Crisis communication and security culture

Audiences and obligations

• Employees: what happened, what to do and not do, and where to ask. Silence breeds rumor.
• Customers and partners: what is affected, what they should do and when you will update them next.
• Regulators: many laws require notification within a set time after you become aware of certain breaches, especially of personal data. Know the deadlines in your jurisdictions before an incident.
• Executives and the board: impact, decisions needed and the current plan.
• Law enforcement, insurers and vendors, as appropriate.
• The public and the press, through one designated spokesperson.

Principles

• Be honest and timely: say what you know, what you do not know yet, and when you will update. Do not guess, and do not hide.
• One source of truth and one voice: all external statements are approved by legal and communications and consistent with each other.
• Do not blame: not the attacker's cleverness, not the employee who clicked, not the vendor, until facts are established.
• Give people something to do: concrete steps (change passwords, watch for fraud) beat generic reassurance.
• Update on a promised schedule, even when the update is that nothing has changed.
• Prepare: templates, contact lists and decision rights written in calm times and rehearsed in tabletop exercises with executives.

A message skeleton

Subject: Security incident affecting [service]

What happened: On [date] we detected [plain description]. We [contained it on date].
What information was involved: [specific categories; say what was NOT affected, only if confirmed].
What we are doing: [containment, investigation with external experts, improvements].
What you can do: [concrete steps].
What happens next: we will update you by [date/time]. Contact: [channel and name].
We are sorry for the concern this causes.

Culture decides the first hour

• Blameless reporting: people who report a mistake quickly must be thanked, not punished. The first report is often what saves the day.
• Make the secure way the easy way: tools and defaults, not long policies nobody reads.
• Security champions in engineering and business teams, who bring security closer to daily work.
• Short, relevant, respectful awareness content that explains why, using real examples from your company.
• Leaders model the behavior: executives follow the same rules (MFA, reporting, approvals).
• Measure culture: report rates, time to report, participation in exercises, and survey trust in the security team.