In The Event Of A Cybersecurity Breach, How Will You Communicate With Employees?

4 best practices to follow

Cybercriminals are becoming increasingly advanced, industrialized and organized. They operate as criminal enterprises, and have rapidly accelerated their attacks. Research shows a 148% spike in ransomware attacks in the last year. Even as more breaches make the news, a third of respondents say they don’t know their company’s emergency response plan in the case of a cybersecurity incident or system outage.

This lack of preparation can cause further damage by increasing the impact of a cybersecurity breach from a delayed response. One report from IBM found that on average, organizations take 280 days to detect a data breach. Companies can’t waste any time planning their emergency response after a breach has occurred. They must have a response plan in place so they’re ready to execute if the time comes.

Cyberattacks, fires, active shooter, and other critical events require emergency preparedness and planning so response teams follow appropriate incident response protocols. A critical component to those plans is emergency communications to keep employees informed and minimize as much confusion and damage as possible.
Here are four best practices to follow when communicating with employees after a cybersecurity breach.

After a breach, companies can’t waste time struggling to get in touch with employees. In the era of hybrid and dispersed workforces, contacting every employee is challenging and manual methods, such as call trees are not reliable. Staff may be in different time zones or work off-hour shifts, making it challenging to reach them, not to mention the server or network may be compromised. On top of this, remote work structures mean more information is accessed digitally, creating a risk of higher losses in the event of a cyberattack.

The solution is to quickly communicate with employees across multiple channels to effectively reach them. A mass notification system can alert employees of a security breach or any other critical incident via SMS, voice, email, desktop notification and other channels. Messaging templates for specific scenarios can easily be set up in advance so every employee is notified within seconds.

These notifications can be targeted, so teams have the relevant information for their role. IT teams need to assess the breach, secure current systems and address identified vulnerabilities. Executive teams have overall responsibility to manage the response and ensure that proper protocols are followed. Communications teams are tasked to monitor public perception and control the messaging to media, social channels and external stakeholders.

Communicating efficiently and effectively in the wake of a cyberattack is crucial to ensure employees have pertinent information. Mass notification systems and other communication tools can quickly send targeted messages so that everyone is aware of the situation and takes the best steps to support the incident response.

After a cybersecurity breach occurs, it can be a chaotic time for leadership and employees. Companies should be transparent and direct with what they know and reassure employees that they are handling the situation. Keeping everyone composed is important to managing the negative impacts of the event. Let employees get the official news from you, rather than potentially unreliable sources.

Communications should provide clear, actionable direction so that everyone is aligned on what has happened and how they can reduce the impact on business operations. Follow your crisis communication plan and inform employees about internal protocols and external statements. Be sure to share the availability of internal systems; status of current investigations; and notifications sent to customers, business partners and affected individuals.

These communications will act as a guide for employees to ensure proper procedure is followed. There will be enough questions coming from stakeholders on every side, so proactively minimizing internal confusion with clear direction will be a significant step in streamlining the response process.

When a breach is first detected, there may be limited information to share with employees. As time passes and the situation evolves, provide continuous touchpoints on the efforts to contain the data breach and recover core technologies. The new information engages teams to follow proper protocols and reinforces their trust in leadership.

Companies should also share any changes in how to handle business processes. If certain systems are still not accessible, explain what is being done to address the problem. This will help teams know they are being kept in the loop throughout the event.

Having one continuous, reliable source of information will prevent further damage to both the business’s reputation and its digital assets. If employees rely on social networks or external media to get the latest news, inaccurate information will cause confusion and complicate the situation. Companies should share information on any changes and provide periodic check-ins to let everyone know the situation is being managed.

A cyberattack response plan must be coordinated before an actual breach occurs, not after the fact. If leadership needs to share information with employees, but doesn’t have a mass notification system established to do it efficiently, valuable time will be spent coordinating outreach and delaying the appropriate response. You don’t want an employee to unknowingly use compromised systems or put even more information at risk because of a poor communication strategy. This can easily be avoided by instituting a cyberattack communication strategy before an incident occurs.

The implications of a cyberattack can be damaging, but managing the crisis effectively with strong leadership, a well-conceived emergency response plan and the appropriate mass notification tools can reflect positively on an organization’s preparedness. Employees can then support the business continuity efforts to keep essential functions running and minimize downtime for a quick recovery of operations.

Organizations that are prepared for a cybersecurity incident will demonstrate their management competence and expertise, while minimizing damage and reassuring stakeholders. This means having a communication and response plan that keeps employees informed and enables teams to collaborate for a quicker resolution.