Run the communications half of an incident

applied · 90 min · Objective 4.2

Task

Take one of your staged incidents and run everything except the technical response: the cadence, the channel, the holding statement, the three audiences, and the discipline of never issuing something that has to be retracted. Objective 4.2 is incident response reporting and communication.

Steps

  1. Set the cadence before anything else: who is told what, how often, and by whom. Announce the next update time explicitly and then meet it.
  2. Move to an out-of-band channel on the assumption the corporate one is compromised, and authenticate the participants in a way that does not depend on the affected infrastructure.
  3. Write the holding statement at the 30-minute mark, with only what is genuinely known, an explicit note that figures may change, and a committed next update time.
  4. Produce three versions at the 2-hour mark: internal staff, customer, and regulator-facing. Different detail and emphasis, identical facts.
  5. Issue a "nothing has changed" update on schedule when nothing has changed. That message is what stops people interrupting the response for status.
  6. Audit every statement you wrote for negative claims you cannot evidence, for numbers you are not sure of, and for any assertion that the incident is contained before eradication was verified.
  7. At the end, count the statements that would have needed retracting had the scope turned out twice as large.

Verify

grep -c "^## " /tmp/comms-log.md
grep -ciE "next update (at|by)" /tmp/comms-log.md
grep -ciE "no (customer )?data (was|were) (taken|accessed|affected)" /tmp/comms-log.md
grep -ciE "no evidence (of|that)|investigation is ongoing|figures may change" /tmp/comms-log.md
grep -ciE "contained|resolved" /tmp/comms-log.md

Every update must commit to a next update time, so the second count should match the number of updates. The third must be zero -- unqualified negatives are the retraction generator -- and the fourth must be non-zero, because those are the phrasings that say the same thing defensibly. Check every hit in the fifth against your eradication evidence.

Notes

The retraction count from step 7 is the deliverable. A correction about a breach is a second news story, resets trust to zero, and makes every subsequent update doubted internally as well as externally.

Prefer an early acknowledgement to an early conclusion. You can always add detail; you cannot withdraw a claim.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.