{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/communication-plan","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/communication-plan/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/communication-plan/"},"term":{"en":"Communication plan","da":"Kommunikationsplan"},"aka":{"en":["crisis communication plan"],"da":["krisekommunikationsplan"]},"domain":["security"],"cluster":"incident-response","layer":"governance","status":"current","summary":{"en":"A plan for who tells what to whom during a crisis - staff, customers, authorities and the press.","da":"En plan for, hvem der siger hvad til hvem under en krise - medarbejdere, kunder, myndigheder og presse."},"body":{"formal":{"en":"The part of the contingency plan that names who may speak for the organisation and sets approval steps, prepared messages, contact lists and reporting deadlines for internal and external communication during an incident.","da":"Den del af beredskabsplanen, der udpeger talspersoner og fastlægger godkendelsesgange, forberedte budskaber, kontaktlister og frister for indberetning ved intern og ekstern kommunikation under en hændelse."},"plain":{"en":"Like agreeing in advance who in the family calls grandma with bad news, so she does not hear it first from the neighbours.","da":"Ligesom at aftale på forhånd, hvem i familien der ringer til bedstemor med dårlige nyheder, så hun ikke hører det fra naboerne først."},"inPractice":{"en":"When member data leaks from a pension fund, the plan says only the director speaks to the press, members get a prepared message in e-Boks, and Datatilsynet is notified within 72 hours.","da":"Da medlemsdata lækker fra en pensionskasse, siger planen, at kun direktøren udtaler sig til pressen, medlemmerne får en forberedt besked i e-Boks, og Datatilsynet får besked inden for 72 timer."},"whyItMatters":{"en":"Confused or late messages can do more harm to trust than the incident itself, and missing a reporting deadline set by law can bring fines.","da":"Forvirrende eller sene budskaber kan skade tilliden mere end selve hændelsen, og en overskredet frist for indberetning, som loven kræver, kan give bøder."}},"deepDive":{"en":"NIST SP 800-34 Rev. 1 lists the crisis communications plan as one of the plan types around an information system contingency plan, and ISO 22301:2019 clause 8.4.3 requires procedures for warning and communication, covering communication with interested parties, the media and, where relevant, national or regional authorities, including how communication is recorded. NIST SP 800-61 addresses the same need from the incident-response side: who may share what with law enforcement, other response teams, suppliers, customers and the media, and the rule that information sharing is decided in advance rather than improvised.\n\nA working plan contains a stakeholder map (staff, management, board, customers, citizens or patients, suppliers, insurers, regulators, police, media, partners), named spokespersons with deputies, an approval chain with a maximum turnaround time, pre-approved holding statements for the most likely scenarios, and channel choices for each audience. It also defines a single source of truth, usually a situation log owned by the crisis team, from which all messages are derived, so that the press office, customer service and the regulator do not receive conflicting versions.\n\nThe legal deadlines drive the timing more than any communications preference. Under GDPR Article 34 the controller must inform affected data subjects without undue delay when a breach is likely to result in a high risk to them, in clear and plain language describing the nature of the breach, the likely consequences, the measures taken and a contact point. Article 34(3) allows a public communication instead when individual notice would involve disproportionate effort. NIS2 Article 23(1) requires entities, where appropriate, to notify recipients of their services of significant incidents likely to affect them, and Article 23(2) to tell recipients potentially affected by a significant cyber threat what measures they can take. These external messages and the regulatory reports must be consistent, because regulators and journalists compare them.\n\nCyber incidents add constraints that ordinary crisis communication does not face. Email, Teams and the intranet may be compromised or monitored by the attacker, so the plan needs out-of-band channels such as phone trees on paper, SMS services or a separate messaging platform prepared in advance. Statements should avoid premature claims such as \"no data was taken\" before forensics confirms it, since corrections damage trust more than an honest \"we are investigating\". Ransomware groups also contact customers and journalists directly, which the plan should anticipate.","da":"NIST SP 800-34 Rev. 1 nævner krisekommunikationsplanen som en af de plantyper, der omgiver beredskabsplanen for et informationssystem, og ISO 22301:2019 afsnit 8.4.3 kræver procedurer for varsling og kommunikation, herunder kommunikation med interessenter, medier og, hvor det er relevant, nationale eller regionale myndigheder, samt hvordan kommunikationen registreres. NIST SP 800-61 dækker samme behov fra hændelseshåndteringens side: hvem der må dele hvad med politiet, andre responsteams, leverandører, kunder og medier, og princippet om, at deling af oplysninger besluttes på forhånd i stedet for at blive improviseret.\n\nEn brugbar plan indeholder et interessentkort (medarbejdere, ledelse, bestyrelse, kunder, borgere eller patienter, leverandører, forsikringsselskab, tilsynsmyndigheder, politi, medier, samarbejdspartnere), navngivne talspersoner med stedfortrædere, en godkendelsesgang med en maksimal svartid, forhåndsgodkendte standardudmeldinger for de mest sandsynlige scenarier og valg af kanal for hver målgruppe. Den fastlægger også én fælles sandhed, typisk en situationslog, som krisestaben ejer, og som alle budskaber udledes af, så presseafdelingen, kundeservice og tilsynsmyndigheden ikke får modstridende versioner.\n\nDe lovbestemte frister styrer timingen mere end nogen kommunikationsmæssig præference. Efter databeskyttelsesforordningens artikel 34 skal den dataansvarlige uden unødig forsinkelse underrette de registrerede, når et brud sandsynligvis indebærer en høj risiko for dem, i et klart og enkelt sprog, der beskriver bruddets karakter, de sandsynlige konsekvenser, de trufne foranstaltninger og et kontaktpunkt. Artikel 34, stk. 3, tillader en offentlig meddelelse i stedet, når individuel underretning vil kræve en uforholdsmæssig indsats. NIS2 artikel 23, stk. 1, kræver, at enheder, hvor det er relevant, underretter modtagerne af deres tjenester om væsentlige hændelser, der kan påvirke dem, og stk. 2, at modtagere, der kan blive berørt af en væsentlig cybertrussel, får at vide, hvilke foranstaltninger de kan træffe. Disse eksterne budskaber og indberetningerne til myndighederne skal hænge sammen, for både myndigheder og journalister sammenligner dem.\n\nCyberhændelser giver begrænsninger, som almindelig krisekommunikation ikke møder. Mail, Teams og intranettet kan være kompromitteret eller overvåget af angriberen, så planen skal have kanaler uden for det normale netværk, fx telefonkæder på papir, SMS-tjenester eller en separat beskedplatform, der er forberedt på forhånd. Udmeldinger bør undgå forhastede påstande som \"der er ikke taget data\", før den tekniske undersøgelse har bekræftet det, fordi rettelser skader tilliden mere end et ærligt \"vi undersøger sagen\". Ransomware-grupper kontakter desuden selv kunder og journalister, hvilket planen bør tage højde for."},"edges":[{"type":"part-of","to":"security/contingency-plan","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/data-breach","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/incident-response","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/crisis-management","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management","url":"https://doi.org/10.6028/NIST.SP.800-61r3","tier":"standard","publisher":"NIST"}],"draft":true}