Crisis Narrative Coordination Protocol

The Narrative Resilience Framework explains the enduring capability an institution builds over time. The Crisis Narrative Coordination Protocol explains what the institution does during a material incident.

The framework and protocol use the same institutional logic without duplicating one another.

Review the Narrative Resilience Framework

1. 01

   Use existing structures first. Map the protocol onto the ministry's current crisis, policy, communication, legal, security and records arrangements.

2. 02

   Keep the response proportionate. Most signals do not require a crisis cell or a public correction.

3. 03

   Separate evidence, assessment and decision. A verified fact, an analytical judgement and an authorized posture are different institutional objects.

4. 04

   Keep confidence separate from severity. A low-confidence signal can still have high potential consequence; a verified falsehood can remain low severity.

5. 05

   Preserve local context. The mission contributes language, culture, stakeholder knowledge and host-country consequence that central monitoring cannot reliably infer alone.

6. 06

   Retain institutional authority. Tools and AI may assist triage and analysis; people retain responsibility for severity, attribution, posture and authorization.

7. 07

   Treat restraint as an active posture. Monitoring, private engagement or deliberate non-response may be more effective than public rebuttal.

8. 08

   Record the decision trail. The institution should be able to reconstruct what was known, assessed, decided and authorized at each material point.

9. 09

   Protect lawful expression. Criticism, disagreement or inconvenient reporting does not become a narrative incident merely because it is uncomfortable. Activation requires a plausible diplomatic, institutional, operational, security or public-interest consequence that needs coordination.

10. 10

    Learn without creating permanent crisis mode. Stand down the acute coordination structure when its thresholds are no longer met, preserve lessons and return ownership to normal structures.

Severity describes potential institutional consequence and the coordination required. It does not describe whether the content is true, whether attribution is complete or how confident the assessment is.

Applying the levels

• Assess the highest material consequence, rather than averaging dimensions into a reassuring score.
• A small but highly sensitive incident can be Level 4. Reach is not the sole measure of severity.
• Low confidence does not automatically mean low severity. It means the uncertainty must be visible in the decision.
• Set an escalation trigger and a stand-down trigger whenever a level is assigned.
• Map each level to the ministry's existing authority and out-of-hours arrangements before operational use.

These are functional responsibilities. Ministries should map them to their existing units, grades, legal mandates and duty systems.

Stage ownership at a glance

The protocol can be run with one controlled page or record containing:

A video appears to show an ambassador making an inflammatory statement during a bilateral dispute. The first posts have limited reach, but several local accounts are beginning to share it.

1. 01The mission preserves the video, source link and timestamp, registers the incident and alerts the geographic desk.
2. 02Monitoring checks the source, media artefacts, earlier versions, translation and distribution. The content is assessed as probably synthetic with moderate confidence.
3. 03Because the video targets an ambassador during a live dispute and could affect personnel safety and bilateral handling, the incident is assigned Level 3 despite still-limited reach.
4. 04The geographic desk is named incident lead. The mission, monitoring team, spokesperson, security and legal advisers join a secure coordination channel.
5. 05A one-page common operating picture separates confirmed facts from the synthetic-media assessment, records confidence and identifies the next distribution threshold.
6. 06The institution chooses a combined posture: private engagement with the host authority, prepared factual correction, stakeholder briefing and continued monitoring. Public release is held unless agreed triggers are met.
7. 07The designated authority approves the posture, local-language boundaries and spokesperson line. Mission and HQ actions are sequenced and recorded.
8. 08Monitoring shows whether distribution crosses the agreed threshold, whether the private intervention reduces risk and whether a public correction becomes necessary. After stand-down, the ministry reviews detection, authorization time, local adaptation and the response's amplification effect.

The protocol does not determine the answer in advance. It ensures that the institution reaches and records an answer through the right evidence, context and authority.

Before operational adoption, a ministry should:

• map the six functions to existing teams and alternates;
• define the incident threshold and locally relevant consequence domains;
• connect Levels 1-4 to existing crisis and authority arrangements;
• approve secure reporting, evidence handling and record-retention procedures;
• establish out-of-hours contacts and handover expectations;
• approve the incident register and common operating picture templates;
• define local adaptation boundaries for missions;
• integrate existing FIMI, cyber, intelligence, consular, policy and communication mechanisms;
• test the protocol through tabletop exercises;
• review it after material incidents and at a regular institutional interval.

This public version is an independent coordination architecture. It should be adapted to national law, institutional mandates, information classifications, operational culture and existing procedures.

The protocol draws on publicly available foreign-ministry crisis arrangements, government crisis-management and communication doctrine, and current FIMI detection and response practice. Relevant sources include Global Affairs Canada's Rapid Response Mechanism, the EEAS FIMI Toolbox and Rapid Alert System, the G7 RRM, France's 2026-2030 national strategy on foreign information manipulation, NATO's approach to information threats, the UK Government Communication Service crisis model and STOP guide, and the UK Amber Book.

Public documentation cannot reveal the full internal operating procedures, classifications, intelligence relationships or authorization rules of individual foreign ministries. The protocol therefore identifies transferable functions and decision requirements rather than claiming to reproduce any ministry's internal system.

Selected sources

1. 01Global Affairs Canada - Rapid Response Mechanism Canada
2. 02G7 Rapid Response Mechanism - 2025 Annual Report
3. 03G7 RRM - Common Understanding of the Information Manipulation Set Framework
4. 04EEAS - Information Integrity and Countering FIMI
5. 05France - National Strategy Against Foreign Information Manipulation 2026-2030
6. 06NATO - Approach to Counter Information Threats
7. 07UK Government Communication Service - Crisis Communications Operating Model
8. 08UK Government Communication Service - STOP Crisis Communications Planning Guide
9. 09UK Government - The Amber Book: Managing Crisis in Central Government
10. 10UK Government - Explaining Uncertainty in UK Intelligence Assessment
11. 11UK National Audit Office - Responding to Sudden-Onset Humanitarian Crises
12. 12France Diplomatie - The Crisis and Support Centre