The following piece was originally published by O’Dwyer’s.
Cyber incidents represent a unique but in many ways a quintessential corporate crisis. They have the potential to become highly visible, affect nearly all stakeholders, disrupt operations, damage reputation, and precipitate litigation. Like any crisis, how an organization responds can become the bigger crisis, and it often has a bigger impact on reputation than the incident itself.
As a result, the same foundational approach of any crisis communications response applies: 1) gather the available facts; 2) develop messaging and tailor a consistent response across key audiences; 3) assess legal obligations and risk and calibrate the response accordingly; 4) communicate promptly through the appropriate spokespeople and channels in a way that is consistent with what is known and sensitive to what is not or may change; and 5) ensure messages are guided by honesty, empathy, and transparency.
While many organizations have crisis playbooks that include scenario planning for cyber-related incidents, those playbooks often focus on technical and operational responses and sometimes treat communications planning as an afterthought. The organizations best positioned to maintain credibility in response to a cyberattack are those that are prepared to deploy a communications strategy in lockstep and in a complementary manner with their other crisis procedures.
The Balancing Act
Cyber incidents frequently present a unique challenge because the facts that would otherwise influence substantive and comprehensive communications (e.g., how the attacker gained access, what systems were affected, etc.) can take a long time to establish conclusively. But once an incident becomes public, stakeholders naturally will want answers rapidly. Furthermore, all communications must be carefully calibrated based on potential legal exposure, so communications teams must work closely with legal teams to ensure whatever is communicated doesn’t create more legal risk. This dynamic creates a challenging balancing act that requires communications teams to respond swiftly, credibly, and transparently even before the facts are known. As a result, some questions may have to be left unanswered while an investigation is ongoing, and it may become necessary to acknowledge this.
Balancing so much unknown with the reality that stakeholders’ sensitive information could be at risk is a difficult needle to thread. To effectively communicate through uncertainty, organizations should 1) acknowledge stakeholder concerns and explain what they know definitively and what, if any, assurances can be given; 2) consider outlining what is not yet known; and 3) articulate what the organization is doing to determine the facts and protect affected stakeholders. Organizations also should resist providing premature assurances, which may offer short-term relief but ultimately undermine credibility if developments in the investigation later yield conflicting results.
Initial questions organizations should ask themselves include:
- How did the attack occur?
- Is there an ongoing threat to the organization’s systems or operations?
- What is the nature of the data compromised? Does it include sensitive information or personally identifiable information (PII)?
- Which stakeholder groups were likely impacted?
Putting It All Together
The stakes are high in cyber incident response. In many cases, these events have significant potential to impact long-term credibility and create legal exposure. An effective cyber response does not delay and does not pretend to have all the answers. Instead, it promptly addresses the appropriate audiences – acknowledging what is unknown, confirming what facts have been determined so far, demonstrating empathy for those who may have been affected, explaining what remains under investigation, and providing updates as the facts develop. Organizations that do this effectively can maintain and even build trust with key stakeholders through the uncertainty.
Read more about our cybersecurity practice here.
