A cybersecurity incident becomes a reputation issue when people need accurate information about their accounts, data, or access to a service. Prepare communication alongside technical response, while keeping containment and evidence preservation under qualified security leadership.
01
Plan distinct incident scenarios
An account takeover, exposed customer file, and service outage require different actions. Define the technical lead, decision maker, legal or privacy adviser, and communication owner for each. Keep an alternative contact channel available in case the usual email or social account is compromised. NIST's incident-response guidance treats preparation and improvement as part of ongoing cybersecurity risk management, not just a message drafted after damage occurs.
02
Separate confirmed scope from investigation
Record what is known, when it became known, and who verified it. Do not announce that no information was affected before the investigation supports that conclusion. Likewise, do not speculate publicly about attackers or exposed records. A useful initial update explains the affected service, practical precautions, and where verified updates will appear, with uncertainty stated plainly.
- Preserve logs and relevant records through the security process.
- Confirm who may approve public statements and required notices.
- Test an alternative communication channel before an incident.
03
Practice a concrete handoff
For example, if a business's social account posts a fraudulent payment request, security handles recovery while communications identifies a verified alternative channel and warns customers about the specific unauthorized request. Customer support needs the same facts. After recovery, review access controls and delayed decisions. Public reassurance should describe completed actions rather than claim that future incidents are impossible.
Frequently asked questions
Should the marketing team investigate the breach?
It can collect communication facts, but technical investigation and containment need appropriately qualified staff. Avoid actions that destroy evidence or expose more data.
Is a public post enough notification?
Not necessarily. Applicable legal, contractual, and platform obligations vary. Have qualified advisers determine required recipients, content, timing, and delivery methods.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.