How your organization should communicate BEFORE a cyberattack

There are 7 ways CISOs can prepare their company for a cyber incident.

In a 2022 study, approximately 88% of Chief Information Security Officers (CISOs) surveyed reported to have experienced a cyber incident within the year. Unfortunately, in this day and age, it's not a matter of if, but a matter of when your organization will face a cyberattack.

It’s important to prepare for a cyberattack well in advance by communicating with your critical audiences: board, leadership, management, employees, customers, industry, regulatory agencies, government, and other stakeholders.

Audio: Listen to this article.

When it comes to cybersecurity, a company's data, including company financials, employee data, social security numbers, and other records, are sensitive. A company's employees should always be on guard because a cybersecurity incident impacts you, your family, your employer, your coworkers, your customers/clients, and more.

Any vulnerability is a potential cyberattack. And if the attack comes from your account, your device, or your mistake, it will have serious ramifications for the entire company, its employees, and its clients.

We are a trusted public relations advisor to cybersecurity companies and organizations seeking helpful expert guidance on corporate communication before, during, and after a cyber attack.

We developed seven ways to execute important internal and external communications within your company before a cyberattack occurs. 

Internal communication: 

1. Train, train, train your employees and executives.

The best way to inform your employees about best practices before a cyberattack is to train them. Incorporate cybersecurity training into initial assessments, initial training, and bi-monthly training. Then, progressively decrease the training to monthly and then quarterly, unless more frequent training is necessary. 

These training sessions should educate all employees and executives within the organization on the latest cybersecurity best practices and why those practices should be followed. Some training can include a series of blog posts on cybersecurity best practices from an industry expert, a series of mandatory lunch and learns, CBTs, and/or live seminars. 

If you don’t train them on cybersecurity, they’ll never learn much about it.

Besides training current employees, you should always onboard new employees with cybersecurity training as well. New employees can then be well aware of company cybersecurity policies and plans. Once onboarded, they should follow the same training flow as previously mentioned.

2. Communicate with employees in real time.

Send real-time communications and alerts when there are new and developing threats to keep all employees up-to-date on important cybersecurity updates. If everyone is aware of potential cyber incidents, they’ll be more alert for any cyberattack attempts.

3. Have a crisis communications plan.

Plan. Plan. Plan. If you don’t have steps in place for employees to follow, then something bad is bound to happen. Have a documented plan for what employees should do if they were subjected to a potential cyberattack or if they need to report an attempted attack. 

This plan should walk them through steps they need to take and direct them to the appropriate individual within the company to report to. If a cyberattack has occurred, it’s important employees don’t panic and have guided direction to help minimize the damage. 

4. Practice with a crisis simulation. 

This is an extension of training. Instead of only sharing information with your employees, simulate a cyberattack so employees can put their training to the test and learn more in-depth. This also puts your crisis communications plan to test. If something is unclear in your plan, you’ll be able to define it more clearly so no one will have questions during a real emergency. 

It’s always beneficial to be over prepared, especially when it comes to cybersecurity.

External communication:

5. Communicate to the public about your use of cybersecurity best practices.

It’s important to let your clients/customers know you are keeping their information safe. Communicate with them about your best practices. If a cyberattack does occur, you’ll have a better relationship with the public if you’ve gained their trust through promoting your practices. 

6. Educate the public on cybersecurity protocols through monthly newsletters.

Besides promoting your company’s practices, let your consumers know you have protocols in place as well. You can mention in your monthly e-newsletters you have a process in place to help continue protecting their information even if a cyberattack does occur.

7. Establish your CISO as an expert to the public.

To have the best relationship with the public and the trust of your consumers, you need to establish your CISO as an expert. This can occur with earned media, cybersecurity advice in monthly newsletters, or a cybersecurity video series for employees and the public to view.

It’s important to communicate both internally and externally about cybersecurity best practices and what to do if a cyberattack occurs. Both your employees and customers want to feel well prepared and know the steps to take in such an incident.

Your internal corporate communications or external public relations firm can be your CISO's best friend when it comes to protecting the organization and its employees. 

If you're currently experiencing a cybersecurity incident, book a crisis cybersecurity consultation. Not under duress but looking for help communicating about cybersecurity before a potential cyber attack? We can help you. Book a free cybersecurity consultation. 

Photo by Jopwell