Three vendor responses arrive on the same afternoon. All three say multi-channel. All three say real time. All three promise a full audit trail, and all three attach a feature matrix with a tick in every row.
That is the moment most procurement decisions go wrong, because the questions were too easy to answer. A supplier can say yes to multi-channel while sending four messages that all arrive on the same phone. A supplier can say yes to reporting while producing a spreadsheet that shows what was sent and not who read it.
Take an illustrative case, invented to make the point rather than drawn from a customer. A regional transport operator has depots in four countries, 2,800 staff, and a mix of office workers, drivers and contract cleaners. Its resilience manager has run two live incidents in the past year. Both times the alert went out inside three minutes. Both times nobody could say, an hour later, how many drivers had seen it.
That gap is what the ten checks below are built to expose. They come from the questions buyers ask after a near miss rather than before one, and the useful part is not the check itself. It is what a weak answer sounds like.
Knowing how to choose a mass notification system means testing each claim against the one thing that decides whether an alert worked, which is whether the right people acted on it.
A Mass Notification System Is Not A Bigger Group Text
A mass notification system is software that sends one urgent message to many people at once across several channels, confirms who received it, and keeps a timestamped record of both. The category is sold as mass notification software, and the sending part of it is the commodity. The confirming and the record are what separate a system from a distribution list.
Group texts, email blasts and staff WhatsApp groups can distribute information, but they do not usually provide a central record of which named employees acknowledged an alert or who may still need assistance. This can make it harder to reconstruct and evidence how an organisation communicated during an incident. Public systems work differently again. GOV.UK’s Emergency Alerts service can sound a siren-like tone on a phone set to silent, holds it for about ten seconds, and targets people by their current location, which is a capability built for governments warning the public rather than for an employer reaching named staff.
Choosing A Mass Notification System Is Not A Feature Comparison
Buyers compare channels. Incidents are lost in the last six feet, between the message arriving on a device and a person doing something about it.
A message that is delivered has reached a handset. A message that is acknowledged has reached a person who pressed something to say so. Those are different events, they are logged differently, and only one of them tells the incident lead anything useful. Most shortlists treat them as the same word.
There is a whole separate question behind this, which is why alerts get ignored, and how to test for it even when the sending works perfectly. The checks below assume the sending works.
The transport operator in the illustration is the example. The send log showed 2,800 messages delivered in under three minutes, which looked like a success until somebody asked how many drivers had confirmed. The platform had no answer, because it had never been asked to collect one. Delivery was all it measured.
So the ten checks below are weighted towards what happens after the send. Six of them are about confirmation, record-keeping, escalation and proof. Four are about reaching people in the first place.
How To Choose A Mass Notification System: The Ten Checks
Work through these in a scripted demo, with the vendor driving and somebody from the resilience team timing it. Ask for the thing to be done live rather than described. Choosing the right system comes down to what you insist on seeing, rather than what a vendor promises. If the shortlist is already drawn up, comparing platforms side by side is a faster way to find the gaps than reading three feature matrices.
1. Does It Support Genuinely Separate Channels?
Ask for one message to go out by SMS, voice call, email, push notification and a desktop or web alert, and ask which of those depend on the same infrastructure. Four channels that all rely on a data connection are one channel wearing four hats. The practical differences between sending across several channels at once and sending the same way five times are worth reading before the demo.
A weak answer describes the channel list and avoids the dependency question.
2. What Happens When A Channel Fails?
Ask what the system does when the first channel gets no response. The useful behaviour is cascading: the alert moves to the next channel automatically, and keeps moving until somebody acknowledges.
A weak answer offers a manual resend. In a live incident nobody is watching a dashboard waiting to press resend.
3. Can Somebody Use It Under Pressure, First Time?
Ask the vendor to hand the console to a member of your team who has never seen it, and have them launch a pre-built scenario. Time it. Then ask them to do it on a phone.
A weak answer is a polished demo driven only by the vendor’s own specialist.
4. What Is Automated, And What Still Needs A Person?
Pre-built scenarios, saved recipient groups and ready-made message templates remove the worst task in an incident, which is drafting under pressure. Ask to see a scenario built from scratch and then fired.
A weak answer confuses automation with scheduling. Sending a message at 09:00 every Monday is not incident automation.
5. How Precisely Can You Target?
Ask to send to one depot, then to one shift, then to the on-call rota only. Targeting by site, department and rota covers most real incidents. Targeting by a person’s live location is a different and much harder capability, and it depends on data your organisation may not hold or may not be allowed to hold.
A weak answer promises geolocation without explaining where the location data comes from or how often it refreshes.
6. What Happens At Full Volume?
Ask what the platform does when every recipient is alerted at once, across every site, and whether throughput is contractual. Then ask what happens to the queue if a national network throttles SMS during a wide-area event.
A weak answer quotes a headline send rate with no reference to the conditions under which it holds.
7. Where Does The Contact Data Live, And Who Can See It?
Staff phone numbers are personal data. Ask where it is hosted, who inside the vendor can read it, how it is deleted when somebody leaves, and which certifications the vendor holds rather than claims. Ask for the certificate numbers.
A weak answer names a standard without naming the scope of its certification.
8. Can It Show You Who Did Not Respond?
This is the check that separates the shortlist. Ask for the report that lists, by name, everybody who received the alert and did not acknowledge it, and ask whether that report can be exported.
A weak answer shows aggregate delivery statistics. A count of 2,800 sent is not a list of the fourteen people nobody can find. The mechanics of proving who received a message are worth understanding before the demo, because the terms vendors use for it differ.
9. What Does It Connect To, And How?
Ask which systems feed it staff records, and which systems it can raise an alert from. Then ask for the integration to be named specifically. Standards matter here: the Common Alerting Protocol (CAP), published by OASIS, defines a shared format for alert messages. CAP support can help systems exchange structured alert information, but it does not automatically guarantee interoperability with public warning infrastructure. Ask the vendor which specific systems and integrations it supports, and request a demonstration.
A weak answer says it has an API and names no system.
10. Who Trains The People Who Will Use It At 03:00?
The person launching the alert will not be the person who ran the procurement. Ask what training comes with the contract, whether it is self-paced, and how a new starter gets competent without a consultant.
A weak answer offers a one-off onboarding session and a PDF.
| Check | Ask for this, live | A weak answer sounds like |
|---|---|---|
| 1. Separate channels | One alert across SMS, voice, email, push and desktop | A channel list with no dependency detail |
| 2. Failure behaviour | Automatic cascade until acknowledged | You can resend manually |
| 3. Usability | Your own colleague launching it cold, timed | A vendor-driven demo |
| 4. Automation | A scenario built and fired in the session | Scheduled recurring messages |
| 5. Targeting | One site, then one shift, then the on-call rota | Geolocation with no data source named |
| 6. Volume | Contractual throughput, plus carrier throttling | A headline send rate |
| 7. Security | Certificate numbers and hosting location | A standard named without its scope |
| 8. Non-response reporting | A named list of who did not acknowledge, exported | Aggregate delivery statistics |
| 9. Integration | Named systems in and out, and CAP support | It has an API |
| 10. Training | Self-paced material a new starter can complete | One onboarding session |
Two Different Jobs, Often Bought Together
Mass notification and crisis management platforms are often considered together, but they serve different purposes. Alerting reaches people and confirms they heard. Crisis management coordinates what happens next: who owns which task, what was decided, what the record says afterwards.
Plenty of organisations buy the first and discover they needed the second. The distinction between the two, and which one a given team actually needs, is set out on the Crises Control homepage.
Across Borders, Time Zones And Opt-In Rules
Choosing a mass notification system for a multi-country operation changes three of the ten checks. Contact data moves between jurisdictions, so check 7 becomes a legal question rather than a technical one. Consent rules differ, so a number collected lawfully in one country may not be usable for alerting in another without a fresh basis. And a wide-area event hits national carriers differently, which is check 6.
Scale introduces a quieter problem: who is allowed to press send. A global operator with depots in four countries cannot route every alert through one head office at 02:00 local time. Ask how sending rights are delegated by site, and what stops a local manager alerting 2,800 people when they meant to alert 40.
Sector rules narrow the list further. What matters when choosing a system for a school or college is not what matters when deciding what hospitals need from alerting, and both differ from a depot network.
Regulated premises in the United Kingdom have a requirement coming rather than one already in place. The Terrorism (Protection of Premises) Act 2025, commonly called Martyn’s Law, has passed, and the Security Industry Authority, named in the Act as its regulator, says it is expected to come into force in spring 2027 with the exact date confirmed beforehand. There is no obligation to comply until it commences.
What it will require of premises in scope, once it is in force, is worth reading now because it shapes the decision. Standard tier premises, where 200 to 799 people may be present, will need appropriate public protection procedures so far as is reasonably practicable. The Act names four: evacuation, invacuation, lockdown and communication. Communication is defined as ensuring information is provided to individuals at the premises, which is the one that touches this purchase directly. Enhanced tier premises, where 800 or more people may be present, will have additional duties. These include implementing public protection measures, documenting the relevant procedures and providing the required documentation to the Security Industry Authority. Organisations should check the SIA’s current guidance for the detailed requirements and any applicable exemptions.
So a purchase made now is a preparation decision, not a compliance one. No platform makes an organisation compliant with a law that has not started, and the SIA has said plainly that neither it nor the Home Office endorses specific companies or services for compliance. The useful question is whether a system will be able to evidence the communication procedure when the duty does start, which is check 8 again.
In the United States, buyers comparing systems against a published standard usually work from NFPA 72, the code covering fire alarm and signalling alongside emergency communications systems. Neither document tells you which platform to buy. Both tell you what you will be asked to show.
Where Ping Fits, And What It Leaves To You
Crises Control is an Operational Incident Coordination Platform, and Ping is the mass notification software inside it. It reaches people through SMS, voice calls, email, push notifications, Microsoft Teams and web alerts, and recipients acknowledge with one tap. Alerts can be targeted at a specific group, such as a single site, a department or an on-call rota, which covers checks 1 and 5.
On check 2, Crises Control’s mass notification platform can be configured to cascade notifications across channels until recipients acknowledge, so the alert keeps moving without anybody driving it. On check 8, every delivery, acknowledgement and response is recorded into a communication history, and the reports export for audit. That is the list of who did not respond, which is the report most shortlists cannot produce.
When a message is not enough, Incident Manager activates predefined response plans with saved message templates, recipient groups and critical documents, and keeps a chronological record of communications, updates and decisions. Task Manager assigns, distributes, tracks and escalates the response tasks that follow. Training sits with the Crises Control Academy, which runs as self-paced units covering mass notifications, incident response and the mobile app, so check 10 does not depend on booking a consultant.
What the software does not do is decide what people should be told. It will not write the message, judge whether to evacuate, or choose who to wake up. Those stay human decisions, and a platform that claims otherwise is selling something else.
The Check Most Buyers Skip
Of the ten, check 8 is the one that gets left until last and the one that decides whether the purchase was worth making. If buyers ask only one question, it should be this one. Everything before it is about getting a message out, which most suppliers can do. Check 8 is about knowing whether it landed.
Finish the illustration. The transport operator runs its third incident on a platform that can produce the list. Fourteen people have not acknowledged, their names are on a screen within four minutes, and somebody goes to find them. Nothing about the alert is faster than the previous two. The difference is that the question has an answer.
Frequently Asked Questions
How do you choose a mass notification system?
Choosing a mass notification system starts with the ten checks rather than with feature matrices, and each one should be seen performed live rather than described. The decisive ones are whether the platform cascades automatically between channels when nobody responds, and whether it can produce an exportable list of the people who received an alert and did not acknowledge it. Most platforms send competently. Fewer can tell you who acted.
What is the difference between message delivery and acknowledgement?
Delivery means the message reached a device. Acknowledgement means a person confirmed they had seen it, usually by tapping a response. The two are logged separately, and only acknowledgement tells the person running an incident who is still unaccounted for. A platform that reports only delivery cannot answer the question that matters after an evacuation.
How many channels does a mass notification system need?
The number matters less than the independence. SMS, voice calls, email, push notifications and desktop or web alerts cover most workforces, but several of those fail together if they share one data connection. Ask which channels survive a network outage, and whether the platform moves to the next channel on its own when the first gets no response.
What should a mass notification system record for compliance?
It should hold a timestamped record of every alert sent, every delivery, every acknowledgement and every escalation, and it should export that record without a support ticket. Organisations working to a published standard or a statutory duty are generally asked to show what was sent, to whom, when it was confirmed, and what happened when it was not. Aggregate statistics rarely satisfy that.
How long should choosing a mass notification system take?
Allow longer for the evidence checks than for the channel comparison. Vendor responses on channels and speed can be assessed on paper in a week. Checks 7, 8 and 9, covering data location, non-response reporting and named integrations, usually need a second scripted demo and a conversation with the teams that own staff records, which is where most timelines slip.
This article was drafted with AI assistance and reviewed by the Crises Control team. Featured image: AI-generated.
