Communications and information
Google's guide treats keeping users, stakeholders and leaders informed as just as important as the technical mitigation. Consistent updates at the right level of detail build trust.
What every update answers
- What is affected: systems, data, locations, people.
- How bad it is: impact now, and whether it is growing.
- What people should do: workarounds, password resets, channels to avoid.
- When it will be mitigated and resolved, or when the next update comes if nobody knows yet.
The communications plan
The communications plan says which channel carries what, who is on it, and how anyone confirms who they are talking to. Planning writes it. Logistics stands it up. The IC approves it with the IAP.
Example
| Purpose | Primary | Backup | Owner |
|---|---|---|---|
| Command bridge | Standing conference line | Out-of-band chat room | IC |
| Operations | Out-of-band chat, one room per group | Conference line | Operations |
| Executive updates | Scheduled call plus written status summary | Phone tree | Public Information |
| Legal and privileged | Counsel's own channel | Phone | Legal advisor |
| Outside parties | Named contacts by phone and email outside the affected domain | Liaison's mobile | Liaison |
Out of band
Assume the attacker can read corporate email and chat until scoping shows otherwise. Run the response on accounts outside the affected identity provider, verify each member by voice before adding them, and keep the roster somewhere offline. Say out loud when the incident moves channels, and why.
Cadence
Executives get the status summary at fixed times set in the IAP. Every update ends with the time of the next one, including updates with nothing new. A fixed cadence cuts interruptions to responders more than any other single measure.
One voice
Everything leaving the incident goes through the Public Information Officer, drawn from the same status summary and cleared with counsel where it could create legal exposure. Responders asked by anyone outside the organization send them to Public Information or Liaison.
Common operating picture
NIMS calls it the common operating picture: one shared view of the incident that everyone works from. Planning's Situation unit owns it. In cyber it is the status summary, the attack timeline and the scope list, kept in one place, timestamped, and read by incident command, the crisis team and the executives alike. Anyone who needs a number takes it from there.
Writing it down
- Plain language. No acronyms outside the glossary.
- Every time with its timezone.
- Requests and decisions that must survive the incident go on a general message (ICS 213).
- Everyone in a role keeps an activity log (ICS 214).