Will media call us during a cyber attack? What is a crisis communication plan?

make a crisis plan first dude. who speaks what gets said template answers if media asks. don't say no comment looks shy... fast reply on social media — correct false news if any...

Crisis communication workflow: 1) detection (internal: IT alert), 2) assessment (legal + PR): reputation risk, media likelihood (ransomware + customer data = high media attention), 3) message mapping (stakeholder-specific messaging: customers vs. media vs. employees different tones), 4) channel selection (press release if media interest likely, direct statement to customers always), 5) monitoring (media mention tracking via Google Alerts, social media monitoring tools), 6) response cadence (h+4: brief statement, h+24: detailed, daily updates if ongoing investigation). Interview preparation: media training for spokesperson (tone, pace, key message focus), messaging cards (3 key points repeated), boundary-setting (scope, timeline, confidential details off-limits).

Make a crisis plan from the start — who speaks what gets said what media might ask. btw don't answer unprepared. Fast reply on social media — correct false news instantly if any... Learn the boilerplate answer: 'Under investigation, we will report results'...

Crisis comms hierarchy: Pre-crisis (planning, training), Active crisis (incident response + comms running in parallel), Post-crisis (root cause comms + prevention steps). Media strategy: transparency (what happened, what we did, what's next) vs. info security (protecting the ongoing investigation). Spokesperson coaching: repeating key messages (message discipline), tone (empathy, accountability), body language (calm, confident). Social media playbook: 24/7 monitoring during crisis, rapid response (<2h for big rumors), internal comms first (don't let employees find out from the news), post-crisis narrative (lessons learned, improvements made).

Three different views emerged, they all complement each other. People defend habits, not processes. Resistance comes from there.

This is my opinion I'm not claiming it's absolute truth.

i think it's hard to be that definitive about crisis communication... taking ntoes for two weeks yields better results than a six-month estimate.

proven by experience.

i felt relieved reading this answer so it's not just me... taking measures without an inventory leaves doors you haven't seen open.

if you post the result here it will help others too.

The answer above hits the nail on the head. Your time to detect an issue directly determines its cost.

An untested backup is not a backup.

If I understood correctly, you're saying: The biggest time-waster for us was not knowing who had the final say.

That's all, sorry if I went on too long.

let me summarize the topic, since several different answers were given. taing notes for two weeks yields better results than a six-month estimate.

just leaving this note, it might be useful.

I can't fully agree with this. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Good luck with that.

I didn't know that.

I'd appreciate it if you shared the outcome. The answer varies greatly by industry; there is no one-size-fits-all rule.

We experienced almost the exact same thing last year. Just because everyone does it doesn't mean it's right.

Taking measures without an inventory leaves doors you haven't seen open. If you post the result here, it will help others too.

i have an objection here but everything goes well for the first three months; problems arise in the fourth.

having backups accessible on the same network and with the same identity makes them part of the target. correct me if I'm wrong.

It's rare to find an explanation this clear. When making decisions, write down the worst-case scenario too, not just the best.

I'm also curious if anyone does it differently.

Timely topic.

my question might sound amateurish, sorry about that. having backups accessible on the same network and with the same identity makes them part of the target.

if you scold false alarms, nobody will report agan but anyway that's all sorry if I went on too long.