A communication plan defines how cybersecurity information reaches the people who need it. For routine security reporting, messages should connect metrics to each audience’s business priorities. During an incident, the plan must also specify who communicates, how information is shared internally and externally, and what may be disclosed. section 4.3.3 section 9.2
Make the plan usable before it is needed:
- Identify audiences and the decisions they face. Finance may need cost reductions and return on investment; operations may need downtime and incident-response measures. Use clear language and visuals rather than unexplained technical metrics. section 4.3.3
- Assign responsibilities. A senior security leader informs executives and the board; security managers translate findings; technical staff supply reports and dashboards. Communications teams may help with messages to customers, partners, regulators, or the public. section 3.2.6
- Prepare reliable channels and backups. Incident response team members should have multiple ways to communicate and a fallback person if a primary member or channel becomes unavailable. section 9.2 section 9.6
- Set disclosure boundaries and account for applicable notification requirements. After an incident, review what worked and incorporate lessons into training and exercises. section 9.2 section 9.6
Test the plan with a ransomware scenario
In a tabletop exercise, an attack escalates and a journalist asks for comment. The team must decide how to update internal and external stakeholders, who handles the inquiry, and how to prepare a public statement. The exercise exposes communication decisions that are easier to resolve before a real incident. section 9.3.1
