The technical aspect of incident response can be immense. In extreme scenarios, such as the NotPetya incident in 2017, global organisations such as the shipping company Maersk found the speed and scale of the malware’s impact to be unlike anything they’d seen before.
Computer screens turned black. Employees sprinted through the offices demanding that colleagues disconnect their devices. Almost immediately, the infrastructure and systems underpinning a vast network of port operations, vessels and cargo movements had become inaccessible. The task of understanding what had happened, rebuilding and launching some kind of fallback operation was simply enormous.
But this is just part of the operational response. There is another part that is so often undervalued that organisations often find themselves having to work on in the most pressured and intense moments of crisis response: communication.
When considering the impact of an incident, and how that can be positively impacted, of course the technical and operational response plays a huge part. However, communications – done in an honest, transparent, consistent and authentic way – can also play a significant role both in the resilience of an organisation and the attitude, understanding and reaction of an organisation’s key stakeholders.
It is precisely this capability, however, that is often overlooked: in terms of preparedness; practice; and the appropriate skills and training.
Organisations do not enter a crisis with a blank slate
Customers, employees, regulators and the media will interpret an incident through what they already know or believe about the organisation involved, and their relationship to it. Its record on customer service, transparency and accountability will shape whether its early statements are trusted or tolerated and whether it is given the benefit of the doubt.
Trust cannot suddenly be manufactured when systems go down. It is accumulated over years but can be lost in hours. This was one of the key messages that came across from cyber leaders when interviewed for Communicating Cyber Risk. Crisis communication should therefore be understood as an extension of how an organisation behaves and communicates in normal times, rather than as a separate capability activated only when something has gone wrong.
The UK’s National Cyber Security Centre (NCSC) makes this connection explicit. Its guidance argues that communicating with stakeholders throughout an incident can reduce its short-term impact, build customer trust and limit longer-term harm. It also recommends preparing a communications strategy before an incident, including identifying audiences, agreeing responsibilities and considering which channels will remain available if normal systems are compromised.
From good practice to governance requirements
This is increasingly more than operational guidance. Across different jurisdictions, governments and regulators are making incident reporting and cyber risk governance more formal, more time-sensitive and more visible to senior leaders.
In the United States, Securities and Exchange Commission (SEC) rules require listed companies to disclose material cyber incidents within four business days of determining that they are material. The rules also require companies to describe their processes for managing material cyber risks and the board’s oversight of them. Significantly, disclosure may be delayed where the US Attorney General determines that it would create a substantial risk to national security or public safety.
In Europe, the NIS2 framework has strengthened incident-reporting and cyber-risk-management obligations across critical sectors. The direction of travel is clear: communication during an incident is no longer simply a matter for public-relations teams. It is becoming an essential part of governance, regulatory compliance and national resilience.
Yet policymakers and boards should be careful not to confuse faster reporting with effective communication. An organisation may meet a statutory deadline while still leaving its employees confused, its customers exposed and its technical teams overwhelmed by competing demands for information. Regulation can compel disclosure, but it cannot manufacture clarity, judgement or trust.
Policy should therefore place greater emphasis on communication readiness. Sector exercises and regulatory stress tests should examine whether organisations can coordinate messages, reach affected groups, operate through secure alternative channels and communicate responsibly when information remains incomplete.
One incident, multiple audiences
Preparation should begin by recognising that there is no single audience. Employees need to know what has happened, what they should do and where reliable information can be found. Customers will be concerned with the consequences for them: whether services remain available, whether their information is at risk and what protective action they should take. Regulators require accurate, evidence-based reporting within prescribed timeframes. The media will seek clear explanations and visible accountability.
The detail and tone may differ, but the core facts must remain consistent. Anything said internally should be assumed eventually to become public. Organisations therefore need a central spine of agreed messaging that can be adapted for different audiences without producing contradictions.
Timing and sequencing are critical. Employees and those directly affected should not discover the incident through a news report. Regulators should hear from the organisation rather than from journalists. Customers should receive practical information before being confronted with technical explanations. The media should have access to a clear, authoritative source rather than being left to assemble the story from leaks, rumours and external commentary.
Communicating without certainty
None of this means waiting until every fact is known. During the early stages of an incident, certainty is often impossible. An effective initial communication can simply explain what is known, what remains unknown, what the organisation is doing and when further information will be provided.
Acknowledging uncertainty is generally more credible than filling an information vacuum with premature assurances that may later have to be withdrawn. Early communication does, however, create an obligation to return with meaningful updates. Organisations must be prepared to communicate repeatedly as their understanding changes.
Communication is also essential inside the response itself. The Bank of England’s 2024 CBEST findings identified inadequate communication channels during incident response as a recurring weakness. Where attackers retain access to the network, they may be able to observe how an organisation is coordinating its containment activity. Secure, alternative communication channels are therefore not merely a public-relations consideration; they are part of the operational response.
Preparedness must be practiced
In practice, this means bringing technical, legal and communications specialists together before a crisis occurs. Organisations should agree roles, escalation routes and approval processes; maintain secure contact lists and alternative channels; prepare adaptable holding statements; and decide who will speak at different stages.
Most importantly, they should test these arrangements through realistic exercises. Such exercises should create pressure, uncertainty and imperfect information. They should ask leaders to make decisions without waiting for a complete technical picture. They should test whether communications can still be approved if email is unavailable, whether the organisation can reach employees quickly, and whether senior leaders can explain the incident in language that customers will understand.
Communication is therefore the means through which leadership becomes visible, uncertainty is managed and trust is protected. Organisations that recognise this before a crisis will be far better placed to withstand one when it arrives.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
