The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and international partners have developed guidance to help service providers plan and carry out communications during information technology and operational technology outages. The document describes practices for communicating clearly, accurately, promptly, and in ways appropriate to affected audiences. (CISA)
The guidance covers outages caused by cyber threat actors, human error, equipment failure, or natural hazards. Any of those events can disrupt services and contribute to societal panic, including when speculation from end users and the public is an additional factor. An outage at one organization may also cascade across interconnected systems, increasing uncertainty and alarm.
The document identifies clarity, accountability, and transparency as core principles for crisis communications. It describes key elements of messaging intended to inform affected stakeholders and the public during a disruption. The guidance says communications should account for legal requirements, operational security, law enforcement, and efforts to contain an incident.
For service providers, the recommendations concern both the substance and timing of communications. Messages should be clear and accurate, while also reflecting the information needs of the audiences receiving them. Affected stakeholders and members of the public may require different information during an outage, so the guidance emphasizes audience-appropriate communication rather than a single message for every group.
The guidance also stresses that communication should continue as conditions change. Service availability may change because of an outage or because an organization isolates systems as a defensive strategy. In either situation, transparent and ongoing communication can help end users minimize operational impacts, limit speculation, and preserve trust.
The recommendations are intended to support communication during both information technology and operational technology disruptions. Operational technology systems can support vital functions, and a major cyber incident or other crisis may require organizations to isolate systems while they work toward recovery. CISA’s CI Fortify initiative provides information and resources to help critical infrastructure organizations prepare to isolate and recover vital OT systems. (CISA)
The guidance connects recovery decisions with the need to keep affected people informed. Isolation can be a defensive measure, but changes in service availability still require communication about the situation and its effects. Ongoing updates can help end users understand operational impacts and reduce speculation while recovery or containment work proceeds.
It also addresses emergency planning by critical infrastructure owners and operators. They are advised to assume that telecommunications services may be disrupted or otherwise unreliable during an emergency. Organizations should therefore have crisis communications plans that include backup communication methods.
Those plans should also account for the communications organizations expect from their service providers. Understanding the type of information that may be provided can help owners and operators prepare for service changes and plan how to communicate with their own affected stakeholders. The guidance places that preparation within a broader approach built around clear, accountable, transparent, and audience-appropriate communications.
The document is guidance for planning and executing communications during outages. Its recommendations address how organizations can communicate during disruptions, defensive isolation, containment, and recovery while reducing speculation and panic and helping preserve trust. The focus is on maintaining useful information for affected stakeholders and the public as service conditions develop.