UK: NCSC issues guidance on effective communication during a cyber incident | DLA Piper

[co-author: Morven Henderson]

Planning and developing an effective communications strategy is a crucial step in preparing for a cyber security incident. Last week, the UK's National Cyber ​​Security Center published guidance on communicating with stakeholders before, during and after a cybersecurity incident. The guide is aimed at organizations of all sizes and sets out three key principles to follow.

1. Prepare your communication strategy in advance

A cyber incident can affect any company, regardless of size, at any time. The NCSC therefore advocates a proactive strategy that can be used when necessary to mitigate the impact of the incident.

Steps to consider include:

• Appointing an official spokesperson for the organization when communicating with stakeholders such as media, customers and employees.
• Identify key stakeholders in advance. Who needs to be informed and how will this be achieved (taking into account that the usual channels may not be available)?
• Draft and agree on pre-approved communication templates. While there is no one-size-fits-all solution, this can include styled media requests, internal updates to staff, and notifications to customers, customized as needed. Designing these templates in advance will save you time and ensure the organization speaks with a unified voice.

The NCSC emphasizes the importance of regularly testing the strategy through tabletop exercises and simulations to ensure its effectiveness and identify any areas where changes or improvements are required.

2. Communicate clearly and adjust your messages when necessary

The NCSC states that communication should be “clear, consistent, authoritative, accessible and timely.” It is also important that any communications published before, during or after a cybersecurity incident inform those involved while maintaining reputation and credibility. Factors to consider include:

• The information provided to those involved must be clear but balanced to ensure that no information is disclosed that increases the risk to the victim or that risks having to be subsequently withdrawn if the incident develops. It is important to ensure that the communication strategy fits key stakeholders and that specific concerns of each group are addressed.
• The impact of the incident should be reflected in communication with those who suffer the consequences, acknowledging the practical consequences rather than focusing solely on technical details.
• Developing a question-and-answer document should be an early priority in incident response: Preparing responses to common stakeholder requests in advance enables a consistent response and provides assurance that communications address important and recurring concerns.

3. Manage the consequences

Finally, the NCSC Guide encourages organizations to think long-term. While the focus is on an immediate response after an incident, consider what the approach will be in the weeks and months afterward, depending on recovery time. How regularly will you provide updates? How are incidents and subsequent responses used to inform future preparation and lessons learned?