Home / Knowledge hub / Incident communications
Knowledge hub
Incident communications
Who says what, to whom and when, during and after an incident.
What it means
Incident communications is the plan and practice for telling people what is happening during a security incident. It covers the team doing the work, leadership, affected customers, partners, regulators and sometimes the public. Each group needs different detail, at a different time, from a named person.
The idea that makes it click: the incident has two problems, the technical one and the one in people's heads. Silence lets rumours fill the gap, while an early statement that turns out wrong damages trust twice. Good communication is accurate, timely, and clear about what is not yet known.
Why it matters
Customers judge you as much by how you told them as by what happened. A notice that is late, vague or contradicts a later one costs more trust than the flaw did. Staff who improvise on social media or in support tickets can also create legal problems.
There are fixed deadlines too. Under GDPR a personal data breach must be reported to the authority within 72 hours of becoming aware, where it is likely to risk people's rights. India's CERT-In directions require reporting certain incidents within six hours. Lawyers need to be in the loop early.
How it shows up
It shows up as a short internal update at fixed intervals, a holding statement for support staff, a customer notice, a regulator filing and a final summary. Templates written in advance save hours. One person approves every outgoing message, so facts match across channels.
Repeating mistakes: promising a cause before it is known, naming the wrong number of affected accounts, telling customers to do nothing when they should reset credentials, and writing in jargon. Rehearse it in a tabletop exercise and keep the contact list somewhere that still works if email is down. See also breach notification.
Questions people ask
Incident communications, answered
Who should speak for the company during an incident?
One named spokesperson, backed by one approver for facts. Technical staff feed them information but do not post their own versions.
Having a single voice keeps statements consistent across support, social media and press.
Should we tell customers straight away?
Tell them as soon as you know something they can act on or that the law requires, even if the picture is incomplete. Say what you know, what you do not, and when you will update them.
Guessing at causes before they are confirmed is the mistake to avoid.
What belongs in a customer breach notice?
What happened in plain words, what data was involved, what you have done, what the customer should do, and how to reach you. Leave out blame and technical noise.
Have legal review it, because the wording can have consequences.
How is this different from an incident war room?
The war room is where responders coordinate among themselves. Communications is what is said to everyone outside that room, and to leadership.
They need a link: the scribe's timeline is the source for what you can truthfully say.
Do we need this if we are a small company?
Yes, in a lighter form. A one-page plan with names, phone numbers, approvers and draft notices is enough to start.
Small teams are the ones most likely to make mistakes under stress because nobody has done it before.
Sources
Where this comes from
Related
Terms that sit next to this one
Incident response plan
A written plan for who does what in the first hours after a security incident.
Breach notification
Telling regulators and affected people about a data breach within a set time.
Incident war room
A single place and channel where responders coordinate during a live incident.
Tabletop exercise
A talk-through of an incident scenario to test the plan without touching systems.
Post-incident review
A blameless look back at an incident to improve the plan and the system.
What will you say in hour one?
If a flaw is found in your app, it helps to have a finding that shows exactly what was reachable, with the request and response, so your notice can be specific. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.