{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/communication-plan","url":{"en":"https://atlas.maintz.dev/en/terms/security/communication-plan/","da":"https://atlas.maintz.dev/da/terms/security/communication-plan/"},"term":{"en":"Communication plan","da":"Kommunikationsplan"},"aka":{"en":["crisis communication plan"],"da":["krisekommunikationsplan"]},"domain":["security"],"cluster":"incident-response","layer":"governance","status":"current","summary":{"en":"A plan for who tells what to whom during a crisis - staff, customers, authorities and the press.","da":"En plan for, hvem der siger hvad til hvem under en krise - medarbejdere, kunder, myndigheder og presse."},"body":{"formal":{"en":"The part of the contingency plan that names who may speak for the organisation and sets approval steps, prepared messages, contact lists and reporting deadlines for internal and external communication during an incident.","da":"Den del af beredskabsplanen, der udpeger talspersoner og fastlægger godkendelsesgange, forberedte budskaber, kontaktlister og frister for indberetning ved intern og ekstern kommunikation under en hændelse."},"plain":{"en":"Like agreeing in advance who in the family calls grandma with bad news, so she does not hear it first from the neighbours.","da":"Ligesom at aftale på forhånd, hvem i familien der ringer til bedstemor med dårlige nyheder, så hun ikke hører det fra naboerne først."},"inPractice":{"en":"When member data leaks from a pension fund, the plan says only the director speaks to the press, members get a prepared message in e-Boks, and Datatilsynet is notified within 72 hours.","da":"Da medlemsdata lækker fra en pensionskasse, siger planen, at kun direktøren udtaler sig til pressen, medlemmerne får en forberedt besked i e-Boks, og Datatilsynet får besked inden for 72 timer."},"whyItMatters":{"en":"Confused or late messages can do more harm to trust than the incident itself, and missing a reporting deadline set by law can bring fines.","da":"Forvirrende eller sene budskaber kan skade tilliden mere end selve hændelsen, og en overskredet frist for indberetning, som loven kræver, kan give bøder."}},"deepDive":{"en":"NIST SP 800-34 Rev. 1 lists the crisis communications plan as one of the plan types around an information system contingency plan, and ISO 22301:2019 clause 8.4.3 requires procedures for warning and communication, covering communication with interested parties, the media and, where relevant, national or regional authorities, including how communication is recorded. NIST SP 800-61 addresses the same need from the incident-response side: who may share what with law enforcement, other response teams, suppliers, customers and the media, and the rule that information sharing is decided in advance rather than improvised.\n\nA working plan contains a stakeholder map (staff, management, board, customers, citizens or patients, suppliers, insurers, regulators, police, media, partners), named spokespersons with deputies, an approval chain with a maximum turnaround time, pre-approved holding statements for the most likely scenarios, and channel choices for each audience. It also defines a single source of truth, usually a situation log owned by the crisis team, from which all messages are derived, so that the press office, customer service and the regulator do not receive conflicting versions.\n\nThe legal deadlines drive the timing more than any communications preference. Under GDPR Article 34 the controller must inform affected data subjects without undue delay when a breach is likely to result in a high risk to them, in clear and plain language describing the nature of the breach, the likely consequences, the measures taken and a contact point. Article 34(3) allows a public communication instead when individual notice would involve disproportionate effort. NIS2 Article 23(1) requires entities, where appropriate, to notify recipients of their services of significant incidents likely to affect them, and Article 23(2) to tell recipients potentially affected by a significant cyber threat what measures they can take. These external messages and the regulatory reports must be consistent, because regulators and journalists compare them.\n\nCyber incidents add constraints that ordinary crisis communication does not face. Email, Teams and the intranet may be compromised or monitored by the attacker, so the plan needs out-of-band channels such as phone trees on paper, SMS services or a separate messaging platform prepared in advance. Statements should avoid premature claims such as \"no data was taken\" before forensics confirms it, since corrections damage trust more than an honest \"we are investigating\". Ransomware groups also contact customers and journalists directly, which the plan should anticipate.","da":"NIST SP 800-34 Rev. 1 nævner krisekommunikationsplanen som en af de plantyper, der omgiver beredskabsplanen for et informationssystem, og ISO 22301:2019 afsnit 8.4.3 kræver procedurer for varsling og kommunikation, herunder kommunikation med interessenter, medier og, hvor det er relevant, nationale eller regionale myndigheder, samt hvordan kommunikationen registreres. NIST SP 800-61 dækker samme behov fra hændelseshåndteringens side: hvem der må dele hvad med politiet, andre responsteams, leverandører, kunder og medier, og princippet om, at deling af oplysninger besluttes på forhånd i stedet for at blive improviseret.\n\nEn brugbar plan indeholder et interessentkort (medarbejdere, ledelse, bestyrelse, kunder, borgere eller patienter, leverandører, forsikringsselskab, tilsynsmyndigheder, politi, medier, samarbejdspartnere), navngivne talspersoner med stedfortrædere, en godkendelsesgang med en maksimal svartid, forhåndsgodkendte standardudmeldinger for de mest sandsynlige scenarier og valg af kanal for hver målgruppe. Den fastlægger også én fælles sandhed, typisk en situationslog, som krisestaben ejer, og som alle budskaber udledes af, så presseafdelingen, kundeservice og tilsynsmyndigheden ikke får modstridende versioner.\n\nDe lovbestemte frister styrer timingen mere end nogen kommunikationsmæssig præference. Efter databeskyttelsesforordningens artikel 34 skal den dataansvarlige uden unødig forsinkelse underrette de registrerede, når et brud sandsynligvis indebærer en høj risiko for dem, i et klart og enkelt sprog, der beskriver bruddets karakter, de sandsynlige konsekvenser, de trufne foranstaltninger og et kontaktpunkt. Artikel 34, stk. 3, tillader en offentlig meddelelse i stedet, når individuel underretning vil kræve en uforholdsmæssig indsats. NIS2 artikel 23, stk. 1, kræver, at enheder, hvor det er relevant, underretter modtagerne af deres tjenester om væsentlige hændelser, der kan påvirke dem, og stk. 2, at modtagere, der kan blive berørt af en væsentlig cybertrussel, får at vide, hvilke foranstaltninger de kan træffe. Disse eksterne budskaber og indberetningerne til myndighederne skal hænge sammen, for både myndigheder og journalister sammenligner dem.\n\nCyberhændelser giver begrænsninger, som almindelig krisekommunikation ikke møder. Mail, Teams og intranettet kan være kompromitteret eller overvåget af angriberen, så planen skal have kanaler uden for det normale netværk, fx telefonkæder på papir, SMS-tjenester eller en separat beskedplatform, der er forberedt på forhånd. Udmeldinger bør undgå forhastede påstande som \"der er ikke taget data\", før den tekniske undersøgelse har bekræftet det, fordi rettelser skader tilliden mere end et ærligt \"vi undersøger sagen\". Ransomware-grupper kontakter desuden selv kunder og journalister, hvilket planen bør tage højde for."},"howTo":{"steps":{"en":["Map every audience you may have to reach in an incident - staff, management, board, customers or citizens, suppliers, insurer, regulators, police, media and partners - and note who owns each relationship.","Name a spokesperson and a deputy for each audience, and agree an approval chain for outgoing messages with a maximum turnaround time, so a statement is never stuck waiting for one person.","Write pre-approved holding statements for the likeliest scenarios, such as ransomware, a data leak and a long IT outage, that say what you know, what you are doing and when the next update comes.","Choose a channel for each audience and prepare out-of-band alternatives in advance, such as a paper phone tree, an SMS service or a separate messaging platform, in case email, Teams and the intranet are down or watched by the attacker.","Agree that one situation log owned by the crisis team is the single source of truth, and derive every message to the press, customer service and regulators from it so the versions never conflict.","Build the legal duties into the plan - notifying Datatilsynet within 72 hours and informing affected people without undue delay when a breach puts them at high risk, and telling service recipients about significant incidents under NIS2 - and name who drafts each message.","Keep the plan, contact lists and statements on paper or offline, and test them in exercises at least once a year, including a round where the normal channels are unavailable."],"da":["Kortlæg alle de målgrupper, I kan få brug for at nå under en hændelse - medarbejdere, ledelse, bestyrelse, kunder eller borgere, leverandører, forsikringsselskab, tilsynsmyndigheder, politi, medier og samarbejdspartnere - og notér, hvem der ejer hver relation.","Udpeg en talsperson og en stedfortræder for hver målgruppe, og aftal en godkendelsesgang for udgående budskaber med en maksimal svartid, så en udmelding aldrig hænger fast hos én person.","Skriv forhåndsgodkendte standardudmeldinger til de mest sandsynlige scenarier, fx ransomware, et datalæk og et langvarigt IT-nedbrud, der siger, hvad I ved, hvad I gør, og hvornår næste opdatering kommer.","Vælg en kanal til hver målgruppe, og forbered alternativer uden for det normale netværk, fx en telefonkæde på papir, en SMS-tjeneste eller en separat beskedplatform, hvis mail, Teams og intranet er nede eller overvåges af angriberen.","Aftal, at én situationslog, som krisestaben ejer, er den fælles sandhed, og udled alle budskaber til presse, kundeservice og myndigheder af den, så versionerne aldrig modsiger hinanden.","Byg de lovbestemte pligter ind i planen - anmeldelse til Datatilsynet inden 72 timer og underretning af de berørte uden unødig forsinkelse, når et brud giver høj risiko for dem, samt underretning af modtagerne af jeres tjenester om væsentlige hændelser efter NIS2 - og udpeg, hvem der skriver hvert budskab.","Opbevar plan, kontaktlister og udmeldinger på papir eller offline, og test dem i øvelser mindst én gang om året, også i en runde, hvor de normale kanaler ikke virker."]},"pitfalls":{"en":["Claiming early that no data was taken before the forensic work has confirmed it, and then having to correct the statement.","Relying on email and Teams to coordinate the response while the attacker may be reading them.","Letting the press office, customer service and the report to the authorities tell different versions of the same incident.","Forgetting that ransomware groups may contact customers and journalists directly before you have said anything."],"da":["At sige tidligt, at der ikke er taget data, før den tekniske undersøgelse har bekræftet det, og derefter måtte rette udmeldingen.","At koordinere indsatsen via mail og Teams, mens angriberen måske læser med.","At lade presseafdelingen, kundeservice og indberetningen til myndighederne fortælle hver sin version af den samme hændelse.","At glemme, at ransomware-grupper kan kontakte kunder og journalister direkte, før I selv har sagt noget."]},"guides":[{"title":"Plan - Your cyber incident response processes","url":"https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes","publisher":"NCSC UK","tier":"official-doc"},{"title":"NIST SP 800-34 Rev. 1 - Contingency Planning Guide for Federal Information Systems","url":"https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final","publisher":"NIST","tier":"standard"},{"title":"Håndtering af brud på persondatasikkerheden","url":"https://www.datatilsynet.dk/regler-og-vejledning/behandlingssikkerhed/haandtering-af-brud-paa-persondatasikkerheden","publisher":"Datatilsynet","tier":"official-doc","lang":"da"},{"title":"Indberet en sikkerhedshændelse","url":"https://www.sikkerdigital.dk/virksomhed/naar-skaden-er-sket/indberet-en-sikkerhedshaendelse","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"}]},"edges":[{"type":"part-of","to":"security/contingency-plan","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/data-breach","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/incident-response","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/crisis-management","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management","url":"https://doi.org/10.6028/NIST.SP.800-61r3","tier":"standard","publisher":"NIST"}],"draft":true}