Strategy
Part of PR agencies strategy: comparing external incident support with an in-house baseline
PR agencies strategy framework: agency, in-house, trial or hold
How an England PR planning decision ends in agency, in-house, a smaller trial or hold, with a worked baseline, indicative costs and the gates that stop a bid.
An organisation operating in England that needs an approved communications plan for a possible cyber incident can end the decision in four places: a bounded external agency package, its current in-house process, a smaller evidence trial or a hold. This is a planning case, not a report that an incident has occurred.
What to take away
- Four outcomes are defensibleagency, in-house, a smaller evidence trial or hold.
- The external route advances only if it fills a verified capability or capacity gap, not an undocumented assumption.
- A bid that cannot name the out-of-hours confirmer loses the comparison.
- Indicative day rates and a four week package show proportion, never a verdict.
- Record a separate pass, hold or fail for each gate, because a strong gate cannot rescue a failed one.
Four outcomes and what each needs
The decision owner picks one outcome and records the evidence behind it. Each outcome has its own trigger, and a bounded agency package is only one of the four. The table lists what must be on file before an outcome is chosen.
| Outcome | Choose when | On file before choosing |
|---|---|---|
| External agency package | The tested baseline shows a verified capability or capacity gap | Named people by grade, evidence from a comparable incident or exercise, out-of-hours rota, exit terms |
| Current in-house route | The baseline meets the objective the scenario set | Dated scenario script, approval log, released holding line, debrief actions |
| Smaller evidence trial | The baseline is untested, or a bid cannot name the out-of-hours confirmer | Scenario, named owners, target time left blank |
| Hold | The problem is unverified, the baseline is missing, specialist gates fail or the contract cannot preserve correction, confidentiality and exit | The failed gate and the recheck date |
Set no target time until the buyer has a tested baseline and risk owner approval. The NCSC's incident-communications guidance recommends advance roles, protocols, stakeholder routes, media handling and exercises, so test the existing file against those functions before any pitch is read.
Worked case: a retailer that ended in a smaller trial
As an illustration only, a 60 person retailer tests a synthetic ransomware scenario with one communications manager and no out-of-hours cover. The first approved holding line goes out 4 hours 20 minutes after scenario start, and three of five customer channels have no approved template.
Only then does the buyer set a target of 90 minutes for the first approved holding line and 30 minutes for verified facts, and re-test quarterly. Keep this evidence list for the run:
- The dated scenario script.
- The approval log with named confirmers and times.
- The released holding line.
- The out-of-hours contact test.
- The debrief actions.
In that example, a bid that cannot name the out-of-hours confirmer loses the comparison, and the recorded outcome is a smaller in-house evidence trial. The agency may prepare material, but it does not inherit the buyer's approval authority, and a missing confirmer sends the item to hold.
What the agency route would cost
Costs are indicative only. England agencies commonly quote day rates by grade, roughly £450 to £600 for junior support and £1,000 to £1,200 for a director. At those rates a bounded four week package with an out-of-hours rota works out at roughly £12,000 to £30,000, excluding VAT.
What fixes the figure: the number of named days, seniority, out-of-hours cover, secure handling of incident data, the number of approvers and the exit terms. Ask for a fixed fee with a day cap and compare it with at least two other quotes.
The range is wide, so it tests proportion rather than value. If the baseline found a small gap, a package at the top of the range needs a reason on file.
Where to look for candidates
Shortlist against the brief, not the pitch. Criteria that matter for this job: named people by grade, evidence from a comparable incident or exercise, an out-of-hours rota, secure handling of unverified data, accessible formats, a named subcontractor list and clear exit terms.
Sources to start from: the PRCA member directory, PRWeek's annual UK consultancy rankings and this site's own agency directory. Check the contracting entity at Companies House, and ask each agency for its cyber insurance, its own incident response plan and two references you can call.
The planning guide for this case covers problem definition, channels and contracts in more detail.
Gates that override a good bid
The decision owner records a separate pass, hold or fail for each gate. A strong result on one gate cannot rescue a failed one.
- factual claims, evidence and sign-off;
- media relationships and spokesperson authority;
- advertising recognition and paid placement;
- privacy, PECR and contact provenance;
- copyright, licences and reuse;
- confidentiality, security and incident access;
- accessible formats and audience needs;
- budget authority, contract, correction and exit.
NCSC supply-chain guidance, specifically the Establish control principle in its set of supply chain security principles, supports proportionate requirements, contract flow-down and continuing assurance. It does not certify a supplier.
The CAP Code, the UK Code of Non-broadcast Advertising and Direct and Promotional Marketing, explains that press releases and editorial material differ from advertising, while remit can depend on the communication. The ICO's business-contact guidance, part of its Direct marketing guidance, also keeps recipient and channel facts central. Neither a journalist relationship nor a public address supplies blanket permission.
Decide, record and revisit
Name the buyer's decision owner, evidence owners, review date and reversal trigger. A defensible outcome can be agency, in-house, a smaller evidence trial or hold.
Stop if the problem is unverified, the baseline is missing, specialist gates fail or the contract cannot preserve correction, confidentiality and exit. Recheck every current rule before acting on the result.
Before you act
- Test the existing communications file and state the operational defect.
- Time the in-house route on one synthetic scenario and leave the target blank.
- Name the out-of-hours confirmer for every route compared.
- Ask for a fixed fee with a day cap and at least two other quotes.
- Record pass, hold or fail for each gate separately.
- Name the decision owner, review date and reversal trigger.
Common questions
Which outcomes can the framework end with?
Agency, in-house, a smaller evidence trial or hold. The tested baseline and the gates decide which one, and the decision owner records the reason.
What does the external agency inherit from the approval chain?
Authority stays with the buyer's named roles, which the problem record lists. The contract binds the agency to the buyer's release process and does not transfer any approval.
When should the process stop?
Stop if the problem is unverified, the baseline is missing, specialist gates fail or the contract cannot preserve correction, confidentiality and exit. Recheck every current rule before acting on the result.
