<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-incident-communication-plans
description: >-
  Implements structured incident communication plans including stakeholder
  notification, executive briefings, status cadence management, and regulatory
  disclosure coordination during security incidents.
domain: cybersecurity
subdomain: incident-response
tags:
  - incident-communication
  - stakeholder-management
  - executive-briefing
  - crisis-communication
  - notification-templates
  - status-updates
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Incident Communication Plans

## Overview

Effective incident communication is as critical as technical response. Poor
communication during incidents leads to duplicated effort, delayed containment,
regulatory penalties, and reputational damage. This skill implements structured
communication plans covering internal escalation, executive briefings, technical
team coordination, external stakeholder notification, and regulatory disclosure
timelines.

Communication failures are the #1 cause of incident response delays. A predefined
communication plan with templates, escalation matrices, and cadence schedules
eliminates decision paralysis during high-pressure incidents.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| PagerDuty / Opsgenie | On-call escalation | SaaS platform |
| Slack / Teams | Secure incident channel | Existing deployment |
| TheHive | Case management | `docker pull thehiveproject/thehive` |
| Jira Service Management | Ticket tracking | SaaS platform |
| Secure email / Signal | Out-of-band comms | Pre-configured |

## Key Concepts

### Communication Tiers

| Tier | Audience | Cadence | Content Level |
|------|----------|---------|---------------|
| T1 | IR Team (technical) | Real-time (chat) | Full technical detail |
| T2 | CISO / Security Leadership | Every 2 hours (P1) | Impact + actions |
| T3 | Executive / Board | Every 4-8 hours (P1) | Business impact summary |
| T4 | Legal / Compliance | As needed | Regulatory implications |
| T5 | External (customers, media) | Per legal guidance | Approved statements only |

### Escalation Matrix

```
P1 Critical:
  0 min  → IR Lead + SOC Manager (auto-page)
  15 min → CISO notification
  30 min → Legal counsel briefing
  1 hr   → CTO/CEO awareness (if data breach confirmed)
  4 hr   → Board notification (if material impact)

P2 High:
  0 min  → IR Lead (auto-page)
  30 min → SOC Manager
  2 hr   → CISO briefing
  Next business day → Executive summary
```

### Communication Channel Security

During incidents, assume the attacker may have access to corporate email and
chat. Use pre-established out-of-band channels:

- **Signal group** for executive communication
- **Separate Slack workspace** (not corporate) for IR coordination
- **Bridge phone line** for verbal briefings
- **Encrypted email** for written status reports

## Workflow

### Step 1 — Activate Incident Communication Plan

```bash
# Create dedicated Slack channel
curl -X POST "https://slack.com/api/conversations.create" \
  -H "Authorization: Bearer $SLACK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"inc-2026-0342-response","is_private":true}'

# Page on-call IR team via PagerDuty
curl -X POST "https://events.pagerduty.com/v2/enqueue" \
  -H "Content-Type: application/json" \
  -d '{
    "routing_key":"'"$PD_ROUTING_KEY"'",
    "event_action":"trigger",
    "payload":{
      "summary":"P1 Security Incident - Active compromise detected",
      "severity":"critical",
      "source":"SIEM",
      "component":"production-web"
    }
  }'
```

### Step 2 — Issue Initial Notification

```
INITIAL INCIDENT NOTIFICATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Incident ID:     INC-2026-0342
Severity:        P1 — Critical
Status:          ACTIVE — Investigation
Detected:        2026-03-17T14:23:00Z
Classification:  [Unauthorized Access / Malware / Data Breach]

IMPACT SUMMARY
Affected systems: [list]
Business impact:  [description]
Data at risk:     [type and volume if known]

CURRENT ACTIONS
1. IR team assembled and investigating
2. Affected systems isolated
3. Evidence preservation in progress

NEXT UPDATE: [time] or sooner if status changes
IR Lead: [name] | Bridge: [number] | Channel: #inc-2026-0342
```

### Step 3 — Establish Status Update Cadence

```
STATUS UPDATE — INC-2026-0342
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Update #:        3
Time:            2026-03-17T18:00:00Z
Status:          ACTIVE — Containment
IR Phase:        Containment / Eradication

SINCE LAST UPDATE
- Identified patient zero: [hostname]
- Lateral movement to 3 additional hosts confirmed
- C2 domain blocked at perimeter firewall
- Memory images acquired from all affected hosts

CURRENT RISK
- Credential exposure scope: [X accounts]
- Data exfiltration: [confirmed/investigating/ruled out]

NEXT STEPS
1. Complete credential rotation for affected accounts
2. Analyze memory images for additional IOCs
3. Verify containment boundaries hold

BLOCKERS: [none / list]
NEXT UPDATE: 2026-03-17T22:00:00Z
```

### Step 4 — Executive Briefing Template

```
EXECUTIVE INCIDENT BRIEF — CONFIDENTIAL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Date:            2026-03-17
Incident:        INC-2026-0342
Classification:  Unauthorized Access — Active

BUSINESS IMPACT
- [X] customer-facing systems affected
- Estimated downtime: [hours]
- Revenue impact: [estimate if known]
- Regulatory notification: [required/not required/under assessment]

ROOT CAUSE (preliminary)
[One paragraph — what happened, how, when]

RESPONSE STATUS
Containment:     [Complete / In Progress / Not Started]
Eradication:     [Complete / In Progress / Not Started]
Recovery:        [Complete / In Progress / Not Started]

DECISIONS NEEDED
1. [Decision with options and recommendation]
2. [Decision with options and recommendation]

TIMELINE TO RESOLUTION: [estimate]
```

### Step 5 — Close Incident Communications

```
INCIDENT CLOSURE NOTIFICATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Incident ID:     INC-2026-0342
Status:          CLOSED
Duration:        [X hours/days]
Final Phase:     Recovery Complete

SUMMARY
[2-3 sentences: what happened, impact, resolution]

KEY METRICS
- Time to detect:    [hours]
- Time to contain:   [hours]
- Time to eradicate: [hours]
- Time to recover:   [hours]
- Systems affected:  [count]
- Accounts reset:    [count]

POST-INCIDENT REVIEW: Scheduled [date]
AFTER-ACTION REPORT: Due [date]
```

## Verification

- [ ] Dedicated incident channel created with restricted access
- [ ] On-call IR team paged within SLA (P1: 15 min)
- [ ] Initial notification sent to all required stakeholders
- [ ] Status update cadence established and maintained
- [ ] Executive briefings delivered at required intervals
- [ ] Legal counsel engaged for potential breach notification
- [ ] Out-of-band communication channel verified functional
- [ ] Incident closure notification distributed to all stakeholders

## References

- NIST SP 800-61r3: Section 3.2 — Incident Communication
- SANS Incident Handler's Handbook — Communication Section
- FIRST PSIRT Services Framework
- ISO/IEC 27035: Information Security Incident Management
- PagerDuty Incident Response Guide: https://response.pagerduty.com
