+603 2731 9226contact@crisismanagementcentre.com

Q Sentral · Kuala Lumpur · Malaysia

Commercial building in Kuala Lumpur
Confidential briefing
HomeGuidance / Malaysia

Practical crisis management resources

Direct checklists for leadership, risk, operations and communications teams preparing for serious incidents.

On this page

Preparation, response and recovery.

01

How to build a crisis management plan

A usable plan defines authority and action, not only policy.

  • Set activation and escalation criteria.
  • Name the team, alternates and decision authorities.
  • Maintain contacts, meeting routines and a decision log.
  • Link operational actions to stakeholder communication.
  • Exercise the plan and assign each improvement.
02

Crisis team roles and escalation

The team should be small enough to decide and broad enough to act.

  • Appoint one accountable crisis leader.
  • Separate strategic decisions from operational workstreams.
  • Include legal, risk, operations, communications, technology and people functions as required.
  • Define who can activate the team and approve external statements.
03

How to run a tabletop exercise

Test the decisions, interfaces and assumptions that matter during a real incident.

  • Agree objectives before writing the scenario.
  • Use staged information rather than a single discussion prompt.
  • Record decisions, delays and unanswered questions.
  • Debrief immediately and turn findings into owned actions.
04

Crisis management and business continuity

Crisis management directs the response; continuity keeps priority activities operating or restores them.

  • Connect activation criteria between the two plans.
  • Use one view of priorities, dependencies and stakeholders.
  • Coordinate technology recovery, operational workarounds and leadership decisions.
  • Exercise both structures together.
05

Crisis communication plan structure

Communication should follow verified facts, stakeholder priority and clear approval authority.

  • Define the fact-verification and approval process.
  • Map employees, customers, regulators, partners, investors, media and communities.
  • Prepare adaptable holding materials rather than incident-specific promises.
  • Track questions, commitments and corrections.
06

The first hour of a crisis

The first objective is disciplined coordination, not a complete answer.

  • Protect people and stabilise urgent operations.
  • Activate technical, legal and management leads.
  • Separate confirmed facts from assumptions.
  • Set the next decision time and assign actions.
  • Acknowledge urgent stakeholders only with approved information.
07

Holding statements

A holding statement acknowledges an issue while facts and obligations are still being assessed.

  • State only what is confirmed.
  • Explain immediate action without speculation.
  • Identify the next source or timing of an update where possible.
  • Obtain legal, regulatory and operational approval before release.
08

Media training checklist

Prepare the spokesperson for the format, issue and legitimate limits of their knowledge.

  • Define the spokesperson’s authority and subject area.
  • Practise direct answers and explanations of uncertainty.
  • Rehearse difficult follow-up questions.
  • Review pace, language, posture and non-verbal signals.
09

Malaysia data breach notification

Notification decisions depend on the applicable law, facts, organisational role and current official guidance.

  • Engage the data protection officer and qualified legal counsel promptly.
  • Preserve the technical fact record and evidence.
  • Assess affected data, people and systems.
  • Use current guidance from the Personal Data Protection Commissioner; do not rely on a generic deadline.
Official source: Personal Data Protection Commissioner guidance
10

What to communicate after a data breach

Affected people need accurate, useful information without technical or legal speculation.

  • Explain what happened to the extent confirmed.
  • Describe which information may be affected.
  • Set out protective steps people can take.
  • Provide a reliable contact and update route.
  • Keep regulator, customer, employee and public materials consistent.
11

Material events and public-company response

Operational, legal, investor and public communications must be coordinated when an event may be material.

  • Escalate early to responsible officers and advisers.
  • Maintain one verified fact and decision record.
  • Assess disclosure obligations using current rules and qualified advice.
  • Coordinate employee, customer, market and media communications.
Official source: Securities Commission Malaysia resources
12

Supply-chain disruption checklist

Map operational dependencies and communication duties before disruption reaches customers.

  • Identify critical suppliers, routes and single points of failure.
  • Set operational triggers and alternative arrangements.
  • Prioritise customer, employee, regulator and partner updates.
  • Track commercial decisions and public commitments.
13

Coordinated online narratives

Respond to harmful or misleading narratives with evidence, governance and proportionate action.

  • Verify the content, reach and coordination indicators.
  • Distinguish criticism from manipulation or impersonation.
  • Align communications, security, legal and platform actions.
  • Avoid amplifying low-reach material through an oversized response.
14

Post-crisis review questions

A review should improve the operating system, not assign blame after the fact.

  • When was the incident recognised and escalated?
  • Which decisions were delayed, and why?
  • Where did teams use conflicting facts or priorities?
  • Which stakeholder commitments remain open?
  • Who owns each improvement and by when?
Apply the guidance

Review your current arrangements.

Schedule a consultation about a plan, exercise, live response or post-incident review.

Schedule a consultation

Schedule a consultation.

Provide your contact details and a short description. The form will open an email addressed to Crisis Management Centre.

+603 2731 9226contact@crisismanagementcentre.com

Level 35-02 (East Wing), Q Sentral
2A Jalan Stesen Sentral 2
50470 Kuala Lumpur, Malaysia

This form opens a populated email in your email application. No information is stored by this site.