In an increasingly remote and cloud-based business ecosystem, companies across all industries continue to be targets of ongoing cyberattacks. From hospitals and banks to transportation companies and tech giants, the event of a cyber breach is unfortunately no longer a matter of if, but rather when it will occur.  

Having a corporate crisis communication plan on hand is wise, but given the uptick in cyber-related events, it’s important to revisit these crisis playbooks and update sections to reflect the real threats of running a business in 2021 and managing a remote or hybrid workforce.

If you have not developed a crisis communications plan, it’s not too late. It is far better to be proactive and develop these materials now so that, in the event of a crisis, the executive team can refer to a strategic plan with agreed-upon response steps. Response steps offer guidance on how to effectively manage communications when faced with a crisis situation. This guidance includes when the company should share messages, what the context of the messages will be, who will receive those messages, which executives will share the messages and how the message will be sent, aka the communication channel (e.g. email, text alert, etc.).

With that said, a major deterrent of developing a crisis communication plan is the time investment. To help facilitate planning and development, we’ve created a checklist of highly recommended assets. When it comes time to develop a cyber crisis plan or update existing plans with cyber-related responses, the overview, elements needed, and potential time investment will be clear.

1. List of potential cyber security events. This could include hacks, ransomware or network outages.
2. Members of the crisis communications team. These are the individuals within the company and outside the organization who will be vetting the initial breach and then managing the response to relevant parties.
3. Response steps. The list of response steps provides the crisis team with an agreed upon overview and direction of what will take place during a cyber event. It is also helpful to include suggested owners with each of the response steps in advance of the crisis situation so all members of the crisis have shared expectations of who will be owning what and when it will happen.  
4. Crisis evaluation framework. This framework could be a matrix or table and outline the different scenarios paid with their associated response. This framework will help the communications team determine the proper communication response based on the IT expert’s security diagnosis.
5. Draft templates. Developing draft messages that will be shared by the company in the event of a cyber event will save time when in a crisis situation. The team can then refer to these templates and make the necessary updates to address the relevant information and parties impacted by the event.
6. Communication channels. Depending on the severity of a cyber event, communication channels might be limited. Here it will be important to outline the channels available to the company and understand who those channels reach.
7. Media response. This section is particularly helpful in a communications plan, as it provides the team with guidance on when to be proactive vs. reactive when sharing updates about the cyber event with media – and other external audiences.
8. Guidelines for spokespeople. These best practices and tips go hand in hand with the media response and will help the company spokesperson navigate the response as successfully as possible. 

After a crisis plan is developed, it is wise to participate in a mock crisis response, where the crisis communications team can walk through the developed plan and test out the flow of the response steps. This practice will also provide the spokespeople with media training and best practices for navigating cyber crisis related questions that journalists would surely ask.

For other helpful crisis communication resources, check out the following articles:

• Communicating in a Crisis
• Guidelines for Spokespeople When Handling a Crisis
• The Power of a Blog in a Crisis
• Components of a Successful Crisis Plan
• What Not to Do in Crisis Communication