/response-coordinator

name: response-coordinator
description: Coordinate crisis response through structured playbooks, communication templates, and team orchestration
license: MIT
metadata:
  author: ClawFu
  version: 1.0.0
  mcp-server: "@clawfu/mcp-skills"

Crisis Response Coordinator

> Orchestrate effective crisis response through structured playbooks, clear communication templates, and coordinated team actions.

When to Use This Skill

• Active crisis situations
• Building crisis playbooks
• Training response teams
• Creating communication templates
• Post-crisis improvement

Methodology Foundation

Based on **Burson-Marsteller crisis playbook** and **PPRR model** (Prevention, Preparedness, Response, Recovery), combining:

• Incident command structure
• Stakeholder communication
• Timeline management
• Documentation practices

What Claude Does vs What You Decide

| Claude Does | You Decide | |-------------|------------| | Structures response playbook | Go/no-go decisions | | Drafts communications | Approval authority | | Coordinates timelines | Resource deployment | | Documents actions | Spokesperson selection | | Suggests escalation paths | Legal implications |

Instructions

Step 1: Activate Crisis Protocol

**Activation Checklist:**

• [ ] Confirm crisis status (not false alarm)
• [ ] Identify crisis type and scope
• [ ] Assemble core response team
• [ ] Establish communication channels
• [ ] Begin documentation log

Step 2: Establish Command Structure

**Crisis Team Roles:**

| Role | Responsibility | Typical Owner | |------|----------------|---------------| | **Crisis Lead** | Overall coordination | CEO/COO | | **Comms Lead** | External messaging | CMO/PR Head | | **Operations Lead** | Fix the problem | CTO/VP Ops | | **Legal Counsel** | Legal guidance | General Counsel | | **Customer Lead** | Customer communication | VP CX | | **HR Lead** | Internal/employee | CHRO |

Step 3: Execute Response

**Response Phases:**

| Phase | Duration | Focus | |-------|----------|-------| | **Contain** | 0-2 hours | Stop bleeding, assess scope | | **Communicate** | 2-4 hours | Stakeholder notifications | | **Resolve** | 4-24 hours | Fix root cause | | **Recover** | 1-7 days | Return to normal | | **Learn** | 7-30 days | Post-mortem, improvements |

Step 4: Manage Communications

**Stakeholder Priority:**

| Stakeholder | When to Notify | Channel | |-------------|----------------|---------| | Internal team | Immediately | Slack/Teams | | Board/Investors | Within 1 hour | Call/Email | | Affected customers | Within 2 hours | Direct | | All customers | Within 4 hours | Email/Social | | Media | Reactive | Press statement | | Public | As needed | Website/Social |

Step 5: Document Everything

**Crisis Log Template:**

TIME | ACTION | OWNER | OUTCOME
-----|--------|-------|--------
10:00 | Alert received | [Name] | Verified
10:15 | Team assembled | [Name] | 5/6 present
10:30 | Root cause identified | [Name] | DB issue
...

Examples

Example 1: Crisis Response Playbook

**Input:**

Create a crisis response playbook for a data breach scenario.

**Output:**

## Crisis Playbook: Data Breach

### Severity Classification

| Level | Criteria | Response |
|-------|----------|----------|
| **Critical** | PII exposed, >10K records | Full activation |
| **High** | PII exposed, <10K records | Partial activation |
| **Medium** | Non-PII data exposed | Contained response |
| **Low** | Attempted breach, blocked | Monitor and report |

---

### Activation Trigger

**Automatic activation when:**
- Confirmed unauthorized data access
- Evidence of data exfiltration
- Regulatory notification required
- Media awareness possible

---

## Phase 1: CONTAIN (0-2 Hours)

### Immediate Actions

| Time | Action | Owner | Checklist |
|------|--------|-------|-----------|
| +0 min | Isolate affected systems | IT Security | [ ] |
| +0 min | Preserve forensic evidence | IT Security | [ ] |
| +15 min | Assemble crisis team | Crisis Lead | [ ] |
| +30 min | Brief team on situation | IT Security | [ ] |
| +30 min | Legal notification | Legal | [ ] |
| +1 hr | Scope assessment complete | IT Security | [ ] |
| +1 hr | Impact assessment complete | Ops Lead | [ ] |

### Crisis Team Assembly

**Mandatory Attendees:**
- [ ] CEO (Crisis Lead)
- [ ] CTO (Technical Lead)
- [ ] CISO (Security Lead)
- [ ] General Counsel (Legal Lead)
- [ ] CMO (Communications Lead)
- [ ] VP Customer Success (Customer Lead)

**Optional (as needed):**
- [ ] CHRO (if employee data)
- [ ] CFO (if financial impact)
- [ ] Board liaison

### Initial Assessment Template

BREACH ASSESSMENT ================= Discovery Time: [TIME] Breach Window: [START] to [END]

Data Involved:

• [ ] Names
• [ ] Email addresses
• [ ] Phone numbers
• [ ] Passwords
• [ ] Payment data
• [ ] SSN/Government ID
• [ ] Health information
• [ ] Other: ___________

Records Affected: [NUMBER] Customers Affected: [NUMBER]

Attack Vector: [DESCRIPTION] Current Status: [CONTAINED/ONGOING] Confidence Level: [HIGH/MEDIUM/LOW]

---

## Phase 2: COMMUNICATE (2-4 Hours)

### Communication Sequence

| Priority | Stakeholder | When | Channel | Owner |
|----------|-------------|------|---------|-------|
| 1 | Board/Investors | +2hr | Call | CEO |
| 2 | Regulators | +2hr | Formal notice | Legal |
| 3 | Affected customers | +3hr | Email | CX Lead |
| 4 | All employees | +3hr | All-hands | HR |
| 5 | Media (if inquiries) | +4hr | Statement | Comms |
| 6 | Public | +4hr | Website | Comms |

---

### Communication Templates

#### Customer Notification (Direct Victims)

Subject: Important Security Notice - Action Required

Dear [Name],

We're writing to inform you about a security incident that may have involved your personal information.

WHAT HAPPENED On [DATE], we discovered unauthorized access to [SYSTEM]. The incident occurred between [DATE] and [DATE].

WHAT INFORMATION WAS INVOLVED Based on our investigation, the following information may have been accesse