Customer trust after a cyber incident depends on how the organization restores service, supports affected people, and explains verified facts. A reassuring statement cannot replace technical recovery. Coordinate operational decisions and communication so customers receive information they can use without unsupported assurances.
01
Identify customer-facing priorities
Ask which functions customers need first and what alternatives can safely operate. A booking business may need a reliable way to confirm existing reservations before restoring every marketing feature. Keep recovery decisions with the technical and operational teams, while communications translates confirmed status into clear customer guidance. Avoid asking customers to use an unverified workaround.
02
Distinguish confirmed impact from investigation
NIST’s recovery guidance includes coordinated communication with internal and external stakeholders. Apply that by maintaining a record of what is known, what is being checked, and who can approve updates. “We are investigating access to certain records” has a different meaning from “no information was affected.” Do not substitute the stronger claim because it sounds more reassuring.
- Use a verified communication channel and named update owner.
- Explain practical steps customers should take, when confirmed.
- Coordinate notification obligations with qualified advisers.
03
Show recovery and learning responsibly
Example: service has returned, but the review of affected records continues. State those as separate facts and keep the next update commitment. Afterward, describe meaningful improvements without exposing defensive details that create new risk. Check whether customers can obtain help and whether recurring questions reveal gaps in the explanation.
Frequently asked questions
Does restoring the website mean the incident is over?
Not necessarily. Data review, account protection, customer assistance, and other recovery work may continue. Describe the status of each relevant workstream accurately.
Should we promise an incident can never happen again?
No. Explain verified improvements and ongoing responsibility without an impossible guarantee. Trust depends on accountable follow-through, not absolute security claims.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.