Strategy
Part of PR agencies strategy: comparing external incident support with an in-house baseline
Five PR planning mistakes for an incident-readiness decision, each with a stop test
Five non-ranked PR planning mistakes for an England incident-readiness decision, each tied to current official evidence and a practical stop test.
These five mistakes concern one bounded decision: whether an England-operating organisation should buy external support for cyber-incident communications or retain its current in-house process. They are planning failures, not claims about named agencies.
What to take away
- Audit your in-house incident communications file against NCSC functions before briefing any agency.
- A drafted release or sent briefing is an output, not proof of audience understanding or impact.
- A journalist, stakeholder and marketing subscriber are different roles, so a contact is not permission.
- Record payment, control, placement and evidence before releasing any paid material as editorial.
- Hold any asset whose rights, accessible alternative, secure access, correction owner or exit evidence is missing.
Method and limits
Research date: 6 September 2026.
Scope: problem definition, options, channels, evidence and reversibility for the stated case.
Inclusions: a mistake needed a current official source, an observable failure and a stop or repair test.
Exclusions: price, agency rankings, campaign results, media coverage, invented incidents and sector-specific legal conclusions.
Ranking and conflicts: the list is non-ranked. No supplier, client or affiliate funded the selection. Each gate needs qualified review before operational use.
1. Buying before the gap is recorded
An agency brief that starts with deliverables can conceal the actual defect. The NCSC incident-communications guidance describes advance protocols, spokespeople, stakeholder groups, alternative routes and exercises. Audit the in-house file against those functions first.
Stop test: if the buyer cannot show which capability is missing, retain the baseline and investigate.
2. Counting a statement as an outcome
A drafted release, approved holding line or sent briefing is an output. It does not prove audience understanding, action or organisational impact. Government Communications' Evaluation Cycle separates these layers in a public-sector framework.
Repair: give every measure an event, population, denominator, period, evidence owner and decision use. Require a defensible comparison before making a causal claim.
3. Treating a contact as permission
A journalist, stakeholder and marketing subscriber occupy different roles. Public business details or an existing relationship do not settle every use. The ICO's business-to-business guidance requires attention to personal data, subscriber type, channel and objections.
Stop test: do not send when source, purpose, recipient or suppression route is unresolved.
4. Calling paid material editorial
CAP's scope explanation distinguishes press releases and editorial material from ads and advertorial. Where the Code applies, section 2 addresses recognition and section 3 covers misleading claims and substantiation.
Repair: record payment, control, placement, audience and the evidence behind each objective claim before release.
5. Leaving fragile gates until sign-off
Copyright, accessibility and supplier security cannot be repaired safely by a final copy edit. IPO ownership guidance explains that commissioned work does not automatically settle ownership. GOV.UK inclusive communication guidance covers formats and external suppliers in a government context. NCSC supply-chain guidance supports requirements and continuing assurance.
Stop test: hold any asset whose rights, accessible alternative, secure access, correction owner or exit evidence is missing. A strong message does not compensate for a failed gate.
Close each failure with evidence
For every mistake found, record the affected artefact, owner, source version, immediate containment and the smallest safe repair. Name the person who can authorise a retest and the event that would reopen the decision. Do not mark the matter resolved because wording was softened or a supplier supplied an assurance.
The final record should preserve separate results for factual approval, media handling, advertising remit, contact use, rights, accessibility, security, budget, contract and exit. If one remains unresolved, narrow the planned activity or keep it on hold. The list does not certify a strategy and must be rechecked against current sources before 2027 use.
Before you act
- Show which capability is missing before buying external support.
- Give every measure an event, population, denominator, period and owner.
- Do not send when source, purpose, recipient or suppression route is unresolved.
- Record payment, control, placement and evidence before release.
- Hold assets with missing rights, accessibility, security or exit evidence.
- Name who can authorise a retest and what reopens the decision.
Common questions
When should an organisation retain its in-house process instead of buying external support?
The article says to audit the in-house file against NCSC incident-communications functions first. If the buyer cannot show which capability is missing, retain the baseline and investigate. Buying before the gap is recorded is the first planning mistake listed, and it is a stop test.
What must be recorded before making a causal claim about communications?
The article says to give every measure an event, population, denominator, period, evidence owner and decision use. It also says to require a defensible comparison before making a causal claim. A drafted release, approved holding line or sent briefing is an output, not an outcome.
What should happen when a rights, accessibility or security gate is unresolved?
The article says to hold any asset whose rights, accessible alternative, secure access, correction owner or exit evidence is missing. If one result remains unresolved, narrow the planned activity or keep it on hold. A strong message does not compensate for a failed gate.
