Send It Now or Hold It? — TechKnowSurge

About this interactive

Communication runs through the whole of incident response, and the plan should say in advance who is told, what, when and how. The lesson's case for it is reputation. People accept that systems sometimes go down. What they do not forgive is silence: without updates they assume nobody is working on it. So during an outage, tell people what you know, give updates and, where you can, when the next one comes. Bring in customer support early so they can answer callers, and public relations so the message to customers and the media is managed. The other half is balance. The lesson's warning: announce that all your customers' information is lost, then find out it was not, and you have caused panic for nothing. Messages about causes, blame, data affected or fix times wait until the facts are known. Legal, regulatory and law enforcement reports come later, once it is clear what kind of incident it was. Twenty minutes into an outage, the team knows the store is down and is working on it. That is all it knows.

What you'll learn

Decide whether a message during an incident should go out now, because it is true and useful at that point, or be held until the facts it claims are known
Explain how clear, regular updates to the right people protect an organization's reputation, and how oversharing an unconfirmed claim does the opposite

Aligned to

NIST CSF

RS.CO-02 Internal and external stakeholders are notified of incidents.

RS.CO-03 Information is shared with designated internal and external stakeholders as authorized.

RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging.

CompTIA CySA+

4.2 Explain the importance of incident response reporting and communication.

CompTIA Security+

4.8 Explain appropriate incident response activities.

NIST 800-53

IR-4 Incident Handling

Key terms

Stakeholder: An individual or group with an interest in or affected by an organization's operations, including internal staff, executives, clients, vendors, and partners.
Reputation Management: The practice of shaping and maintaining public and stakeholder perception of an organization, particularly during and after disruptive events.
Public Relations: The function responsible for managing communications between an organization and the public or media, especially during incidents or crises.
Role Separation: The practice of assigning distinct responsibilities to different individuals during incident response to prevent conflicts between tasks such as troubleshooting and communication.

Topics

Incident Response Communication Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →