By Cyber Defense Technologies October 22, 2026 4 min read
When a cyber incident becomes visible, technical teams focus on containment and recovery. At the same time, customers want to know if their data is safe, staff want to know whether they can work, partners want to know whether they are at risk, and regulators and contracting officers may need formal notice. Poorly handled communications can cause more lasting damage than the incident itself, through inaccurate statements, missed obligations or lost trust.
Good incident communication is planned before it is needed.
Decide who decides
Incident response plans often describe technical roles in detail and leave communications vague. Settle in advance:
- Who approves external statements, typically a senior executive with legal and communications input.
- Who speaks for the organization, so customers and media hear one consistent voice.
- Who owns each audience: staff, customers, partners and suppliers, regulators, government customers and the media.
- Who tracks notification obligations and their deadlines.
Keep contact details for these people, and for outside counsel and incident response support, somewhere that does not depend on systems that may be down.
Accuracy over speed
Early in an incident, almost everything is uncertain. Initial assumptions about the cause, the systems affected and whether data was taken are frequently wrong. Statements such as "no customer data was affected" made on the first day can be very difficult to walk back.
Say what you know, say what you are doing, and avoid speculation. It is acceptable to say that the investigation is ongoing and that you will provide updates.
Use holding statements
Prepare short, pre-approved holding statements for likely scenarios, such as a service outage, ransomware or a suspected data exposure. A holding statement typically:
- Acknowledges that the organization is responding to a cybersecurity incident.
- Describes the immediate effect on services, if known.
- Explains what people should do, such as watching for suspicious messages.
- Commits to further updates and says where they will appear.
Having drafts ready means the first statement can go out quickly without being written under pressure.
Staff come first
Employees will hear about an incident quickly, and they will talk about it. Give them clear guidance on what is happening, what they should and should not do, how to report suspicious activity and how to answer customer questions. Remind them not to post about the incident publicly. If email or chat may be compromised, use alternative channels agreed in advance.
Contractual and regulatory notification
Formal notifications run on their own timelines and requirements, separate from public messaging. Depending on your sector and contracts, these may include:
- Defense contractors subject to DFARS 252.204-7012 must report qualifying cyber incidents to the Department of War within 72 hours of discovery.
- Other federal contracts and agency agreements may contain their own reporting clauses.
- State breach notification laws may apply when personal information is involved.
- Sector regulators, insurers and publicly traded company disclosure rules may impose further obligations.
- Customer contracts frequently include notification requirements of their own.
Build a list of these obligations before an incident, including what information each requires and how it must be submitted. Counsel should review notifications before they are sent.
Legal and law enforcement coordination
Involve legal counsel early. Counsel can advise on notification obligations, privilege for investigation findings and the wording of statements. Contacting law enforcement, such as the FBI, and reporting to CISA can provide access to threat information and support, and may help with later recovery efforts. Decide in advance who makes those contacts.
Assume the attacker is listening. If attackers still have access to email or collaboration tools, they may read the response team's discussions. Use out-of-band communication channels for incident coordination until the environment is confirmed clean, and be careful about publicly revealing details that would tell attackers what you have found.
Practice it
Include communications in tabletop exercises. Ask participants to draft the first staff message and holding statement, decide which notifications apply, and walk through who approves what. Gaps found in an exercise are far cheaper than gaps found during a real incident.
How CDT can help
CDT's incident response team supports technical response and helps leadership coordinate communications and reporting. If you are responding to an active incident now, visit our under attack page.
