Simple explanation
During and after an active incident, WHO you tell, WHAT you tell them, and HOW you tell them are all high-stakes decisions — this lesson covers the discipline around incident communication specifically.
Technical explanation
- Limiting communication to trusted parties — during an active incident, oversharing (even internally) risks tipping off an attacker who may still have access, or spreading inaccurate early information before facts are confirmed.
- Disclosing based on regulatory/legislative requirements — many jurisdictions and industries have mandatory breach notification timelines and required content; incident communication has to account for these legal obligations, not just internal preference.
- Preventing inadvertent disclosure of sensitive information — being careful that the incident report/communication itself doesn't leak sensitive details (customer data, security architecture specifics) to an inappropriate audience.
- Using a secure method of communication — if an attacker may still have access to normal channels (email, chat), discussing an active incident through those same channels can tip them off; out-of-band communication is often necessary during active response.
- Reporting requirements — beyond regulatory notification, many organizations have internal policy requiring specific incident types be reported to specific roles within defined timeframes.
Synonyms / related terms
| Term | Means | |---|---| | Out-of-band communication | Communicating through a channel separate from potentially compromised normal channels | | Breach notification | Legally mandated disclosure following certain incident types | | Need-to-know | The principle behind limiting communication to trusted, relevant parties |
Concept Check
"During an active ransomware incident, the response team coordinates entirely over the company's normal email system, which is hosted on the same domain the attacker may still have access to." This violates the principle of using a secure, out-of-band communication method — coordinating response over a channel the attacker might still be reading gives them real-time visibility into the defenders' actions.
Interview-style Q&A
Q: Why might an organization need to communicate about an incident before the full investigation is complete? A: "Regulatory breach notification deadlines often start ticking from discovery, not from full resolution — some jurisdictions require notification within a fixed number of hours or days regardless of investigation status. That means initial communication sometimes has to happen with incomplete information, carefully framed as preliminary, followed by updates as the picture becomes clearer."
Memory trick
"Trust the Channel, Trust the Timeline, Trust the Need-to-know" — three trust checks before sending any incident-related communication: is this channel actually secure, does this meet our regulatory timeline, and does this recipient actually need this information.