Lion Cipher Lab
Write an incident communication plan
- GRC / Compliance
- Beginner
- ~45 min
- Free · no account required
Why it matters
When a security incident hits, the technical containment is often the part a good team handles well -- and the communication is the part that goes wrong and does the lasting damage. Customers who hear nothing for weeks, a spokesperson who guessed at the cause and was publicly wrong, a regulator notified past a legal deadline, an internal message the attacker read because it went out over the compromised email system: these are communication failures, not technical ones, and they are what turn a contained incident into a reputational and legal crisis. A communication plan is the one-page…
What you'll learn
- mapping incident stakeholders (internal and external)
- building a RACI for communications
- designating a single spokesperson and one source of truth
- using out-of-band communication channels during an incident
- pre-drafting holding statements
- understanding breach-notification timelines (GDPR 72h, US state laws) at a high level
- knowing what NOT to say early in an incident
- writing a one-page incident communication plan
Steps in this lab
- The message no one drafted until it was on fire
- Who needs to know, and when
- The RACI of communications
- One source of truth, one spokesperson
- Talk out-of-band -- the attacker may be reading
- Pre-draft holding statements, and know what NOT to say
- Notification timelines and legal duties -- then fill the one page
- Why the plan you write today wins