What’s the difference between an incident response plan and a communication plan?

Your organization’s cybersecurity breach communication plan works in tandem with an incident response plan to make sure decision makers have the information they need to resolve the incident. In short, your cybersecurity breach communication plan is one (very important) part of your overall incident response plan, which helps guide actions beyond communication.

Know when and how to escalate your response

Your cybersecurity breach communication plan should also guide when you communicate the incident to legal counsel and higher-level executives. For example, a single user with one compromised workstation is usually not CEO or board level news. However, having fifty impacted users across the organization is worthy of executive attention. Similarly, the release of two members’ personal data may not require escalation but the release of a thousand members’ data would be. This is where having pre-defined escalation situations in your plan helps.

Different incident types also have different communications needs. For example, a computer virus spreading through your system should be communicated internally as quickly as possible to prevent the virus from spreading further. The same sense of urgency holds for an email phishing scam that may be sending fake email from one compromised account to others. However, a data breach may not call for an organization-wide notification unless there’s a specific need for people to know.

A cybersecurity breach communication plan (along with a larger incident response plan) helps you identify in advance who is responsible for communicating what information to whom. That way, you avoid having to come up with a plan on the fly which can lead to chaos and confusion.  

Affected members

In some states there are specific laws about how the members must be contacted, for example, requiring letters to be mailed. Other states may allow phone calls to affected users in addition to emails, or simply allow you to post a notice on your public web page. There are also state-by-state laws about how much time you have to notify members, with some states requiring shorter notification deadlines than others. Sixty days is the average, but it’s in your best interest to communicate as quickly as possible to avoid potential fines, penalties or the dreaded class-action lawsuits that often accompany them. A good incident response plan should have member notification deadlines listed and sample templates to use for each type of required communication.

While preparing to notify affected members, you should also prepare your help desk to handle the flood of expected calls. Provide a summary of information about the incident and a list of standard answers to help desk personnel for when the calls begin. The goal is to calm your members while providing important details they might need, such as how to enroll in credit monitoring if the incident resolution calls for that.

Regulatory agencies

Regulatory agencies have similar stipulations as affected members. Different states have different rules, federal agencies have different rules than the states, and there are differing deadlines. Do your research and get these notifications right because the regulatory agencies can fine you very large sums of money for very minor infractions.

Your insurance company

You should also reach out to your cyber insurance provider. These companies usually have staff to assist with resolving the incident and a communications approach mapped out for moving forward. And since the insurance company is on the hook for many of the costs incurred once they have been notified of the incident, you should let them guide the resulting recovery and response activities (once those activities have been vetted by your legal counsel).

Law enforcement

Take advantage of legal counsel in order to follow the law. In some incidents, senior leadership may attempt to squelch investigation to avoid negative publicity. If law enforcement communication is required, (for example, if a disgruntled employee stole and sold member data,) then legal counsel is responsible for protecting the organization from accidental disclosures of information while also providing the data needed for the law enforcement agents to do their jobs.

The media

Make sure to control your messaging. You’ll need designated public relations specialists to speak with the media, letting other employees know they shouldn’t provide comments or contact the press. One reason why you need strict control over your messaging is because certain words, such as “breach,” “PII,” and “PHI” carry statutorily-defined legal meanings. Admitting to them could have legal consequences, which is why it’s best to let the PR professionals deal with reporters.

You can’t resolve your cybersecurity breach without communication

There are many types of communications required for cybersecurity incidents, and nuances for each message. The recurring theme is that your incident response plan should include a cybersecurity breach communication plan to help you navigate the correct approach to this important topic.