Tools · Incident response playbooks · 03 / 20
Incident communication plans: who to tell, when, and through which channel
Define internal roles, update cadence, out-of-band channels, and approval paths for external statements, so communication helps the response instead of leaking or confusing it.
Roles
The incident commander coordinates and decides. A communications lead writes updates and handles stakeholders. Technical leads run investigation and containment. Legal and privacy advise on notification duties. Executives receive concise updates and make business decisions. Keeping these roles separate stops the commander from spending all day answering messages.
Channels and cadence
Assume the attacker may read corporate email or chat if accounts are compromised. Set up an out-of-band channel in advance, such as a separate chat workspace or phone bridge with accounts not tied to the main identity provider. Send updates on a fixed cadence, such as every two hours for SEV-1, even if nothing changed, so people stop asking.
Status update template Incident: IR-2026-014 Severity: SEV-2 Time: 14:00 UTC What we know: ... What we are doing: ... Impact to users/customers: ... Decisions needed: ... Next update: 16:00 UTC
Lab: draft three messages
For a scenario where a customer database was accessed by an unauthorized party, draft three messages: an internal update to employees asking them not to discuss it externally and how to report suspicious activity, an executive briefing in five bullet points, and an outline of a customer notice for legal review. Note which facts each audience needs and which details should not be shared yet.
External communication
Regulators, customers, partners, law enforcement, and the press each have different needs and, sometimes, legal deadlines. All external statements go through legal and communications approval. Avoid speculation; state what is known, what is being done, and what affected people should do.
Diagram
Ad hoc versus planned communication
Plans prevent leaks and confusion.
Channel. Same email system the attacker may read
Cadence. Whenever someone asks
External statements. Whoever is asked first answers
Channel. Pre-arranged out-of-band workspace
Cadence. Fixed schedule by severity
External statements. Approved by legal and communications
Check yourself
1. Why prepare an out-of-band communication channel?
2. Which role should handle stakeholder updates so the incident commander can focus?
3. Who should approve a public statement about a breach?