Software Engineering Institute

Incident response organizations often overlook the importance of communications – with their constituents, the general public, and the media. This guide provides cybersecurity centers and incident response teams with high-level guidance on effective communications planning, and considerations and best practices for communications responsibilities in support of incident response services. Communications, both in times of crisis and during normal operations, are essential to the overall success and sustainability of your team. How you plan for and manage these communications and how they are received by your audience will influence your trustworthiness, reputation, and ultimately your ability to perform incident management services effectively. This document leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Forum of Incident Response and Security Teams (FIRST) CSIRT Services Framework to present communications responsibilities as part of both the standard incident management lifecycle and as an integral piece of crisis management support.