Whether caused by cyber threat actors, human error, equipment failure, or natural hazards, service outages can create disruption and societal panic even without speculation from end users and the public as added factors. Outages at one organization may cascade across interconnected systems, increasing the uncertainty and potential for panic.
This guidance, entitled “Communicating Under Pressure: Best Practices for Service Providers” and released by the Cybersecurity and Infrastructure Security Agency (CISA) in collaboration with the Federal Bureau of Investigation (FBI) and international partners, describes how service providers can prepare and execute clear, timely, and audience-appropriate messaging that articulates accurate information while still aligning with operational security, law enforcement, and containment efforts.
Key actions for communicating during service outages:
- Lead with confirmed facts, scope, and affected systems
- Tailor updates to each audience
- State what you know, don’t know and what is under investigation
- Explain operational impact and any customer actions
- Avoid vague language, speculation, and public relations “spin”
- Provide frequent, time-stamped updates
- Align messaging with legal, regulatory, and law enforcement requirements
Service outages alone have the potential to cause enough damage, disruption, and societal panic without speculation and uncertainty from end users and the public as added factors.
Confirm Cause
Moreover, with the evolving and heightened geopolitical tensions around the world, it is important to identify the confirmed, known cause upfront and clearly articulate what it is and what it is not to audiences.
If the root cause is still under investigation, it is equally important not to release premature conclusions. Effective communication gives important context for readers, limits speculation, and drives the focus toward the root cause, mitigations, and solutions.
However, when service disruptions end up known or suspected to be the result of cyber threat actors, it is critical any outward communications account for operational security and align with any law enforcement investigations or containment efforts.
The authoring agencies recommend service providers develop a service outage communications plan that defines triggers, escalation paths, and procedures and includes templates for status pages; customer and partner notices; and regulatory communications.
Keys to Communication
To communicate effectively during an outage, service providers should establish and exercise the following key structures before a crisis:
- Cross-functional incident team. Include engineering and operations, communications and public affairs, legal, risk and compliance, and customer support and sales, with primary and alternate points of contact.
- Government relations. Consider including a government relations lead in cases where government stakeholders end up affected by incidents.
- Clear roles and authority. Designate an incident lead, communications lead, and a spokesperson with predefined approval paths and escalation criteria.
- Parallel, synchronized workstreams. Technical teams diagnose and remediate the root cause, communications manage public messaging and stakeholders, and leadership drives strategy and regulatory outreach.
- Legal team. The legal teams help ensure communications, regulatory obligations, contractual considerations, and risk management activities are appropriately aligned throughout the incident.
- Backup communications methods. Establish and regularly test backup communication methods for informing internal and external stakeholders (e.g., backup email and messaging, SMS and phone trees, radios, out-of-band communications, and conference bridges) for moments where primary systems end up degraded or compromised.
- Pre-planned playbooks and procedures. Communication plans should have defined triggers, escalation paths, and procedures and should be reviewed and refreshed regularly.
- Message consistency. Ensure messaging to internal audiences is consistent with external communications, when possible.
CI Fortify
CISA’s CI Fortify initiative provides information and resources that help critical infrastructure organizations prepare to isolate and recover their vital OT systems during a major cyber incident or crisis.
Changes in service availability, whether from outages or isolation as a defensive strategy, require transparent and ongoing communication to help end users minimize operational impact, limit speculation, and preserve trust.
For emergency planning purposes, critical infrastructure owners and operators should assume telecommunications services may end up disrupted or otherwise unreliable, making it crucial for organizations to have crisis communications plans in place that integrate backup communication methods and understand the type of communication they should expect from their service providers.
Click here for more on the guidance.