When the NotPetya malware tore through global networks in June 2017, the Danish shipping giant Maersk watched its digital infrastructure collapse within minutes. Computer screens across the company turned black. Employees ran through office corridors urging colleagues to unplug their machines. Within hours, the systems controlling port operations, vessel movements, and cargo logistics across Maersk’s vast network became inaccessible, forcing the company to rebuild its entire IT environment from scratch while trying to maintain a fallback operation for global shipping.
While organisations invest heavily in technical defences and recovery protocols, the human infrastructure of crisis communication—honest, transparent messaging to employees, customers, regulators, and the public—is frequently treated as an afterthought until systems fail.
The UK’s National Cyber Security Centre has made explicit that stakeholder communication during an incident directly reduces short-term impact, builds customer trust, and limits long-term harm. Yet this capability is routinely neglected in preparedness planning, practice scenarios, and skills training, leaving organisations to improvise under extreme pressure when trust is most fragile.
Regulators Move to Mandate Disclosure
Regulators are moving quickly to change how companies handle crises, turning public-relations messaging into a legally binding requirement under governance rules. In the United States, Securities and Exchange Commission rules now require publicly listed companies to disclose material cyber incidents within four business days of determining their materiality, alongside descriptions of their risk-management processes and board oversight mechanisms. The Attorney General retains authority to delay disclosure where national security or public safety would be compromised.
Across the Atlantic, the European Union’s NIS2 directive has strengthened incident-reporting and cyber-risk-management requirements for critical infrastructure sectors, creating a more formalised, time-sensitive framework for disclosure. The changes show a clear pattern: governments and companies are now treating cybersecurity communications as part of compliance and national security planning, not just a communications department’s responsibility.
However, meeting statutory deadlines does not guarantee effective communication. Organisations can satisfy regulatory timelines while leaving employees confused, customers exposed, and technical teams overwhelmed by competing information demands. Regulation compels disclosure but cannot manufacture the clarity, judgment, or trust that stakeholders require during a crisis.
Trust Is Accumulated, Not Manufactured
Organisations do not enter a cyber crisis with a blank slate. Customers, employees, regulators, and journalists interpret an incident through the lens of pre-existing relationships and the organisation’s historical record on transparency and accountability. This accumulated trust determines whether early statements are believed or dismissed, and whether the organisation receives the benefit of the doubt during uncertain moments.
Cyber leaders interviewed for research on communicating cyber risk emphasised that trust cannot be manufactured when systems go down; it is built over years but can evaporate in hours. Crisis communication must therefore function as an extension of normal organisational behaviour rather than a separate capability activated only when disaster strikes.
Multiple Audiences, One Spine
Effective preparation requires recognising that no single audience exists during an incident. Employees need immediate guidance on what has occurred, what actions to take, and where to find reliable information. Customers require practical details about service availability, data exposure, and protective measures. Regulators demand accurate, evidence-based reporting within prescribed timeframes. The media seeks clear explanations and visible accountability.
While tone and detail must adapt to each group, core facts must remain consistent across all channels. Anything communicated internally should be assumed to become public eventually. Organisations therefore need a central framework of agreed messaging that can be tailored for different audiences without creating contradictions.
Timing and sequencing carry equal weight. Employees and directly affected parties should not learn of an incident through news reports, and regulators should receive information from the organisation rather than from journalists. The Bank of England’s 2024 CBEST findings flagged poor communication channels during incident response as a persistent issue, observing that if attackers maintain network access, they could watch how an organisation manages its containment efforts. Secure, alternative communication channels thus form part of the operational response itself, not merely a public-relations consideration.
Exercises Must Create Pressure
Preparedness requires more than documentation; it demands realistic practice. Organisations should convene technical, legal, and communications specialists before crises occur to agree on roles, escalation routes, and approval processes. They must maintain secure contact lists and alternative channels, prepare adaptable holding statements, and designate spokespeople for different stages of an incident.
Most critically, these arrangements must be tested through exercises that introduce pressure, uncertainty, and imperfect information. Such drills should require leaders to make decisions without complete technical pictures, verify that communications can be approved when email systems are unavailable, confirm that employees can be reached quickly, and ensure senior leaders can explain incidents in language that customers understand.
Policymakers and boards face growing calls to embed communication preparedness within sector-wide exercises and regulatory stress tests, assessing whether organisations are capable of coordinating messages, contacting affected parties, using secure backup channels, and communicating appropriately despite incomplete information. The direction of travel is clear: communication capability is becoming a measurable component of organisational resilience, tested under conditions that mirror the chaos of an actual breach.
