--- title: Three communications best practices for incident handlers description: Three communications best practices for incident handlers image: https://blog.exigence.io/hubfs/video-conference-gaeb10ea43_1280.jpg --- ![CORRECT LOGO FOR BLOG](https://blog.exigence.io/hs-fs/hubfs/CORRECT%20LOGO%20FOR%20BLOG.png?width=143&name=CORRECT%20LOGO%20FOR%20BLOG.png "CORRECT LOGO FOR BLOG") - [Home](https://www.exigence.io/) - Solution - [Enterprise IT ops and security](https://www.exigence.io/enterprise-it-ops-security) - [Incident Response Firms](https://www.exigence.io/incident-response-firms) - [MSPs & MSSPs](https://www.exigence.io/msps-mssps) - [Platform](https://www.exigence.io/platform) - [Case Studies](https://www.exigence.io/case-studies) - [McGraw Hill](https://www.exigence.io/case-study-mhe) - [Software Giant](https://www.exigence.io/case-study-software-company) - [Thales](https://www.exigence.io/case-study-thales) - [Financial Solutions Provider](https://www.exigence.io/case-study-financial-solutions-provider) - [DataScan](https://www.exigence.io/case-study-datascan) - Company - [About Us](https://www.exigence.io/about-us) - [Careers](https://www.exigence.io/careers) - [Blog](https://blog.exigence.io/) - [Get in touch](https://www.exigence.io/contact-us) # Blog ![](https://blog.exigence.io/hubfs/Exigence_March2019/image/Blog%20ListingPage-Image.png) - [All Posts](https://blog.exigence.io) - [Tech Ops](https://www.exigence.io/blog/tag/tech-ops) - [Critical Incident Management](https://www.exigence.io/blog/tag/critical-incident-management) # [All Posts](https://blog.exigence.io) Sign Up - [All Posts](https://blog.exigence.io) - [Critical Incident Management](https://blog.exigence.io/tag/critical-incident-management) - [CyberSecurity Incident Response](https://blog.exigence.io/tag/cybersecurity-incident-response) - [Automating Critical Incident Management](https://blog.exigence.io/tag/automating-critical-incident-management) Share Post Share Link Cancel Copy Link ![Noam Morginstin](https://blog.exigence.io/hubfs/Noam%20Pic.jpg) Noam Morginstin Admin Mar 06 4 min read Share Post # Three communications best practices for incident handlers ![video-conference-gaeb10ea43_1280](https://blog.exigence.io/hs-fs/hubfs/video-conference-gaeb10ea43_1280.jpg?width=1280&name=video-conference-gaeb10ea43_1280.jpg) The importance of well-managed communications when handling IT and security incidents cannot be overstated. If updates are not communicated in a timely and accurate manner, **misunderstandings**, **misalignment**, and costly **errors** will occur. Not to mention, resolution will be prolonged. And if highly **sensitive information** is communicated to those who should not be privy to such, then the risk of **legal ramifications** is high, as would be the damage. This is why it’s so important to make sure that the following three key best practices are in place for driving effective communications during incident handling: - **Assigning a communications lead** to be the single point of contact from trigger to lessons learned. - **Assuring real-time, personalized updates** that are tailored for specific stakeholders and groups and which are dispatched at every step of the incident resolution journey. - **Protecting legal privilege** to avoid the risk and damage of exposure in court.   Let’s take a closer look.   # Assigning a communications lead Incident communication is not just about the process of alerting users that there’s a breach, outage, or a degradation in performance. The incident **impacts** **multiple internal and external stakeholders**, including incident handlers, Sales, Marketing, management, Legal, PR, customers, and – of course – the breach insurance carrier. They all need data.   *Controlling the conversation* Accordingly, it is critical to assign the communications task to someone who will know **when** to communicate **what** to **whom**. And this someone should also have the **business acumen** to control the conversation with each audience type, with just the information they need – in a way that will enable them to **carry out their duties** (internal) or to **feel confident** (external) that competent and accountable professionals are carrying out the requisite tasks.   *Owning the message* Furthermore, it should be this person and this person only who serves as the **central point for crafting messages**. There are so many different nuances associated with each incident, where sensitivity to how these nuances should be communicated is critical. For example, it wouldn’t serve the organization well if the tech lead communicates to customers or other stakeholders that the resolution being considered for a security incident is to wipe the server and restore it from the back up. Customers may be concerned about the integrity of their personal data. Legal and management will be concerned about evidence preservation.   [![EBOOKDOWNLOAD](https://blog.exigence.io/hs-fs/hubfs/EBOOKDOWNLOAD.png?width=317&name=EBOOKDOWNLOAD.png)](https://info.exigence.io/the-7-key-capabilities-for-gaining-control-command-of-critical-incidents)   # Assuring real-time and personalized updates The incident journey is one that unfolds quickly and changes constantly. Incident handlers, management, and all the other stakeholders mentioned earlier need to be kept **appraised of the real-time status** of the incident, who is doing what, what actions have been taken, by whom, and what was the outcome of each. Accordingly, updates need to be sent in **real-time** and to the **right people** with the **right information**. Though, this can be a difficult task, when the incident lead and team are busy taking care of the actual incident. Chasing everyone for a status update, constructing a report, and sending it out in real time comes with a huge overhead. It’s time consuming, complex, and extremely challenging. What complicates matters even more is that the same update is not relevant for all involved. Each **communication needs to be tailored** to the intended audience. Executives are interested in different information than the NOC team, Legal, or Sales, for example. The key to overcoming the challenge is to **aggregate data from all relevant incident tools** and systems in one place and to be able to create **role-based updates** that are **compiled automatically** (as based on this data) and dispatched at the touch of a button.   # Protecting legal privilege  During the incident resolution effort, information is exchanged between and among many different parties. The information that is being shared can be very **sensitive**, the kind which the organization will not want to be read out during **evidence presentation in court**. However, difficult questions do need to be asked, and sensitive answers do need to be provided. The key to protecting this type of information exchange and to **minimizing the risk of losing legal privilege** and having confidential incident related communications and documents disclosed, is to assure that incident **communications take place exclusively in a closed system** that restricts access through **role-based permissions**.   [![Virtual War Room](https://no-cache.hubspot.com/cta/default/5278914/a7395683-2a53-4a74-a3a7-d684d6e9f07d.png)](https://cta-redirect.hubspot.com/cta/redirect/5278914/a7395683-2a53-4a74-a3a7-d684d6e9f07d)   # In conclusion There is no doubt, effective communication is strategic to skillful, accelerated, and successful incident resolution. And the key is to have: - **A communications lead with incident knowhow and business acumen** for crafting effective messages and controlling the conversation. - **Data aggregation, consolidation, and automation** for real-time updates that are tailored to each incident stakeholder type and can be created with one click. - **A closed system that limits communications through role-based permissions**, for assuring confidentiality and privilege protection.   To learn how Exigence can help you implement the three key best practices of effective incident communication, we invite you to reach out to book your free demo [here](https://calendly.com/exigence/exigencedemo?month=2022-01), or reach out to us at [info@exigence.io](mailto:info@exigence.io).   [![New call-to-action](https://no-cache.hubspot.com/cta/default/5278914/3bca5d96-909f-4490-9cda-2a4b47505f83.png)](https://cta-redirect.hubspot.com/cta/redirect/5278914/3bca5d96-909f-4490-9cda-2a4b47505f83) [Critical Incident Management](https://blog.exigence.io/tag/critical-incident-management)• [major incident management](https://blog.exigence.io/tag/major-incident-management)• [CyberSecurity Incident Response](https://blog.exigence.io/tag/cybersecurity-incident-response)• [Automating Critical Incident Management](https://blog.exigence.io/tag/automating-critical-incident-management) [Critical Incident Management](https://blog.exigence.io/tag/critical-incident-management)• [major incident management](https://blog.exigence.io/tag/major-incident-management)• [CyberSecurity Incident Response](https://blog.exigence.io/tag/cybersecurity-incident-response)• [Automating Critical Incident Management](https://blog.exigence.io/tag/automating-critical-incident-management) Share Link Cancel Copy Link ### Recent Posts [See All](https://blog.exigence.io) [![Global Industrial Leader Coordinates Severity 1 Incidents with Clarity and Speed](https://blog.exigence.io/hubfs/Gemini_Generated_Image_ocux07ocux07ocux.png "Global Industrial Leader Coordinates Severity 1 Incidents with Clarity and Speed")](https://blog.exigence.io/https/www.exigence.io/global-industry-giant) ## [Global Industrial Leader Coordinates Severity 1 Incidents with Clarity and Speed](https://blog.exigence.io/https/www.exigence.io/global-industry-giant) [![From plan to practice to prevail: my conversation with Chris Johnson, host of the MSSP 1337 podcast](https://blog.exigence.io/hubfs/Podcast%20blog%20post%20and%20Linkedin%20image.jpg "From plan to practice to prevail: my conversation with Chris Johnson, host of the MSSP 1337 podcast")](https://blog.exigence.io/from-plan-to-practice-to-prevail-my-conversation-with-chris-johnson-host-of-the-mssp-1337-podcast) ## [From plan to practice to prevail: my conversation with Chris Johnson, host of the MSSP 1337 podcast](https://blog.exigence.io/from-plan-to-practice-to-prevail-my-conversation-with-chris-johnson-host-of-the-mssp-1337-podcast) [![The 6th DORA requirement no one told you about](https://blog.exigence.io/hubfs/DORA.png "The 6th DORA requirement no one told you about")](https://blog.exigence.io/the-6th-dora-requirement-no-one-told-you-about) ## [The 6th DORA requirement no one told you about](https://blog.exigence.io/the-6th-dora-requirement-no-one-told-you-about) ### Take control of your critical incidents Get in touch and get started! [Schedule a Demo](https://calendly.com/exigence/60min?back=1) - © 2017-2020 by Exigence Ltd. - [info@exigence.io](mailto:info@exigence.io?subject=Hey%20there!%20(from%20the%20site)) - [US: +1-877-422-3833](tel:+1-877-422-3833) - [Privacy Policy](https://www.exigence.io/privacy-policy) - [![Twitter](https://blog.exigence.io/hubfs/Exigence_March2019/image/Twitter.png)](https://twitter.com/exigence_ltd) - [![Linkedin](https://blog.exigence.io/hubfs/Exigence_March2019/image/Linkedin.png)](https://www.linkedin.com/company/exigence-ltd-?trk=biz-companies-cym) - [![Twitter](https://blog.exigence.io/hubfs/Exigence_March2019/image/Twitter.png)](https://twitter.com/exigence_ltd) - [![Linkedin](https://blog.exigence.io/hubfs/Exigence_March2019/image/Linkedin.png)](https://www.linkedin.com/company/exigence-ltd-?trk=biz-companies-cym) - [Privacy Policy](https://www.exigence.io/privacy-policy) - [info@exigence.io](mailto:info@exigence.io?subject=Hey%20there!%20(from%20the%20site)) - [US: +1-877-422-3833](tel:+1-877-422-3833) - © 2017-2020 by Exigence Ltd.