Question: How might I respond to a Web-based incident that causes significant brand damage?

Rad Jones, academic specialist in the School of Criminal Justice, Michigan State University; former international security manager, Ford Motor Company: Crisis management helps to protect four types of assets: people, property, information, and reputation. When I talk to a company about crisis response, I emphasize the importance of a crisis management team that includes key executives from human resources, marketing, legal, operations, security and other key functions.

The same processes used to prepare for a fire, an explosion or severe business disruption are also helpful in preparing for a Web-based threat to the company's reputation. What is the damage to the product? What is the marketing and sales recovery strategy? What are the legal options/concerns? Are there proprietary information issues? What is the financial impact?

The crisis management team process brings everyone to the table to discuss how to respond. Tabletop exercises prior to an incident will help the team respond during an event.

You don't have to decide things under fire if you have already considered critical incidents in a relaxed and thoughtful atmosphere.

Kathleen Kotwica, executive vice president and chief knowledge strategist, Security Executive Council: If there is already significant brand damage, it is too late to ask the question. The most important activity surrounding brand damage incidents, whether or not in the Web world, is to have a brand reputation crisis strategy.

First, assess the possible risks based on your company or industry. Based on that exercise, craft a response plan to include process scenarios, roles and responsibilities.

Brand damage on the Web can happen fast, so the corporate response must be equally fast and should use the same channels in which the offending information surfaced. If a company is not prepared, a quick response could backfire because it's not appropriate to the Web 2.0 audience's concerns (e.g., corporate double-speak).

Key for this audience are transparency of corporate reaction and being able to communicate a response quickly, even if it is only an assurance the company is assessing the issue and/or that appropriate action is imminent.