In the wake of a cybersecurity incident, quick and effective communication is critical for any organization. Such communication requires a coordinated effort between the incident response team and various internal and external stakeholders. An incident response communication plan is an essential component of any organization’s broader response plan, which guides and directs these communication efforts.
To ensure a successful incident communication plan, organizations should develop a crisis communication plan during calm periods. Attempting to make important decisions in the midst of the high-pressure environment surrounding a security incident can lead to disastrous outcomes. Here are five actions organizations can take to ensure their incident communication plan is as effective as possible.
1. Formalize the Incident Response Team Activation Process
The first crucial communication that takes place after a security incident is the activation of the incident response team. Any employee suspecting a security incident should contact the organization’s security operations center (SOC) or other designated 24/7 monitoring point. The SOC should follow a standard triage process to determine whether the event warrants the activation of the full incident response team.
In cases where the SOC determines team activation is required, organizations should consider adopting an alerting mechanism like PagerDuty or Opsgenie. These tools manage on-call schedules, trigger alerts through multiple communication channels, and provide responder status information. By offloading these tasks to a dedicated platform, the burden on SOC analysts reduces, and the incident response team convenes faster.
2. Designate a Point Person for External Communication
As soon as word of a security incident leaks, external stakeholders will begin clamoring for information. The incident response team will be bombarded by requests from customers, the media, regulators, and other stakeholders. Crisis communication requires a coordinated response to control rumors and ensure the organization presents a clear and consistent message across communication channels.
To provide this consistent and coordinated view of the incident to external stakeholders through regular updates, enterprises should create a communication role on their incident response team. This person may not be a deeply technical team member but should have enough familiarity with technical concepts to serve as both a translator and filter for the technical information emerging from the response team.
3. Create Criteria for Law Enforcement Involvement
Two of the most critical decisions facing an incident response team are whether it’s appropriate to involve law enforcement and when notification of law enforcement should take place. These are difficult decisions because law enforcement involvement often changes the nature of an investigation and increases the likelihood of public attention. On the other hand, law enforcement personnel have access to investigative tools, such as search warrants, that are unavailable to internal teams.
Incident response communication plans should address this quandary by outlining clear criteria for when the team should notify law enforcement. The plan should also identify who on the team has the authority to make that determination and what internal notifications should take place before involving law enforcement.
4. Develop Communication Templates for Customer Outreach
Many security incidents require some level of communication with customers or the general public, and any incident response communication plan should account for this. This might be a required notification in the wake of an unauthorized release of personally identifiable information, or it might be an explanation to customers of a service disruption.
To develop preapproved incident response communication templates that clear the hurdles in advance, leaving the incident response team to fill in the blanks and tweak template language. The teams should regularly monitor their social media mentions and provide a coordinated response to control rumors and ensure the organization presents a clear and consistent message across various communication channels.
5. Monitor Social Media
Social media is an extremely important channel of communication between many organizations and the general public. Customers are quick to publicly express their concerns with an organization by tweeting or posting a public tongue-lashing. It’s crucially important that companies regularly monitor their social media mentions, particularly during a crisis.
Social media feeds can provide the incident response team with a quick read on customer sentiment and serve to trigger rapid intervention if rumors start to spiral out of control. In addition, social media reports may provide the team with important indicators of service performance, information disclosures, and other facts that might shape their response priorities.
Effective communication is an essential component of a strong response to a significant cybersecurity incident, such as a data breach. Solid incident communication plans provide mechanisms for rapidly notifying stakeholders, coordinating both internal and external communications, and monitoring customer sentiment. These tools improve the organization’s ability to respond to a crisis and help minimize reputational damage.