Belief System Analysis · Published on .
Starting from observed effects
An unavailability of service is not enough to conclude that there has been an intrusion, and an ongoing investigation cannot guarantee the absence of a data leak. Communication must distinguish what is observed, what is confirmed and what remains to be verified. This discipline is particularly useful when the questions relate to access to accounts, how a payment works or the confidentiality of information.
The first situation sheet can be kept short: services affected, time of observation, protective actions undertaken, known consequences and next update. Each element has a validator. The communications department does not have to establish the technical diagnosis alone; it must know what fact it can make public and what wording honestly reflects the uncertainty.
Organize coordination that holds up under pressure
The ANSSI guide on cyber crisis communication links preparation, coordination and internal and external communication. It constitutes an operational support point. The notification or information obligations specific to a situation must be established with the legal, security, compliance and data protection functions concerned. [1]
We propose to separate three decisions: qualify the incident, choose the protective measures and determine the information to be disseminated. The people responsible for these decisions must talk to each other at a pace adapted to the evolving facts. Too broad a circuit can slow down each publication; a circuit that is too short can release dangerous or false information. Good organization provides for staff, substitutes and means of contact that can be used if the usual tools are unavailable.
Give customers usable information
A message to customers should explain what they can do now, where to find reliable information and what steps to avoid. Practical recommendations must be validated with the competent teams. An ambiguous guideline can increase calls, create errors, or make people more vulnerable to a fraud attempt posing as assistance.
The reference page must be accessible, dated and kept up to date. If a channel is unavailable, an alternative means that works must be announced. Media responses and social posts may link to this page, without replacing individualized information where it is necessary. Contact arrangements and security rules must remain consistent with those of the establishment.
Prepare employees for what they can say
Employees can receive questions on their personal phones or be contacted directly by customers and partners. They need clear instructions on the authorized channels, the information that can be communicated and the requests to be transmitted. It is not enough to ask them not to speak: they must be allowed to correctly direct a person who is seeking help.
An internal point must distinguish the impact on work, expected behaviors and the public situation of the incident. Frontline teams should receive updates at least as quickly as the messages they will need to explain. If an instruction changes, the correction must be explicit; letting several versions coexist creates contradictions that customers immediately perceive.
Example: inform during an investigation
In a fictitious situation, an establishment notices the unavailability of several services and opens an investigation. He can confirm the interruption and the measures actually taken, without prematurely announcing a cause or a return time. It may specify that new information will be published at a given appointment, even if this point should simply confirm that the investigation is continuing.
When new facts emerge, the update should explain what is changing. If a previous statement becomes inaccurate, it must be clearly corrected. A viewable timeline helps to understand the evolution. It must retain useful information without disseminating technical details which would aggravate the exposure. The level of precision is a documented arbitration between the responsible functions.
Prepare the return to service and the post-crisis
| Timing | Priority question |
|---|---|
| Observation | Which services and public are actually concerned? |
| Protection | What actions are taken and what instructions are validated? |
| Investigation | What facts remain open and when to inform again? |
| Recovery | What works, under what conditions? |
| Tracking | What commitments still need to be kept? |
The technical recovery does not automatically close the subject of trust. Files may remain pending, clients may need explanations and employees may maintain an unusual workload. The recovery message must therefore specify the residual limits and the next steps.
Once the emergency has passed, the communications department can contribute to feedback: what questions were poorly anticipated, what validations slowed down the response, what messages were misunderstood? For Belief System, this analysis must lead to concrete changes and a preparation exercise, so that the next mobilization is based on proven practices.