Communication, Coordination, and Reporting
The human side of response
Technical skill fails without coordinated communication. You must understand internal (incident commander, executives, legal, HR, IT ops) and external (customers, regulators, law enforcement, partners, media) communication streams, each with defined owners and cadence. A communications lead centralizes messaging to prevent conflicting statements.
Concepts to master
- Need-to-know and confidentiality: share details on a controlled basis; assume messages may be disclosed.
- Regulatory and contractual reporting: breach notification laws, sector rules, and contract clauses impose deadlines. Know that timing and content are often legal-driven.
- Status reporting cadence: regular updates with known facts, unknowns, and next actions - separate fact from speculation.
- Single source of truth: one incident log/timeline that all responders update.
- Out-of-band channels: use pre-arranged secure comms if primary systems are compromised.
- Stakeholder management: executives need impact and decisions, not packet captures.
Traps in questions
A frequent trap is premature public disclosure or speculation before facts are confirmed. Another is assuming the technical lead should handle all external communication - usually a designated spokesperson and legal counsel do. Watch for questions that treat regulatory notification as optional or as purely technical.
Rule of thumb
Communicate on a schedule, not on emotion. Separate confirmed facts, assessments, and unknowns, and route external messaging through the designated owner and legal review.