Introduction
“When we asked our customers what they’d like to explore at our most recent meet up they shared that whilst they always do what they can to prevent any cyber slip-ups, some times “stuff” happens. And when “stuff” happens, having a plan to deal with it is critical. So we asked the team at Eskenzi PR to come in and lead a session on managing communications in a crisis. Below is a short summary of the informative and pragmatic steps they shared…”
Tim Ward, CEO, ThinkCyber
Ask anyone working in or on the fringes of cybersecurity about the major concerns of the past few years, and you'll likely hear about various crises: data breaches, ransomware attacks, malware, and botnets - these issues have become mainstream. Recently, we have witnessed some of the most monumental cyber-attacks in digital history, making headlines worldwide.
Consider the 23andMe breach, where hackers obtained data on 7 million people, or the Dell data breach, affecting 49 million customers. These incidents demonstrate that no organisation is safe from cybercriminals. These malicious actors are becoming more sophisticated, moving beyond service disruption to infiltrate company networks, steal valuable data, and threaten to release or sell it.
The consequences of such incidents are significant, with financial and reputational repercussions. Fortunately, steps can be taken before, during, and after an incident to limit the damage. There are technical measures—technologies and training needed to identify and remediate unusual activity in your systems—and communication strategies. Effective communication involves relaying the facts of a breach to the public and media clearly, authentically, and reassuringly. While both technical measures and communication are important, let's delve into the latter.
What you say and do—or don’t do—during a breach can determine whether your company is seen as competent and trustworthy or as having failed its customers, partners, and employees. Here are some key points to consider when building your communication strategy.
Early Bird Catches the Worm
In our world of hyper-connectivity, news travels fast, especially bad news. A single tweet can spark a frenzy, leaving you on the defensive with angry partners and worried customers. Once your organisation learns of a breach, act quickly to inform stakeholders. Identify your stakeholders and use effective channels, such as press releases, email, and social media, to keep them updated. By getting the word out first, you can take control of the narrative.
Balance Speed and Accuracy
While speed is crucial, the accuracy and tone of the message must not be compromised. Preparation is key. Consistency in your message demonstrates confidence and authority, so your company must speak as one unit. This doesn't mean the message can't evolve with the situation, but it must be coherent.
Build a team with representatives from human resources, legal, public relations, IT, and the CEO. This team will form a committee to guide next steps, but there should be a clear leader who makes final decisions. Ideally, this individual will also be the company’s main spokesperson, with ample media training.
Be Purposeful with Your Messaging
Crafting the message itself is critical. While predicting specific incidents is impossible, having draft copies tailored to various scenarios can facilitate quick, thoughtful responses. Every word must be intentional. Communications should be clear and concise, with sincere apologies and accurate facts to explain the situation. Create a document that customer- and partner-facing employees can refer to for the latest details on the breach and guidelines on what can and cannot be said. Share what is being done to resolve the issue—without overpromising—and outline plans to prevent future incidents.
Rehearse and Adapt
Finally, practice makes perfect. Regular rehearsals are essential to any good crisis communication plan. They help your team understand their roles and responsibilities and identify any process issues early. This ensures the plan is continuously reviewed and revised as needed. Being proactive in building your communication plan today can significantly mitigate future impacts. Remember, a reputation built over years can crumble in an instant if you're not careful.