Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we tell staff and customers about an outage, and what do we say?

6 decision pointsThe pack behind this answer: Business Continuity, Disaster Recovery & Cyber Resilience

Add to board memo

The short answer

Recommendation
After the crisis lead declares the disruption, tell staff within one hour and affected customers within two, then update at least every four hours until recovery ends. Use the approved outage messages, and switch to P09's if an attack is suspected.
Reasoning
People act on what they are told, so staff hear first because they run the workaround and answer customers. Each message gives the same four answers from one facts sheet, and promises a time only when the technical recovery lead has given one. The clocks run from the declaration, so declaring early costs one short message.
Considerations
  • The times are internal defaults in the CISO Times continuity pack, counted from the crisis lead's declaration. They are starting points. Check your customer contracts and service levels first, because they may set shorter or different times.
  • A cyber incident uses P09's Incident Communications Template Set, not these messages. A suspected attack moves the messages to P09 at once.
  • No message in this set is a notice to an authority. Whether one is due is decided under P09, and P18 covers the notice.
  • Legal clocks (NIS2 24 hours, GDPR 72 hours, DORA, SEC Form 8-K) start at awareness, classification or a materiality decision, not at the crisis lead's declaration. P09 defines awareness and holds the clocks.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartA critical service is disruptedDecisionHas the crisis lead declared the disruption?OutcomeAsk the crisis lead to declare it, and declare earlyDecisionDoes anything suggest an attack?OutcomeUse P09's communications, not this setStepFill every message from one facts sheet, in four answersDecisionHas the technical recovery lead given a time for the repair?StepGive that time and what it depends onStepSay you do not yet know a time, and when you will tell themStepGet each message approved, then log itStepTell staff within 1 hour of the declaration (OM-01)StepTell affected customers within 2 hours (OM-02)DecisionIs anyone but the communications lead about to speak outside?StepPass the question to the communications leadDecisionHas anyone now suspected an attack?OutcomeTell the incident manager; the next message comes from P09DecisionHas the crisis lead declared the end of recovery?StepSend an update at least every 4 hours, and at each changeOutcomeSend the service restored message (OM-04)

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 19 steps.

  1. Start

    A critical service is disrupted

    People decide what to do from what they are told. Customers who hear nothing go elsewhere, and staff improvise. The pack gives eight approved messages, OM-01 to OM-08, so the communications lead fills in facts instead of writing from a blank page. The set is for disruptions that are not cyber incidents.

    In the pack

  2. Decision

    Has the crisis lead declared the disruption?

    Every time in this set is counted from the moment the crisis lead declares the disruption, not from when the fault began. If you do not know whether it has been declared, ask, because without a declaration no clock is running.

    In the pack

    See also

  3. Outcome

    Ask the crisis lead to declare it, and declare early

    A declaration for an outage that clears in ten minutes costs one short message. The clocks start only when the crisis lead declares. If anyone suspects an attack, tell the incident manager and use P09's communications instead.

    In the pack

    See also

  4. Decision

    Does anything suggest an attack?

    Nothing may suggest an attack for this set to apply. It covers failures such as a failed server, data centre, line or site, or a faulty update. If anyone suspects an attack, answer yes: whoever suspects it tells the incident manager.

    In the pack

  5. Outcome

    Use P09's communications, not this set

    In a cyber incident this set is not used. The messages come from P09's Incident Communications Template Set, CT-01 to CT-10, approved and sent as P09 sets out. P09 also decides whether a notice to an authority is due. This flow does not repeat those rules.

    In the pack

  6. Step

    Fill every message from one facts sheet, in four answers

    Every message answers four questions in order: what has happened, in facts only; what still works, including the workaround; what to do, the one or two things this reader should do or not do; and when the next update will come. Do not guess the cause and do not blame a supplier. Do not offer money or accept fault without the approver the pack leaves you to name. A figure changes on the facts sheet first.

    In the pack

  7. Decision

    Has the technical recovery lead given a time for the repair?

    The technical recovery lead is the only source of a time for the repair. A supplier's estimate reaches the messages through them, and a supplier's contracted repair time is the longest the contract allows, not a promise to pass on. If you are not sure, answer no.

    In the pack

  8. Step

    Give that time and what it depends on

    State only the time the technical recovery lead has given, with what it depends on. A time given and then missed costs more trust than no time at all.

    In the pack

  9. Step

    Say you do not yet know a time, and when you will tell them

    The pack's wording is that you do not yet know and will tell them as soon as you do. Staff may plan around a supplier's contracted repair time, but no message to customers passes it on as a promise.

    In the pack

  10. Step

    Get each message approved, then log it

    The crisis lead approves each message before it goes, or the deputy when the crisis lead cannot be reached within 15 minutes, the pack's default. The words are approved in advance, so the approver checks the facts against the facts sheet. A message changed after approval is a new version and is approved again. Log every message sent.

    In the pack

  11. Step

    Tell staff within 1 hour of the declaration (OM-01)

    Staff run the workaround and answer customers, so they hear first. Send it even when little is known: a short message on time is worth more than a full one late. Each site or unit continuity lead tells their own people through the call tree and briefings.

    In the pack

  12. Step

    Tell affected customers within 2 hours (OM-02)

    Tell the customers whose service is affected, not every customer, and lead with what still works and what to do. Copy the message to the staff who had OM-01, so none hears the news from a customer first. Prepare the website notice, the call-handling script and the media holding line with it.

    In the pack

  13. Decision

    Is anyone but the communications lead about to speak outside?

    Outside a cyber incident the pack keeps the same discipline: only the communications lead, or a spokesperson they name, speaks to journalists or posts in public about the disruption. Call handlers answer from the call-handling script. If you are not sure who is speaking, answer yes.

    In the pack

  14. Step

    Pass the question to the communications lead

    Staff do not talk or post about the disruption outside the organisation. Pass customers' questions to the customer contact team and journalists' questions to the communications lead. Suppliers do not speak for you: the supplier notice asks them to pass every question on.

    In the pack

  15. Decision

    Has anyone now suspected an attack?

    A disruption that began as a failure can turn out to be an attack. Ask this before every update. If anyone suspects it, or you do not know, answer yes.

    In the pack

  16. Outcome

    Tell the incident manager; the next message comes from P09

    The communications lead sends nothing more from this set. The messages already sent stand, and nobody outside is told that the cause has changed until P09's approved messages say so. No message promises a failover or a restore, because nothing is restored until the incident manager confirms the copy or site can be trusted.

    In the pack

  17. Decision

    Has the crisis lead declared the end of recovery?

    Send the closing message when the crisis lead declares the end of recovery. Until then updates continue.

    In the pack

  18. Step

    Send an update at least every 4 hours, and at each change

    Updates run from the customers' first message. Send one on time even when nothing has changed, and say so. Staff see each customer message when it goes out, so they never wait more than 4 hours for word. The pack's figure is a default your own standard may change.

    In the pack

  19. Outcome

    Send the service restored message (OM-04)

    It is the last message about the disruption and goes to everyone told earlier: what is back and since when, what happens to the backlog, and a thank you. Give a contact for anyone still affected.

    In the pack

Practical checklist

  1. Confirm the crisis lead has declared the disruption and note the time.
  2. Check that nothing suggests an attack.
  3. Fill each message from one facts sheet, with a repair time only if the technical recovery lead gave one.
  4. Get the crisis lead, or the deputy, to approve each message and log it.
  5. Tell staff within the hour and affected customers within two, with a copy to staff.
  6. Let only the communications lead or a named spokesperson speak outside.
  7. Update at least every four hours, and at each change, until the end of recovery.

Evidence to have ready

  • The declaration time and the deadline set for each message.
  • Each message as sent, with its approver, channel and time in the approval log.
  • The facts sheet, with a dated copy each time a figure changed.

Assumptions

  • The crisis lead has declared, or is about to declare, the disruption of a critical service, and nothing suggests an attack.
  • The communications lead and a deputy are named, and the outage messages are approved in advance.
  • A facts sheet exists, and each audience has a channel that does not depend on the systems most likely to fail.

Not covered here