The note to the executive team
Proposed decision: treat customer information as a component of service continuity.
What weakens trust
A service interruption leaves customers with immediate decisions: wait, try again, call, or find an alternative. If the information does not help them choose, a technical breakdown also becomes an experience of abandonment. Communication must be linked to operations and customer relations from the preparation of resilience measures.
Recommended arbitration
The committee validates a single factual base, publication responsibilities and an update rate adapted to the situation. Competent teams determine regulatory obligations; communication organizes the coherence of explanations to the public. The priority is not to produce a reassuring formula, but to provide accurate, useful and revisable information.
The expected decisions
Appoint a person responsible for the state of affairs, a person responsible for customer information and a spokesperson. Define emergency channels, methods of assisting vulnerable audiences and the procedure for correcting erroneous messages. Provide restitution after an incident which distinguishes between return of service, resolution of individual consequences and preventive actions.
Resilience is also a public experience
System availability, business continuity and customer understanding must be considered together.
An issue that goes beyond cyberattack
The first overview of major incidents declared within the framework of DORA, published by the European authorities in 2026, highlights in particular the role of system failures, external events and dependencies on service providers [1]. Preparation should therefore not be limited to an intrusion scenario. A migration, third-party outage, or configuration error may also call for a coordinated response. [1]
Different consequences depending on the audience
The same unavailability can prevent an individual from paying, a company from carrying out an operation or an employee from responding to a request. The general message should be supplemented with instructions relevant to these situations. The bank or insurer must also distinguish between people who are actually affected and those who are worried but are not affected.
Do not confuse reassurance and certainty
A phrase such as “everything is secure” can go beyond what the investigation can establish. It is more useful to indicate the functionalities concerned, the elements checked and the action to take. Communication can acknowledge uncertainty while showing an organization: who is working, what information will be updated, and how to access help.
A state of the facts, several useful answers
Consistency is not about sending the same text to all recipients.
Building the common base
The statement of facts mentions the time of detection, the services affected, the confirmed perimeter, the measures taken and the unknowns. It is versioned and its validation is assigned. Employees who respond to customers must access an up-to-date version without waiting for informal email circulation.
Adapt the answer without altering the facts
Customers need instructions and assistance. Employees need to know what to say and where to direct. The media is waiting for a public explanation and a possibility of follow-up. The authorities receive the information determined by the applicable procedures. Validations and schedules must be coordinated, without presenting a public communication as a substitute for a regulatory notification.
Plan for operation in degraded mode
The usual site, app or sending tool may be unavailable. Backup channels and means of authenticating messages must be tested. Incident communications can be exploited by fraudsters: instructions should direct to known points of contact and avoid inviting customers to pass on secrets or codes.
| Public | Priority need | Coordination manager |
|---|---|---|
| Customers | Impact and action to be taken | Customer relations and operations |
| Employees | Instructions and guidance | Internal communication |
| Media | Facts and next point | Media relations |
| Authorities | Required information | Compliance and enabled functions |
Test the answer to three situations
The scenarios below are illustrative. They are used to prepare an organization, without describing a real incident.
Payments unavailable, cause still unknown
The first response explains the impact observed, the alternatives actually available and the time of the next point. She does not promise an unconfirmed resolution time. The committee decides on the level of mobilization of assistance, the audiences to contact directly and the information that can be published before the technical conclusion.
Rumor of data leak accompanies outage
Unavailability is not enough to establish exfiltration. The authorized teams assess the situation and communication avoids both confirming without proof and denying prematurely. Messages must specify the scope of each statement: “we have not identified” is not synonymous with “there is no risk”. The persons concerned receive the appropriate instructions when the facts permit.
Unpopular business decision reignites criticism
A price change announced after an incident may be perceived as disconnected from the customer experience. The committee must examine the timetable, the economic explanation and the possibilities for appeal or support. Communication alone cannot resolve a contradiction between the service provided and the decision taken. It must make this contradiction visible before publication.
Preserve the relationship after return of service
The end of the technical incident is not always the end of the incident for the people affected.
Distinguish three stages
Recovery describes the return of functionality. Remediation deals with individual consequences, operations to be verified or complaints. The learning focuses on the causes and preventive actions. Mixing these steps can lead to announcing a complete resolution while customers are still waiting for a response.
Explain a sensitive decision
An agency closure, change in coverage or modification of service must be presented with its reasons, timetable and practical consequences. The legal or contractually possible nature of a decision is not enough to make it understandable. Field teams must be able to respond to specific situations or direct them towards a clearly defined procedure.
Give a place to public affairs
Institutional relations help to understand the expectations of the territory, the issues of access to services and the concerns of public decision-makers. They must be articulated with the real experience of customers and local communication. The committee benefits from distinguishing obligations, voluntary commitments and choices on which dialogue remains possible.
Organize proofs of trust
A solid reputation requires information that audiences can find, understand and verify.
Prepared media relations
The spokesperson must have a timeline, a scope and a common vocabulary with the experts. Responses to journalists must separate established facts from hypotheses. After the incident, an explanation of the actions taken may be useful; it must not disclose elements that would facilitate an attack nor announce absolute guarantees.
A digital presence without contradictions
Help pages, application messages, the institutional site and social publications must link to reference information. Old incident instructions must be dated and closed. An engine or an AI can otherwise restore a past situation as well as a current one. GEO work begins with the accuracy, availability and consistency of this content [2]. [1]
Utility-oriented observations
Test the questions that audiences actually ask: available service, assistance procedure, distinction between brands, contact methods. Identify incorrect answers and the sources used, without reproducing personal data in the tests. The frequency of mention of a brand does not indicate whether a customer receives safe and applicable instructions.
90 days to make the device operational
The proposed program must be coordinated with existing continuity and incident management procedures.
Days 1 to 30 — Map the gaps
Compare official procedures with a customer’s actual journey during an interruption. Identify channels that are unavailable at the same time, managers who are not replaced and conflicting messages. Also review the latest grounds for complaint and repeated questions to field teams. The diagnosis must result in a list of assigned corrections.
Days 31 to 60 — Simulate pressure
Carry out an exercise combining operations, security, compliance, customer relations, human resources and communication. Change the information during the session. Check the publication of a first message, its correction and the coordination of channels. Assess the ability to decide with partial information rather than reciting a learned scenario.
Days 61 to 90 — Install tracking
Update instructions, train replacements and test emergency means. Prepare a report model distinguishing customer consequences, information quality and operational improvements. The committee monitors unresolved discrepancies and validates the missing resources. The following exercises must vary the situations so as not to create an illusion of preparation.
Measure what protects the relationship
The indicators must shed light on the audience experience as much as the speed of publication.
Recommended measures
Monitor the time between confirmation of an impact and useful information, consistency between channels, repeated requests due to lack of explanation and the treatment of individual consequences. Maintain the calculation bases and distinguish incidents according to their scope. An overall average should not mask a serious situation for a restricted audience.
Interpret with caution
An increase in contacts can signal concern, but also better visibility of assistance. A drop in public mentions alone does not establish a return of trust. The committee cross-references communication observations with service data and feedback from authorized teams.
The decision to formalize
Validate the responsibilities of the state of affairs, the emergency channels and the closing rules. Request exercise feedback showing an error detected, a decision made and an improvement actually implemented. The objective is to make the device verifiable before the next incident.
Sources and benchmarks
- ESMA, EBA, EIOPA — First report on DORA major ICT-related incidents [1]
- Google Search Central — AI features and your website [1]
Belief System analysis and recommendations. The scenarios are illustrative. The sources illuminate the context; they do not constitute validation of our recommendations.