PR agencies strategy: comparing external incident support with an in-house baseline

A useful PR plan starts with a defect someone can verify, not a campaign theme, journalist list or coverage promise.

This guide follows one planning case. An organisation with an operating establishment in England needs an approved communications process for a possible cyber incident. It must compare external PR agency incident support with its in-house baseline.

Both sides of that comparison are named. External providers: Brunswick Group, Edelman, FTI Consulting, Teneo and Control Risks, all London-based. In-house options: the NCSC's Exercise in a Box, City of London Police's Cyber Griffin, a regional Cyber Resilience Centre and a paid media-monitoring subscription.

No incident or organisational failure is alleged. The NCSC's guidance on cyber-incident communications provides the evidence basis for testing preparedness: defined responsibilities, stakeholder groups, media handling, alternative routes and exercises. The buyer still has to show which of those functions exists, which fails and what decision follows.

The 2027 date is a review horizon. Rules, guidance, risks, staffing and supplier facts checked on 6 September 2026 must be verified again before use.

What to take away

Define the problem without preselecting an agency

Start with the current file. Can the organisation assemble verified facts, decide what remains unknown and identify affected groups? Can it obtain approval, publish in an accessible form and correct a statement when facts change? Who covers those duties outside normal hours, and which channel survives when the usual systems fail?

Record the evidence for each answer. An outdated contact sheet is not a tested relationship. A draft statement is not approved. A senior title does not prove decision authority. If the evidence shows the in-house process already meets the need, the external package has no problem to solve.

A tight problem statement might read:

During an authorised synthetic incident exercise, the buyer cannot produce and approve an accessible stakeholder update from verified facts through an alternative channel. The current owner, failure evidence and review date are recorded in the exercise file.

That sentence is a template, not a finding. The live buyer must replace it with observed evidence or stop.

Keep the parties and audiences separate

The organisation facing the issue may not be the legal entity signing the contract, and an agency may subcontract. A spokesperson can approve or deliver a statement without owning the underlying operational fact.

A journalist or editor decides what, if any, becomes editorial coverage. A stakeholder may need an operational update, and a wider audience may meet later public material.

Use a role ledger:

This prevents a familiar planning error: treating access to a contact as control over the media, or treating an agency deliverable as an audience outcome.

Choose an objective that the evidence can answer

For the synthetic case, an objective should identify the event, eligible audience, action, evidence and period. The baseline must show what the current team can do before a new service is added. Leave any time or quality threshold blank until it is measured and approved.

Government Communications' current Evaluation Cycle separates inputs, outputs, audience perceptions, behavioural outcomes and impact. It is guidance for public-sector communications, not a universal commercial standard. Its categories stop unlike claims being bundled together:

Do not attribute the last two layers to an agency merely because its content appeared earlier. HM Treasury's Magenta Book is also government evaluation guidance, but it makes one useful point: impact questions need an appropriate design and comparison. A media log alone cannot establish causation.

Compare external and in-house delivery fairly

Write one brief for both routes. It should specify the synthetic scenario, audience groups, permitted data and factual sources. Add the approval path, required formats and secure workspace. Then add the exercise, correction process and exit evidence.

The in-house route is not automatically free, independent or available. Record its labour, other work displaced, skills, access and out-of-hours dependencies. Do not invent monetary values. The external route is not automatically faster, better connected or more objective. Require evidence for named capacities and leave availability unknown until confirmed.

Compare named options on the same criteria. Agencies rarely publish rates, so the figures below are labelled typical ranges for England, before VAT at 20%.

Compare both routes on:

A hybrid can be tested if the boundary is explicit. The in-house fact owner may retain approval while an agency prepares accessible variants. That is an operating allocation, not proof of superior results.

Design channel choices around recipients and control

An owned status page, direct stakeholder briefing, earned editorial response and paid placement are different routes. Each has its own origin, recipient and control. Add its permission, disclosure, accessible fallback and correction process.

CAP's 2025 remit explanation says press releases and editorial material are outside the Code as described there. Ads, advertorial, direct marketing and some marketer-controlled commercial claims may fall within scope.

Where material is a marketing communication, section 2 addresses recognition and section 3 covers misleadingness and substantiation. A qualified advertising reviewer must classify the actual item and placement.

The buyer cannot promise earned coverage. Its evidence can show that an authorised response was supplied, when and to whom. The journalist or publisher retains editorial control. Paid control must be disclosed where the rules require it and must not be presented as independent media interest.

Everbridge sells enterprise mass notification, and Signal is a free encrypted messenger. Both can carry a direct route, and neither replaces an approved fact owner.

Treat contact data as a governed input

Media contacts, suppliers, staff, customers and other stakeholders are not one list. Record the source, purpose and recipient category for each record. Add the channel, age, preference and correction route.

The ICO's business-to-business marketing guidance distinguishes corporate and individual subscribers and explains the interaction between PECR and UK GDPR. The page is under review, so publication-day verification matters.

An operational update, a response to a journalist enquiry and a promotional pitch may use the same address for different purposes. A public address or past relationship does not settle the analysis. Keep objections and suppression available to the people who need them, while preserving only the minimum evidence required.

The ICO charges an annual data protection fee, published from £52 for the lowest tier. A media database such as Cision or Meltwater holds records that need the same discipline.

Put claims, rights and disclosure before drafting

Every proposed factual claim needs a source version, confirming owner, permitted qualification, approval, expiry and correction route. The agency can help shape language but cannot replace the person accountable for the operational fact. Stop when evidence is absent or the statement is broader than the record.

Rights need their own ledger. The IPO's copyright ownership guidance explains that a commissioner will not automatically own copyright in every commissioned work and describes licences and written assignments. Record authorship, ownership, licence, editing rights and territory for copy, images, recordings and templates. Add duration and handover for monitoring reports.

Disclosure is not confined to advertising labels. Record funding, sponsorship, agency role and spokesperson interest where they matter to the audience or publisher. Add paid placement, supplied material and corrections to the same ledger. Do not imply that a media contact endorses a message by receiving it.

Make accessibility an acceptance condition

Audience planning should identify formats and barriers before a message is commissioned. GOV.UK inclusive communication guidance, updated in June 2026, covers language, accessible formats, channel choice and external suppliers. It was written for government communicators and does not decide every private organisation's duties.

For this plan, record the audience need, version and test method. Add the reviewer, defect, correction and alternative route. A general claim that content is accessible is not evidence.

A failed accessible-format gate should hold release or trigger the approved emergency exception route, with reasons and remediation recorded by qualified reviewers.

Two free checks are the W3C's Web Content Accessibility Guidelines (WCAG) 2.2 and the accessibility checker in Microsoft Word. Neither replaces a test with the intended audience.

Protect confidential material and continuity

An external agency may need draft facts, contact information or access to a workspace. Classify those inputs before sharing them. Define named accounts, least access, logging, approved transfer and device rules. Add location rules, incident reporting, offboarding, export and deletion.

NCSC supply-chain security guidance recommends proportionate requirements, contract flow-down and continuing assurance. It does not certify an agency or dictate a universal clause. The buyer's security owner must assess the real service and evidence.

Plan for normal channels being unavailable. The NCSC incident guide recommends alternative communications and exercises. Test that route with synthetic data. Do not place live confidential details in a rehearsal simply to make it realistic.

Build a contract that preserves correction and exit

The contract should identify the exact legal parties, package, exclusions, deliverables and dependencies. Add approvals, subcontractors, rights, data roles and confidentiality. Then cover security, accessibility, pricing basis and VAT treatment. It should also fix change control, liability, correction, termination and handover.

It cannot create permission to use a contact, make a claim true or guarantee coverage.

Service measures require an event, eligible population, numerator, denominator and clock. Add timezone, exclusion, source and failure action, and leave values blank unless the contract or tested baseline supplies them.

VAT is 20% on standard-rated UK fees, so ask whether a quote includes it. Out-of-hours activation, additional languages and extra exercise rounds are usual extras.

Exit should return or delete buyer information according to the approved rule, remove access, transfer editable files and rights evidence, preserve open corrections, and name the continuing owner. A plan that works only while one supplier retains the contacts or templates is not yet resilient.

Use ninety days as a reversible evidence cycle

The first stage verifies the problem and baseline. The next writes the common brief and clears specialist review. A third stage inspects evidence for both routes. Only then should the buyer run a synthetic exercise, compare the gate results and decide.

A free Exercise in a Box scenario can supply the first stage with a testable baseline and no supplier.

Government Communications' STOP crisis-planning guide organises government crisis work around strategy, tactics, organisation and people, including holding lines, clearance and contact routes. It can inform the checklist but does not clear a private plan or supply its owners.

At every stage, retain a hold route. Stop if the problem cannot be evidenced, the in-house baseline is hidden, or factual approval is unavailable.

Stop again if a contact purpose is unclear, rights cannot be shown or an accessible route fails. Stop if confidential material is exposed or exit cannot be performed. Restart only when the named owner accepts new evidence.

Make the final decision narrow and dated

The decision record should say external agency, retain in-house, run a smaller retest or hold. It should name the owner, the evidence reviewed, unresolved matters and any dissent. Add the conditions, expiry date and reversal trigger. It should not claim a strategy is guaranteed to work.

The best outcome may be a smaller problem statement. Perhaps the buyer needs only an accessible template review, an exercise facilitator or out-of-hours drafting capacity. Narrowing the package reduces assumptions and makes acceptance clearer.

Before any 2027 use, reopen the regulator and government pages, recheck the risk record, verify the agency and subcontractor facts, and rerun the synthetic exercise. A planning horizon is useful only when it forces a fresh decision.

Before you act

Common questions

What should a problem statement for this planning case contain?

It should identify the event, eligible audience, action, evidence and period, with the baseline showing what the current team can do before a new service is added. Any time or quality threshold stays blank until measured and approved. The live buyer must replace the template with observed evidence or stop.

Why separate the parties and audiences in a role ledger?

The organisation facing the issue may not be the legal entity signing the contract, and an agency may use a subcontractor. A spokesperson can deliver a statement without owning the operational fact. The ledger records authority and boundaries, preventing errors such as treating media access as control.

Which providers and in-house options does the comparison name?

External firms: Brunswick Group, Edelman, FTI Consulting, Teneo, Control Risks, Burson and MHP Group, all with London offices. In-house: the NCSC's Exercise in a Box, City of London Police's Cyber Griffin, a regional Cyber Resilience Centre, Meltwater or Cision monitoring and ResponseSource. Published rates are rare, so each carries a labelled typical range.

How should contact data be treated under this process?

Media contacts, suppliers, staff and customers are not one list. Record the source, purpose, recipient category, channel, age, preference and correction route for each record. The ICO guidance distinguishes corporate and individual subscribers and explains how PECR interacts with UK GDPR, so verify on publication day.