For all the chaos and confusion that Target has caused this year, they recently sent a message to CEOs everywhere that couldn’t be more clear. When it comes to crisis management, you can either prepare your company or prepare your résumé.

Just five months after the data breach that compromised the privacy and security of 70 million Target customers, the retailer has ousted Gregg Steinhafel—the CEO who oversaw the security failure and served as spokesman as the crisis kept the company in prominent rotation in the 24-hour news cycle.

Like most organizations that experience a serious crisis, Target most likely thought they were prepared. Just six months before the attack, they had spent $1.6 million to better identify security compromises. It worked. As soon as the hackers installed the malware, the system detected it and their security company immediately notified Target’s team in Minneapolis.

Unfortunately, the Target team didn’t react. The moment of opportunity to avert the massive breach passed, and soon, customers’personal and financial information was pouring out of the network.

It is one of the most fundamental lessons of crisis management, and Target chose to learn it the hard way: There is a big difference between being prepared and being prepared to act. That lesson has now cost the company at least $160 million, a substantial decrease in year-over-year sales, and a staggering, perhaps even incalculable, loss in brand equity.

Most CEOs today recognize the importance of operational security, and the need to sufficiently protect the network and data. But investment in basic security best practices is not the same thing as crisis preparation. You confuse the two at your own risk.

It is not about how high you build the levees. It is about what you do when the floodwaters breach them. And without a serious crisis management and crisis communications plan in place, efforts to both contain and communicate the damage often prolong and intensify it.

That is arguably what happened with Target. Certainly, there is something admirable in Steinhafel’s willingness to accept responsibility and to embrace transparency. But during a crisis, a very delicate balance must be maintained.

It is one thing to be transparent. It is another to have the CEO feeding the 24-hour news cycle with new daily headlines. Yes, err on the side of disclosure, but your organization’s communications spokesperson (that can be read as “not the CEO”) should avoid making the kind of public statements that chum the media feeding frenzy with exactly the kind of bite-sized revisions that create fresh content.

The fact is, beyond basic information and timely updates, there is much less value in your statements than you imagine. We live in a time of deep skepticism of institutions. Consumers recognize that companies resort to boilerplate when they have something to hide. If your company is in the spotlight regurgitating cliches about “containing the damage”and “investigating the incident”and “best practices,”it will drive greater suspicion and scrutiny.

Assessment of your efforts should come from independent experts, not your company. Often, though, the most common thing to see during a crisis is the complete collapse or failure of effective stakeholder relationship management. Any good crisis management plan should include ongoing communications with stakeholders that can be called on during an incident and its aftermath. If you aren’t communicating with them during a crisis, rest assured the media will be.

The same is true for consumers, who are now the most trusted and influential voices of all. Build or improve consumer communication platforms so that they are in place and effective when needed most. Not only will platforms like e-mail and social media allow you to update customers without engaging media, it will also empower them as advocates across their own social and interpersonal networks. Effectively tracking those networks is extremely important—especially as the crisis arcs.

For those who have never experienced a crisis, it is hard to imagine the sheer velocity of the chaos that ensues once it arrives. Trying to create a crisis communications plan and simultaneously follow it is impossible, as Target recently found out. 

The time to build a crisis communications response plan is during peace time.  Who are your decision makers?  What are your company’s heritage and values that you will not compromise in your response?  Who are the stakeholders and audiences that will be impacted or have a public point of view?  CEOs would be wise to prepare such protocols now, before they find themselves in need of preparing their resumes.    

Sean Smith is a senior vice president at Porter Novelli, where he leads the global reputation management and crisis communications practice.