Sep 10, 2024 - Keep the Conversation Going: Communication in Incident Response

In today’s climate of persistent and evolving cybersecurity threats, the question may not be if you’ll face an attack, but when. That means having a detailed response plan in place is vital to your business’ ability to survive an incident. The Respond function of the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) provides a comprehensive guide to developing your own plan. One of the most crucial (and often overlooked) components of an effective response is a detailed strategy for both internal and external communication.

Let’s Talk About it: Communication’s Place in the Respond Function

The Respond function of the Cybersecurity Framework focuses on documenting, sharing, and even practicing the actions every member of the team will take when a cybersecurity threat is detected. While the Respond function encompasses a range of disciplines, including Response Planning, Analysis, Mitigation, and Improvements, Communication serves as the glue that binds the whole thing together.

The Importance of Internal Communication

When an attack hits, effective communication across your entire organization is essential. A well thought-out plan can ensure everyone knows what’s happening, who’s responsible for what, and the specific actions they need to take. Good communication enables everyone to coordinate their efforts, and guards against overlapping or omitting important tasks. An effective internal communication plan should include instructions for the incident response team, IT and security personnel, and executive leadership. Let’s take a closer look at each of those elements.

1. Incident Response Team Communication

Typically, an incident response team is made up of individuals from various departments, which can include IT, cybersecurity, legal, and public relations. Clear and consistent communication within the team can ensure that everyone is on the same page, and that all actions are aligned with the overall response plan. During the response process, it’s important to conduct regular briefings to keep all members informed of the latest developments and determine if any adjustments need to be made to the response strategy as it proceeds.

2. IT and Security Personnel Communication

Serving as a sort of “sub-team” within the larger incident response team, your IT and security personnel serve as the front line of your response to a cybersecurity incident. Effective communication between these groups is critical to quickly and accurately identify the scope and nature of the incident, implement containment measures, and restore affected systems. Team members should keep each other informed – in real time – about threat intelligence, system vulnerabilities, and the status of mitigation efforts.

3. Executive Leadership Communication

During a significant cybersecurity incident, it’s important that a designated member of the incident response team keeps executive leadership informed of the situation and the response as it progresses. This includes providing regular updates on the incident's impact, the actions being taken, and any potential risks to the organization's operations or reputation. Because executives may need to make decisions about resource allocation, public communication, or legal actions, timely and accurate information is essential.

The Importance of External Communication

The impacts of a cybersecurity incident often aren’t limited to the organization. That’s why an external communication plan is a key component of the Respond function. The manner you share information externally can have a significant impact on your organization's reputation and on the overall effectiveness of your incident response. Depending on your specific situation, your external plan could designate individuals to communicate with customers, partners, regulators, law enforcement, and even the general public, if necessary.

1. Communication with Customers and Partners

Because your customers and business partners can be directly (and significantly) affected by a cybersecurity incident, it’s important to communicate with them in a timely, transparent manner. This includes quickly notifying them of the incident, providing information on how it may impact them, and offering guidance on any steps they should take to protect themselves and their sensitive information. Clear and honest communication can help maintain trust, protect relationships, and prevent the spread of damaging misinformation.

2. Communication with Regulators and Law Enforcement

Depending on the type of incident you’re dealing with, its scope, and the potential damage it might cause, you may need to communicate with regulators and law enforcement. This is particularly important in cases where the incident involves sensitive data or could have legal implications. It’s a good idea to have pre-established protocols for reporting incidents to the appropriate authorities and to ensure that all information you share is accurate and complies with any relevant legal requirements.

3. Public Communication and Media Relations

In the age of social media and 24-hour news cycles, the way your organization handles public communication during a cybersecurity incident can have a lasting impact on the company’s reputation – and even its livelihood. A well-thought-out external communication plan should include key messages, designated spokespeople, and strategies for managing media inquiries. While transparency is important, it’s essential to balance it with the need to protect sensitive information and avoid making the situation worse.

Say What? When and How to Share Information

The timing and the methods you use to share information during a cybersecurity incident are critical factors that can influence the outcome of your response effort. Here are a few best practices that can help guide your internal and external communication strategies:

1. Timely Communication

Your team should share Information with relevant stakeholders as soon as it’s verified. Delays in communication can lead to confusion, speculation, and a loss of trust. At the same time, it’s important to avoid premature communication that could spread incomplete or inaccurate information. Prioritizing speed and accuracy can be tricky, but it’s also vital.

2. Clear and Consistent Messaging

All communications should be clear, concise, and consistent. This includes using plain language that non-technical audiences can easily understand and ensuring that all messaging aligns with your overall incident response strategy. Consistency in communication helps prevent mixed signals and reinforces your organization's credibility.

3. Controlled Information Flow

While transparency is important, you’ll also want to control the pace at which you share information. Too much information too quickly can lead to the spread of sensitive details which could make the incident worse, and even provide attackers with additional leverage. Your communication plan should designate specific individuals or teams to manage all communication efforts and ensure that all information is vetted before being released.

4. Regular Updates

Stakeholders should receive regular updates as the situation evolves. Updates should provide new information as it becomes available and revise previous statements to reflect any changes in the situation. Consistent updating helps maintain trust and shows that you’re actively managing the incident.

The Time is Now: Building Your Communication Plan

Given the critical role of communication in incident response, it’s essential to develop a comprehensive communication plan as part of your overall incident response strategy. Your plan should outline the key stakeholders, communication channels, and messaging strategies you’ll use during an incident. It should also include contact information for all relevant parties, a schedule for ensuring that information is up-to-date, and pre-drafted templates for the types of communications you’ll utilize.

As the NIST Cybersecurity Framework's Respond function emphasizes, a communication plan isn’t just a “nice to have.” It’s a foundational element that can determine the success or failure of your overall incident response effort. By prioritizing both internal and external communication, you can ensure that you’re able to respond to cybersecurity incidents in a coordinated, efficient, and effective manner which can help minimize the impact, protect your organization's reputation, and build trust with stakeholders.

Join us for the next session of our Cybersecurity Webinar Series: 

You're invited to join us on September 26th at 1:00 PM EDT for "Respond: How to Ensure Business Continuity with Effective Incident Response".