IT-Checklist
www.it-checklist.com/crisis-communication-plan
Crisis communication plan
1. Agreements beforehand
2. Who do you tell when?
Times count from the moment you discover the incident. Reports to the Dutch DPA and the NCSC are also in the emergency plan.
| Who | When | Channel | Who does it |
|---|---|---|---|
| Management and incident response team: right away | |||
| Staff: within 1 hour | |||
| Insurer and IT partner: within 1 hour | |||
| Customers who are affected: within 4 hours | |||
| Suppliers and partners: the same day | |||
| NCSC (if the Dutch Cybersecurity Act applies): within 24 hours | |||
| Dutch Data Protection Authority for a data breach: within 72 hours | |||
| People affected by a high-risk data breach: as soon as possible | |||
| Press and social media: when questions come in or it is already public |
3. Golden rules
4. Ready-made texts
First message to staff
When: within 1 hour, through the fallback channel if email is down.
To: all staff.
First message to customers
When: within 4 hours if customers are affected, or earlier if they are already calling.
To: customers, by email, on the website or the emergency page.
Message to people affected by a data breach
When: as soon as possible if the breach is likely to pose a high risk to the people whose data it is.
To: everyone whose data was leaked. Have whoever handles privacy check the text first.
Message to suppliers and partners
When: the same day, especially if email or invoices could come from your systems.
To: suppliers, partners and regular clients.
Short statement for the press
When: if a journalist calls or the incident is already in the news or on social media.
By: the spokesperson only.
Social media post or website banner
When: if customers ask questions online or the website is down.
Where: your social media channels and at the top of your website or emergency page.
Phone script for whoever answers
When: as soon as customers start calling.
For: reception, customer service and anyone who answers the phone.
Update message
When: at the agreed time, even if there is little news.
To: the same people as the first message.
Closing message: it's resolved
When: everything works again and the incident response team has closed the incident.
To: staff, customers and partners who got earlier messages.
Auto-reply and voicemail
When: for as long as you are hard to reach.
Where: the email out-of-office message and the voicemail.