Trying to communicate a crisis without a plan is like trying to float a boat with holes.

That's why a crisis communications plan must be developed first before the inevitability of a data breach, a cyberattack or internal fraud sinks the credit union's valuable reputation.

"I've had people who will call me and say, 'Anthony, I saw you talk six months ago. We're in a crisis and we need your help," Anthony Huey, president of Reputation Management LLC in Sarasota, Fla., said. "The first question I ask is, 'You did what I said, right? You developed a crisis communications plan?' The ones that say no, I'm honest and say, 'I can walk you through the steps and give you some other guidance, but a lot of what needed to be done should have been done already.'"