CYBER SECURITY INCIDENT MANAGEMENT GUIDE

01 PREPARING FOR A CYBER SECURITY INCIDENT 17
THE IMPACT OF THE INCIDENT WILL DETERMINE THE
COMMUNICATION OBJECTIVES
In order to know what to communicate to whom, an organisation should assess the
(potential) impact of the cyber security incident: e.g. are only internal or also external
stakeholders concerned? Is there a data leak? Depending on this impact, your cyber
security incident communication will have different objectives, for example:
COMMUNICATION THAT AIMS TO
RESOLVE & HANDLE THE INCIDENT
Communication with other internal
teams or with third party incident
response teams
COMPLIANCE-DRIVEN
COMMUNICATION
Communication of the incident to
affected customers, communication
towards industry regulators
COMMUNICATION THAT AIMS TO
LIMIT REPUTATIONAL DAMAGE
Communication with customers,
partners and media, but also
communications with internal staff.
ENSURE MULTIPLE COMMUNICATION CHANNELS ARE AVAILABLE
The incident could impact existing communication channels (e.g. compromise e-mail
systems). As an organisation, alternative, secure communication channels should be
available. Several communication methods are available and it is up to the organisation
to select the method most suitable for a particular incident.
A best practice used by many organisations is to use a conference bridge number
that can be set up instantly. The incident response team and all stakeholders should
be informed about the access numbers but not about the control number necessary to
set up a conference. This is typically done by a crisis manager who is responsible for
managing, controlling and organising crisis calls.
POSSIBLE COMMUNICATION METHODS
• Email (preferably using PGP for confidentiality and
integrity of communications)
• Website (Intranet for employees, public web site,…)
• Telephone calls
• In person (e.g., daily briefings)
• Paper (e.g., post notices on bulletin boards and
doors, hand out notices at all entrance points).