Your breach statement is already late

The worst time to decide how your company communicates a cyber incident is during a cyber incident.

At that point, the facts are incomplete, the legal questions are multiplying, customers want an answer, journalists want it sooner and somebody has just suggested posting “we take security very seriously”. Nothing calms a room quite like the sentence used after every breach since the invention of the password.

Cyber risk is now plainly a leadership issue. The UK National Cyber Security Centre’s board toolkit places incident planning, response and recovery alongside risk, strategy, people and oversight. Its central point is hard to dodge: resilience has to be embedded across the organisation, not parked with IT.

Communications belongs in that preparation.

Decide before you draft

Begin by agreeing who decides what. Name the incident lead, legal adviser, technical authority, communications owner and board contact. Define who can approve a holding statement when the chief executive is unavailable and the incident is moving faster than the diary.

Next, build the message architecture before you need the message. You cannot pre-write the facts, but you can establish the order: what happened; what is affected; what people should do; what the organisation is doing; when the next update will come. That last point matters. Silence creates an information vacuum, and an information vacuum quickly fills with screenshots, rumours and speculative LinkedIn expertise.

Prepare for different audiences. A regulator needs detail and precision. A customer needs plain instructions. An employee needs to know what to say and where to send questions. A journalist needs a credible spokesperson. Copying one statement into five channels is efficient only if confusion is the objective.

Practise the uncomfortable questions. Why did this happen? When did you know? Was data taken? Why were customers not told earlier? Has the chief executive spoken to the board? The goal is not to manufacture perfect answers. It is to expose weak ownership, missing evidence and euphemisms before they appear on camera.

Then decide how you will show progress. “Our investigation is ongoing” may be accurate, but repeated for three days it sounds like institutional buffering. Even when the root cause remains uncertain, you can often update the scope, customer action, service restoration or timing of the next briefing.

Do not forget the internal audience. Employees will see customer posts, press coverage and private messages before the all-staff email has survived three approval rounds. Give them a short factual briefing, a clear escalation route and language they can use without pretending nothing has happened. They should never learn the official position from a screenshot on social media.

Rehearse the bad day

Run a simulation with real time pressure at least once a year. Include a broken approval chain, an unavailable spokesperson and a fact that changes halfway through. A plan that only works when everyone is calm, online and certain is not an incident plan. It is office stationery.

Good crisis communication does not compete with the technical response. It reduces the secondary damage: dangerous customer behaviour, internal confusion, avoidable speculation and the suspicion that the company is withholding more than it knows.

The first statement will never answer everything. It should prove three things: you understand the seriousness, you know who needs help and you will return with useful information.

If your plan begins with “draft statement”, it begins too late. Start with decisions, roles and rehearsal. The words will be better because the organisation behind them is ready.