# Incident Communication and Notification
Incident communication and notification is the discipline of managing information flow during and after a cybersecurity incident: internal communication (to employees, executives, and the board), external notification (to regulators, affected individuals, law enforcement, and business partners), and public communication (to media and the general public). How an organization communicates during an incident determines its legal exposure, regulatory compliance, customer retention, and reputational outcome as much as the technical response determines the operational outcome.
Incident communication is a governance function, not a technical function. The IR team contains the threat. The communication team manages the narrative. Both must operate in parallel, coordinated, and with clear decision authority. An organization that contains a breach in 4 hours but takes 6 months to notify affected customers faces regulatory penalties, customer lawsuits, and reputational damage that the technical success cannot offset.
The regulatory landscape for breach notification is complex and tightening. In the United States alone, all 50 states plus the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have breach notification laws with different definitions of "personal information," different notification timelines, and different notification requirements. Federal regulations add layer-specific requirements: HIPAA (healthcare), GLBA (financial services), FERPA (education), and the SEC cybersecurity disclosure rules (public companies). Internationally, GDPR (72-hour notification to the supervisory authority), NIS2 (24-hour early warning), and country-specific laws add further complexity.
Incident communication operates in three phases aligned with the incident lifecycle:
During the incident (active response). Communication focuses on operational coordination and stakeholder awareness. Internal communication notifies the IR team, executive leadership, legal counsel, and communications/PR. The board chair or audit committee chair is notified if the incident may be material. External communication is limited: law enforcement is contacted if criminal activity is suspected, cyber insurance is notified to activate the IR panel, and regulatory notification clocks start running.
The critical principle during active response: say what you know. Do not speculate. Do not provide timelines you cannot commit to. Do not assign blame. "We have identified a security incident affecting [specific systems]. Our incident response team is actively investigating. We will provide an update within [timeframe]." This is a defensible communication. "We believe the attacker accessed customer data, but we think it was encrypted" is speculation that may prove incorrect and create legal exposure.
Post-containment (investigation and notification). Once the incident is contained and the investigation has determined scope, impact, and affected data/individuals, formal notification begins. Legal counsel determines which notification obligations apply based on the type of data involved, the jurisdictions of affected individuals, and the applicable regulatory frameworks. The notification plan is developed: who is notified, through what channel, with what content, and on what timeline.
Post-incident (long-term communication). After notifications are complete, ongoing communication addresses remediation actions, security improvements implemented, and (if applicable) credit monitoring or identity protection services provided to affected individuals. Post-incident communication demonstrates that the organization has learned from the incident and taken concrete steps to prevent recurrence.
The notification landscape requires legal expertise because requirements vary by jurisdiction, data type, and organization type:
U.S. state breach notification laws. All 50 states require notification to affected residents when their personal information is compromised. Notification timelines range from "as expeditiously as possible" (most states) to specific deadlines (60 days in many states, 30 days in some). The definition of "personal information" varies: most states include name plus SSN, driver's license, or financial account number. Some states have expanded definitions that include biometric data, health information, email credentials, and other data types.
HIPAA Breach Notification Rule. Covered entities must notify affected individuals within 60 days of discovery. Breaches affecting 500+ individuals require notification to the HHS Office for Civil Rights and prominent media outlets in the affected state. The HIPAA Breach Notification Rule includes a risk assessment provision: if the covered entity can demonstrate that the compromised PHI was encrypted or that the probability of compromise is low, notification may not be required.
GDPR (Article 33 and 34). Data controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals' rights and freedoms. If the breach is likely to result in a high risk, the data controller must also notify affected individuals without undue delay. The 72-hour clock starts at awareness, not at containment or investigation completion.
SEC cybersecurity disclosure rules (2023). Public companies must disclose material cybersecurity incidents on Form 8-K within four business days of determining that an incident is material. The disclosure must describe the nature, scope, timing, and material impact (or reasonably likely impact) of the incident. Materiality is determined by the organization, but the SEC has signaled that it will scrutinize materiality determinations.
CISA Cyber Incident Reporting (CIRCIA). When final rules are implemented (expected 2025-2026), critical infrastructure entities will be required to report significant cyber incidents to CISA within 72 hours and ransom payments within 24 hours.
Internal stakeholders.
Executive leadership needs decision-relevant information: what happened, what is the business impact, what are we doing, and what decisions are needed (declare a disaster, invoke insurance, engage outside counsel, authorize public communication).
The board needs a condensed assessment: is this material? What is the expected financial and reputational impact? What are the notification obligations? What remediation is planned? Board communication during an incident should flow through the CISO or General Counsel, not through operational staff.
Employees need to know what happened (at an appropriate level of detail), what they should do (change passwords, report suspicious activity, refer media inquiries to communications), and what they should not do (do not discuss the incident on social media, do not speculate with customers).
External stakeholders.
Affected individuals receive formal notification letters (or emails, where permitted) containing: what happened, what information was involved, what the organization is doing, what the individual can do to protect themselves, and how to contact the organization for more information. Notification content requirements are specified by state and federal law.
Regulators receive notification as required by applicable frameworks. The notification must be timely (within the required window), accurate (based on investigation findings, not speculation), and complete (covering the required data elements).
Law enforcement (FBI, Secret Service, state attorney general) is contacted when the incident involves criminal activity. Law enforcement engagement is voluntary in most cases but recommended: it provides access to threat intelligence, may assist with attribution, and demonstrates good faith that regulators and courts consider favorably.
Cyber insurance carrier is notified per the policy terms (typically within 24 to 72 hours of discovery). The carrier activates the IR panel (forensic firm, breach counsel, notification vendor) and begins the claims process. Late notification to the carrier may jeopardize coverage.
Business partners and customers (beyond affected individuals) are notified when the incident may affect their data or operations. Contractual notification requirements (in MSAs and vendor agreements) may specify notification timelines and content.
Media and public. Media inquiries are managed through a designated spokesperson. Prepared holding statements provide consistent messaging. Press conferences or public statements are issued when the incident is significant enough to warrant proactive public communication (usually when affected individual count is large, the organization is well-known, or the incident has public safety implications).
The communication plan should be developed before an incident occurs, not during one. The plan defines:
Roles: who is the incident commander for communication decisions? Who drafts notifications? Who approves external statements? Who serves as media spokesperson?
Templates: pre-drafted notification letter templates (customized per incident), holding statements for media, internal employee communications, board briefing formats, and regulatory notification forms. Templates reduce the time from decision-to-notify to notification-sent.
Contact lists: legal counsel (internal and external breach counsel), insurance carrier claim contact, law enforcement contacts (FBI field office, Secret Service, state AG), regulatory contacts (HHS OCR for HIPAA, state AG offices for state laws, supervisory authorities for GDPR), and media contacts.
Decision trees: at what severity level is the board notified? At what threshold does the organization engage external breach counsel? When does the organization issue a public statement? Who has authority to approve each decision?
Delayed, incomplete, or inaccurate notification creates legal liability. State attorneys general have imposed fines for late notification. GDPR supervisory authorities have fined organizations for failing to notify within 72 hours. The SEC has signaled that it will enforce the four-business-day materiality disclosure requirement. Class action lawsuits following data breaches routinely cite notification failures as evidence of negligence.
The legal exposure from poor communication can exceed the direct cost of the incident itself. A breach that costs $500,000 to remediate can generate $5 million in regulatory fines and legal settlements if notification is mishandled. Communication is not a secondary concern. It is a primary liability management function.
How an organization communicates during a breach directly affects customer retention. Organizations that notify promptly, transparently, and with specific remediation actions retain more customers than organizations that delay, minimize, or deflect. Research by Ponemon Institute consistently shows that organizations perceived as transparent during a breach experience lower customer attrition than those perceived as evasive.
Cyber insurance claims require documented, timely notification to the carrier. Late notification (beyond the policy's required window) is grounds for claim denial. The notification must include the incident timeline, scope, affected data, and response actions. Documentation produced during the incident (IR logs, forensic findings, notification records) serves as claims evidence.
Incident communication sits in the RGA (Risk Governance and Assurance) domain of the Planetary Defense Model. RGA is the strategic envelope: the governance layer that ensures the organization can manage the legal, regulatory, and reputational dimensions of a security incident alongside the technical response.
CDA's Perpetual Compliance Assurance (PCA) methodology addresses incident communication through pre-incident preparation: communication plans, notification templates, contact lists, and decision trees are developed and maintained before the incident occurs. "Compliance is not an event. It is a state." Communication readiness is a compliance state: the organization is always prepared to notify, not scrambling to figure out the process during a crisis.
RGA-C03 (Incident Communication Program, 12 estimated hours) establishes the communication framework: roles, templates, contact lists, decision trees, and regulatory notification mapping. The mission includes a tabletop exercise component that tests the communication plan alongside the technical IR plan, because communication failures during incidents are as common as technical failures and equally damaging.
CDA approaches incident communication with one principle: silence is not a strategy. Organizations that go quiet during an incident (hoping the situation will resolve before anyone notices) face worse outcomes than organizations that communicate early, even if the initial communication is limited to "we are investigating." Stakeholders interpret silence as either ignorance (the organization does not know about the incident) or concealment (the organization knows and is hiding it). Neither interpretation is favorable. Prompt, factual, appropriately scoped communication demonstrates competence and good faith.
Word count: 1,963