Communication, Coordination, and Reporting
Communication failures end more careers than malware does. This domain tests stakeholder mapping, message discipline, and the coordination mechanics that keep notifications accurate and timely.
Structure
- Internal: executives and the board need impact, business risk, decisions required, and the next update time - not packet captures. Technical peers need indicators, scope, and actions.
- External: regulators, law enforcement, customers, partners, insurers, and media. Route each through the owner named in the plan.
- Single voice: one designated spokesperson for media and one for regulators. Responders do not speak publicly.
- Cadence: commit to update intervals and keep them even when nothing has changed.
Mechanics that matter
- Use out-of-band channels when corporate email or chat may be compromised.
- Keep an incident communications log: who was told what, when, by whom, and what was requested back. This log is your defence when someone claims they were never informed.
- Coordinate with third parties - MSSPs, cloud providers, payment processors - early, because their notification clocks and evidence access differ from yours.
- Separate fact from assessment in every message: "we have confirmed X; we have not yet determined Y" prevents contradictions later.
Worked example
A retailer confirms card data theft. Legal advises that notification deadlines may apply; the spokesperson wants to reassure customers. The correct sequencing is: brief the executive team with confirmed facts and unknowns; engage outside counsel to direct the investigation and preserve privilege; notify the acquirer and card brands per contract; prepare a customer statement that says only what is confirmed and gives a next-update date; log each notification with timestamp and recipient. The customer statement never says "no other data was affected" before scoping is complete.
Traps
- Over-reassuring early; premature absolutes become the headline.
- Sending sensitive incident detail over the channel the attacker controls.
- Letting engineers speak to press, or lawyers write the technical brief.
- Missing a regulatory or contractual deadline because no one owned the notification list.
- Mixing privileged counsel-directed work with ordinary business records in one uncontrolled file.