Incident Communication and Stakeholder Management Questions

Direct answer

Tell a small need-to-know group (only the people who need the information to do their part) at once, widen internal communication when a fix exists, and tell customers when they either must act or have been affected. The main exception to waiting: if the flaw is being actively exploited, warn customers immediately with mitigations (temporary steps that reduce the risk before a full fix exists, such as disabling a feature or restricting access), even before a full patch. Legal and PR shape the wording and confirm whether any notification duty applies, but they do not set the technical timeline.

Two different starting points

• Third-party disclosure (a researcher or vendor reports a flaw). Usually under coordinated disclosure: the reporter gives you time to fix before going public, often with an agreed date. Your clock is that date. The flaw may carry a CVE (Common Vulnerabilities and Exposures identifier, a public catalogue number) and a CVSS score (Common Vulnerability Scoring System, a 0-10 severity rating).
• Found by us. You control the timeline, but you must still check whether it was exploited in the past.

What to say, to whom, and when

Worked example (illustrative)

A researcher emails on Monday about an authentication bypass (a flaw that lets someone skip the login check) in your admin API, with a 30-day disclosure date. You: (1) confirm and rate it that day; (2) check logs for past exploitation; (3) restrict knowledge to about ten people; (4) ship a fix in week two; (5) brief support in week three with approved answers; (6) publish the advisory (the customer-facing security notice) once the fix is deployed and on or before the agreed date, whichever comes first, unless exploitation forces an earlier warning, crediting the researcher if they want it. If step 2 shows exploitation, skip ahead: notify affected customers promptly and involve legal for any notification duty.

Sample advisory (illustrative)

Advisory: authentication bypass in the Admin API, fixed in version 4.2.1. Affected: versions 4.0.0 to 4.2.0. Impact: an unauthenticated user could reach some admin functions. Action: upgrade to 4.2.1; if you cannot upgrade today, restrict admin API access to your office network. Status: fixed on 12 June. We found no signs of exploitation in our own logs review, which covered 1 January to 12 June. Reported by an external researcher, thank you. Contact: security@example.com.

Wording rules

• Say which versions or features are affected and what to do; leave exploit details out of the advisory, since it would help attackers before customers patch.
• Do not say "no customers were affected" unless log review supports it.
• Keep one approved Q&A so support gives one answer.

Pitfalls

• Sending a broad internal all-hands email: it leaks.
• Letting PR delay a warning while customers are being attacked.
• Forgetting the researcher: a professional response encourages future reports.

Direct answer

Run one incident with two tracks. Engineering keeps fixing and contains the problem, while a single communications lead moves verified facts from engineering to legal, then to compliance and communications. Legal decides whether a legal duty to notify exists and when the notification clock started. Speed comes from preparing every notification draft in parallel while investigation continues, so that when legal says go, the text is already written. (This is awareness-level: engineers do not decide legal questions, they supply reliable facts and timestamps.)

Roles and flow

Rules that keep this fast: one channel, one fact sheet (never facts passed by chat memory), and every fact carries a timestamp and a source.

The notification clock, with two real examples

(The article and item numbers are for orientation; interviewers care that you know two clocks exist and start at different events.)

• Under the GDPR (EU General Data Protection Regulation), Article 33 requires notifying the supervisory authority (the regulator) within 72 hours of becoming aware of a personal data breach, where feasible. Information may be supplied in phases if not all is known yet.
• In the US, a public company that determines a cybersecurity incident is material must file a Form 8-K (a current report to the US securities regulator, the SEC) under Item 1.05 within four business days of that materiality determination. Material means important enough that a reasonable investor would want to know: for example a breach that disrupts core operations or exposes large amounts of customer data. Deciding it is a judgement call made by counsel and executives, and the date they decide starts the clock. The SEC rule also requires that determination to be made without unreasonable delay after the incident is discovered, so the clock cannot be postponed by leaving the question open; the log should show when the assessment began and when it concluded.

Other regions and sectors have their own rules and forms. Counsel keeps that list, not engineering. Point to note: the clocks start from different events ("becoming aware" versus "determining materiality"), so the log must record both moments.

Worked example (illustrative)

Discovery confirmed Tuesday 09:10 UTC. 72 hours later is Friday 09:10 UTC. Checkpoints the tracker holds (the second clock is shown after this list):

• Tue 12:00: first fact sheet to legal; legal starts the region-by-region list.
• Wed 09:00: draft regulator notice and customer message ready (based on what is known, marked "to be supplemented").
• Thu 09:00: legal decision per region; final numbers frozen at that time.
• Thu evening: submit, leaving a buffer before Friday 09:10.

A sample row of the fact sheet: Records affected: at least 12,400 (preliminary) | Source: storage access logs | Timestamp: Tue 11:40 UTC | Owner: security lead | Status: confirmed, count may rise.

Second clock (US public company, illustrative): on Wednesday 14:00 UTC counsel and executives determine the incident is material. Business days start counting the next day: Thursday is day 1, Friday day 2, Monday day 3, Tuesday day 4. The 8-K is due by end of Tuesday. The tracker therefore holds two rows with different start events: Aware: Tue 09:10, GDPR due Fri 09:10 and Material: Wed 14:00, 8-K due Tue end of day.

Keeping speed while respecting rules

• File an initial notice with known facts rather than waiting for a full investigation, then supplement.
• Do not let engineering statements go public on their own. A casual "no customer data affected" in a chat or forum can be wrong and can be a regulatory problem.
• Draft in parallel for every region, so one region's review does not block another.

Pitfalls

• Starting the clock in your head at the wrong event. Ask counsel and write the decision down.
• Over-sharing unverified numbers to look transparent, then having to correct them to a regulator.

Direct answer

Stop the bleeding (limit further harm first: concretely, switch off logging of that field and restrict access to the log store), then tell a small set of people quickly through a restricted channel: the incident commander (who leads the response), the security and privacy team, and legal or the data protection officer (DPO, the person responsible for privacy compliance). They decide whether this is a reportable breach and the external message. I do not post the data or a broad alert in an open channel.

Structured elaboration

Terms. A query string is the part of a web address after the question mark, such as ?email=ana@example.com. Web servers usually write full addresses into their request logs, so anything placed in the query string, like an email, ends up stored in plain text in the logs, where many staff can read it. A log index is the searchable store where those logs are kept. A pager is the on-call alert system that reaches the incident commander immediately. SEC-INCIDENT is just a prefix tag that makes the message easy to find and filter in the security channel.

Immediate actions (minutes)

• Contain: stop or mask the offending log field, restrict access to the affected log store, do not delete yet (evidence).
• Never paste the personal data (PII, personally identifiable information such as emails or IDs) into chat or tickets. Reference the log location only.

Whom, in order, and how

1. Incident commander or my manager, by pager or direct message.
2. Security incident channel (private, access-controlled).
3. Privacy or legal team, the DPO. They judge whether personal data was exposed to unauthorised parties, which is what makes it a "personal data breach".
4. Affected service owners, later.

Why the speed matters: under GDPR (the EU General Data Protection Regulation) Article 33, a controller must notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware. The controller is the organisation that decides why and how personal data is used (usually our company); the supervisory authority is the national data protection regulator; a processor is a vendor handling data on the controller's behalf, and it must tell the controller without undue delay. The clock is measured from when the company becomes aware, which is why a quiet delay in escalating can use up the window. Whether that clock has started is legal's call, so tell them fast.

Worked example (illustrative)

Internal message: "SEC-INCIDENT: request logs since Tuesday appear to contain customer email addresses in the query string. Access to the log index is now restricted. Logging of that field disabled at 10:20. Scope and who accessed the logs are unknown. Privacy and legal please review. Next update 12:00."

External message (only if legal decides it is notifiable, sent to customers or authority): factual, no speculation: "During routine review we found that some personal data, specifically email addresses, was recorded in internal logs. Access to those logs is now restricted, and we are reviewing who had access while the data was recorded. We have not yet established whether anyone outside authorised staff saw it."

Note why the wording changed from the tempting version: the statement that access was limited to authorised staff is exactly the unknown at this stage (the internal message says who accessed the logs is unknown), and the logs are retained as evidence, so only the confirmed containment step (access restricted, logging of the field disabled) may be stated as fact.

Trade-offs and pitfalls

• Over-alerting in open channels spreads the data; under-alerting risks a missed notification deadline.
• Do not decide alone that it is "not a breach". That judgement belongs to privacy and legal.
• Wording: say what data type and what was exposed, not "a small issue".
• What would change the call: if the logs were sent to a third-party vendor, treat as external exposure sooner.

Direct answer

A data breach means someone who should not have access got customer data. Data corruption means the data was changed or damaged incorrectly. Either way, send a short first notice quickly with only confirmed facts, what customers should do, and when the next update arrives. Follow with a fuller notice once scope is known. the sign-off is one accountable person per decision (executive sponsor for customer wording, head of engineering for facts, general counsel for regulator decisions), with legal and security consulted before anything goes out (see the table below); the timeline puts containment and fact-finding in the first hour and customer, regulatory and internal alignment in the first day.

First notice (short; illustrative wording for a data-corruption event)

Subject: Data issue affecting some [Product] accounts
On [date] at [time UTC] we found that a faulty update changed some order records for a subset of customers. Your account may be affected. We have stopped the update, and your data is protected from further change. Please avoid re-importing or editing orders dated [range] until we confirm. We will send a fuller update by [time]. Contact: [named team and address].

For a breach (unauthorised access), swap in: what was accessed if known, whether credentials should be rotated (changed, so any stolen password or key stops working), and any recommended customer action (reset passwords, watch for suspicious messages). Illustrative wording:

Subject: Security incident affecting some [Product] accounts
On [date] at [time UTC] (UTC is the universal time zone, so everyone reads the same clock) we detected unauthorised access to a system holding [data types, if confirmed]. We have blocked the access and are investigating how far it reached. As a precaution, please reset your password and be cautious of unexpected emails asking for your details. We will send a fuller update by [time]. Contact: [named team and address].

Follow-up notice (more detail)

Scope (which data, which dates, how many accounts), cause in plain language, what we restored or verified, what customers should check, our fixes, and a support path. Add whether data is recoverable and how customers can confirm their own records. Illustrative wording:

Subject: Update: data issue affecting some [Product] accounts
Between [start] and [end] UTC, a faulty update changed order records for about [N] accounts (your account is / is not one of them; see the link for your own check). We found the cause: the update ran without a safeguard that checks records before saving. We restored records from the backup taken at [time] and verified them against [source]. Please review orders dated [range] in your account and contact [team] if anything looks wrong. We are adding [safeguard] and will share a written review by [date].

Who signs off (RACI: Responsible, Accountable, Consulted, Informed)

Read the table like this: Responsible is who does the work, Accountable is the one person with final say who signs off (only one per row), Consulted must be asked first, Informed is told afterwards.

Legal decides whether regulators must be told. For example, under the GDPR (General Data Protection Regulation, the EU data protection law), a controller (the organisation that decides why and how personal data is used) must notify the supervisory authority (the national data-protection regulator) without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, and a processor (an organisation handling data on a controller's behalf, such as a hosting vendor) must tell the controller without undue delay. Other regimes differ, so legal owns that determination.

Timeline

• First hour: contain (stop the bad job or block the attacker's access so the damage cannot grow), assign incident lead, preserve evidence (copy logs and snapshots of affected data before they are overwritten), freeze deploys, open one channel, alert legal and security.
• Hours 1 to 4: establish scope, draft first notice, get sign-off, brief support, and send it. The notice waits for the first hour because it must be able to say truthfully that the problem is stopped, and for enough confirmed facts and one safe customer action; it should not wait past hour 4.
• By end of day 1: first notice already sent (target hours 1 to 4), regulator decision made, fuller notice drafted, executives updated, next-update schedule published.

Multi-audience plan

• Engineering: technical channel, evidence log.
• Product: impact and feature holds.
• Customers: the notices above.
• Executives: a one-page status.

Postmortem elements (afterwards)

A postmortem is a blameless written review (it examines how the system allowed the failure, not who to blame). It holds a root-cause diagram (trigger, missing safeguard, data path), a timeline, and corrective actions with owners and dates.

Trade-offs and pitfalls

• Speed versus accuracy: send early and label unknowns rather than waiting for perfection.
• Never say "no evidence of misuse" unless you have actually looked.
• Over-broad notice causes panic; too narrow forces a second, worse notice.