercise actually tested, because a desk review of a template does not show that an out-of-hours route works.
Use synthetic names and non-sensitive facts, and never contact a journalist, customer or stakeholder during the exercise.
Every failure gets a severity owner, containment, repair evidence, retest scope and restart authority.
Revalidate the sources and all blank entries before any 2027 use.

Enter the agency before the exercise

Record each agency you are considering from the directory before anyone is briefed. One blank entry per agency keeps the comparison with the in-house route fair, and the selection checklist shows what else a buyer should ask for.

Directory entry:[agency name, directory listing, office locations, services offered and named contact].
Scope:[deliverables, incident-communications work included, exclusions, start and end dates].
Commercial:[quoted fee basis, VAT treatment, expenses, payment terms, inclusions and exclusions to be entered].
Evidence:[comparable incident work, named referee, reference-check date and notes].
Route test:[why an external brief beats the in-house route, or the reverse, with the evidence behind the judgement].

The brief for the agency should state the same synthetic scenario that the in-house team will receive. Named agencies, prices and role analysis for this planning case sit in the strategy and planning guide.

Set up the exercise record

Open one record per rehearsal and complete the header before anyone is called. The header fixes which version of the plan was tested, so a later reader can tell whether a failure belongs to the plan or to the day.

Field / Buyer entry

Route tested: [agency name and package, or in-house baseline]
Scenario version: [version number, date, author]
Start event: [what triggers the exercise, the time, who is told first]
Participants: [role, named person, deputy; mark which are agency staff]
Agency roles: [account lead, agency spokesperson, out-of-hours contact, reachable or not]
Unavailable roles: [role absent by design, reason]
Message version: [holding statement and question sheet versions in use]
Approval sequence: [who approves, in what order, by what route]
Accessible variants: [format, test method, tester, unresolved barriers]
Channel fallback: [primary channel, fallback channel, trigger for switching]

Use synthetic names and non-sensitive scenario facts. NCSC guidance says to run regular tabletop exercises and simulations to test the effectiveness of a strategy. Its communications guide covers advance protocols, spokespeople, stakeholder routes, alternative channels and exercises. Use it to identify functions, not to presume that outsourcing is necessary.

Messages to have ready before the clock starts

Prepare these artefacts before an incident starts, and leave every field blank until the evidence is in. The exercise tests whether the artefacts can be used at speed, not whether they read well on paper.

Holding statement skeleton:[Organisation] is [aware of / responding to] [event]. Our priority is [safety / service continuity]. We have [action taken]. We will update [audience] by [time] at [channel]. Media contact: [named spokesperson, role].
Question and answer sheet:[likely question, agreed answer, evidence source, approver, review date].
Media log:[outlet, journalist, question asked, answer given, spokesperson, time, correction and follow-up].
Stakeholder map:[group, interest, impact, channel, owner, update frequency].
First-response checklist:[who confirms the facts, who approves the holding statement, who notifies, who logs the decision].

For each proposed message, record the factual claim, source version, legal or technical confirmer, spokesperson, approver, expiry and correction route. An agency may draft the wording, but a claim without a confirmer on the buyer's side does not go into the holding statement.

Escalation tiers and the out-of-hours call tree

Record the organisation's own tiers rather than copying another team's. Each tier needs a trigger, an approving role, a notification route and a review interval, and the call tree needs the date on which it was last tested.

Escalation tiers:record the buyer's own tiers, for example major, significant and local, with the trigger, approving role, notification route and review interval for each.
Out-of-hours call tree:[primary on-call role, number, backup role, escalation path, acknowledgement window, rota owner and the date the route was last tested].
Internal escalation:[tier, notifying role, recipients, timing and log location].

The channel fallback sits beside the call tree. An owned status page, a direct stakeholder briefing, an earned editorial response and a paid placement are different routes, each with its own recipient and control. Name the trigger for switching from one to another, and record whether the agency or the buyer holds the access for each.

A worked record: ransomware at 02:00

The example below is illustrative, not real data. It shows how a record reads when the exercise finds a real fault, in this case an outdated out-of-hours phone list.

Field	Worked entry
Scenario	Version 3, a ransomware outage starting at 02:00 on a Tuesday
Participants	Duty communications lead, IT incident manager and legal adviser
Unavailable	Head of communications
Message	Version 2, approved by legal and incident manager at 02:40
Accessible variants	Plain-text email; no tested BSL video
Channel fallback	Public website and recorded phone line
Error	Outdated out-of-hours phone list
Correction	List updated and retested
Access removal	Temporary account disabled at 06:00
Inspected or tested	The reviewer inspected the approval log; the exercise tested the phone fallback

The last row is the one readers skip. A reviewer who reads an approval log has inspected a record, while a team that used the recorded phone line has tested a route. Only the second shows that the fallback works at 02:00. In an agency test, add one row naming the agency role that took part and whether it could be reached.

Acceptance and exit for the agency route

List each deliverable, evidence owner, acceptance test, failure action and rework authority. Add export format, rights handover, contact-data return or deletion, credential removal, retained records, open corrections and continuity owner.

NCSC supply-chain guidance supports control through requirements and ongoing assurance. The agency's access to drafts, contacts and workspaces ends when the engagement ends, and the contract terms should say so before signature.

Record every failure with an owner

For each failure, enter the severity owner, containment, repair evidence, retest scope and restart authority. A failure without an owner is only an observation, and it will reappear in the next rehearsal.

Do not contact a journalist, customer or stakeholder during this planning exercise. If personal or confidential material appears unexpectedly, stop the test and follow the buyer's incident and data-handling process. Close the record with one decision: external, in-house, limited test or hold.

Notification and reporting log

An incident plan is incomplete without its reporting routes. Record the decision and the time for each one, including a decision not to report.

ICO:the ICO's guide says the UK GDPR duty to report certain personal data breaches must be met within 72 hours of becoming aware of the breach, where feasible. Record the assessing role, the decision, the reporter and the time of the report or of the decision not to report.
NCSC:report significant cyber incidents to the National Cyber Security Centre through its incident reporting route, and record the reference, the contact and what was shared.
Action Fraud:in England, Wales and Northern Ireland, fraud and cybercrime reports go to Action Fraud, the national reporting centre; record who files the report and what was reported.

Before you act

Record the agency's directory entry, scope and evidence before briefing.
Complete the headerroute tested, scenario version, start event, participants and unavailable roles.
Record factual claim, source version, confirmer, approver, expiry and correction route.
Test the out-of-hours call tree and the channel fallback, and record the date.
Separate what the reviewer inspected from what the exercise tested.
Give each failure an owner, a repair, a retest scope and a restart authority.
Log the ICO 72-hour decision, the NCSC incident report and any Action Fraud report.

Common questions

What does the exercise record capture?

It captures the route tested, scenario version, start event, participants, unavailable roles, message version, approval sequence, accessible variants and channel fallback, then the errors found, the corrections made and the access removed. It also holds the reporting decisions for the ICO, the NCSC and Action Fraud.

How does the record help compare an agency with the in-house route?

Run the same synthetic scenario for both routes and fill one record each. The comparison rests on what each route did under the same conditions, not on what a proposal promised.

What is the difference between inspected and tested?

A reviewer who reads an approval log has inspected a record. An exercise that uses a fallback route has tested it. A desk review of a template is not evidence that an out-of-hours route works.

When must a rehearsal stop?

Stop the test if personal or confidential material appears unexpectedly, and follow the buyer's incident and data-handling process. Do not contact a journalist, customer or stakeholder during the exercise.