<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-crisis-communication-plans
description: >-
  Create crisis communication plans with stakeholder mapping, notification templates, communication cadence schedules, and regulatory disclosure procedures.
domain: cybersecurity
subdomain: incident-management
tags:
  - crisis-communication
  - stakeholder
  - notification
  - media
  - regulatory
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.CO-1", "RS.CO-2", "RS.CO-3"]
  frameworks: ["NIST SP 800-61", "GDPR", "HIPAA"]
---

# Building Crisis Communication Plans

## Overview

Crisis communication plans ensure the right stakeholders receive accurate,
timely information during security incidents. Covers stakeholder mapping,
templated notifications, cadence schedules, and regulatory disclosure.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Stakeholder directory | Contact routing |
| Legal counsel access | Regulatory disclosure guidance |
| PR/Comms team contact | External communication approval |
| Communication platform (Slack/Teams) | Delivery channels |

## Stakeholder Map

```
INTERNAL:
├── IR Team (always) ├── CISO (S1/S2) ├── CTO (service impact)
├── Legal (data breach) ├── PR/Comms (media) ├── Executive (S1)
EXTERNAL:
├── Customers (breach notification) ├── Regulators (GDPR/HIPAA/SEC)
├── Law Enforcement (criminal) ├── Insurance (S1/S2)
```

## Communication Cadence

| Severity | Initial | Updates | Resolution |
|----------|---------|---------|-----------|
| S1 | 15 min | Every 30 min | Within 2 hr |
| S2 | 30 min | Every 2 hr | Within 4 hr |
| S3 | 2 hr | Daily | Within 24 hr |
| S4 | 8 hr | As needed | With closure |

## Regulatory Timelines

| Regulation | Deadline | Recipient |
|-----------|---------|-----------|
| GDPR Art. 33 | 72 hours | Supervisory authority |
| HIPAA | 60 days | HHS + affected individuals |
| SEC (8-K) | 4 business days | SEC + investors |
| PCI DSS | Immediately | Card brands + acquirer |

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Stakeholder map includes all internal and external parties
- [ ] Templates approved by legal and PR
- [ ] Regulatory timelines documented
- [ ] Communication channels tested
- [ ] Plan exercised in tabletop annually
