Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Escalation and Communication Plans
Decide who talks, before you need to
In an incident, information is incomplete and pressure is high. Without a plan, executives hear about it from the news, staff speculate on social media and regulators are notified late. A communication plan decides in advance who is told what, when, how and by whom. Establishing and maintaining incident communication plans and processes for internal and external parties is a CISM task.
Escalation by severity
Escalation timings are defined by severity in the plan, so nobody has to judge whether now is the right time to call the CEO. Escalating too late can miss legal deadlines and leave leaders blindsided.
Audiences and owners
| Audience | Owner | Typical content |
|---|---|---|
| Executives and board | CISO or incident manager | Facts, impact, decisions needed |
| Staff | Communications or HR | What to do and not do; don’t speculate |
| Regulators | Legal and compliance | Required notifications, on time |
| Customers and partners | Communications, with legal | What happened, the impact, what they should do |
| Insurer | Legal or risk | Notice under the policy terms |
| Law enforcement | Legal, with the executive sponsor | Reports where crime is involved |
| Media | Designated spokesperson | Approved statements only |
Prepared and protected
- Templates: pre-approved drafts for common scenarios.
- Spokespeople: named people authorised to speak externally. Nobody else talks to the media, or to the attacker.
- Out-of-band channels: a phone bridge, a separate chat platform, a printed contact list.
- Legal review of external statements before release.
Example. During a breach, attackers still have access to corporate email. The response team switches to a pre-arranged secure messaging group and phone bridge, so the attacker can’t read the response as it unfolds.
Prompt, honest updates protect trust better than silence or inaccurate statements.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who speaks to the media? | Designated, authorised spokespeople |
| Email may be compromised | Use out-of-band communication |
| Why pre-approve templates | Faster, accurate, legally reviewed messages |
| Who handles regulator notification? | Legal and compliance, with executive approval |
| Basis for escalation timings | Incident severity, defined in the plan |
In short
- Establishing and maintaining incident communication plans for internal and external parties is a CISM task.
- Escalation paths and timings are defined by severity, so the right people learn in time without debate.
- Communication plans cover internal audiences (staff, executives, board) and external ones (regulators, customers, partners, insurers, law enforcement, media).
- Pre-approved templates and designated spokespeople speed communication and keep it accurate.
- Out-of-band channels are essential: email and chat may be compromised or down.
- Legal reviews external statements; only authorised people speak externally.
Exam traps
- Staff shouldn't talk to the media or the attacker unless authorised.
- Using compromised email to coordinate the response tips off the attacker.
- Escalating too late can miss legal deadlines and leave leaders blindsided.
- Silence or inaccurate statements damage trust more than prompt, honest updates.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Escalation by severity