Cybersecurity Is Also a Communication Issue: Is Your Organization Prepared for Both?

October is Cybersecurity Awareness Month, an opportunity to consider a question that often receives less attention than technical security: How prepared is your organization to communicate when something goes wrong?

There is something curious about the way organizations approach cybersecurity. Considerable resources are devoted to protecting information, securing networks, training employees, and developing technical response procedures. Leadership teams understand the importance of these investments, even when the technology itself falls outside their expertise. Yet ask those same leaders who would speak to employees, customers, or the media during a cybersecurity incident, and the answers may be considerably less certain.

That disconnect deserves attention. Not because technical security is receiving too much emphasis, but because communication preparedness has not always kept pace with the responsibilities organizations face when an incident occurs. A compromised system may require technical expertise to investigate and restore, but the disruption it creates is experienced by people. They have questions, responsibilities, concerns, and expectations that do not disappear simply because an investigation is underway.

Imagine a healthcare organization discovering suspicious activity involving patient information. Its IT team begins investigating, legal counsel is evaluating potential notification obligations, and executives are trying to establish what happened. Before the organization has a complete picture, employees begin hearing rumors. Patients are calling. A reporter wants to know whether personal information has been compromised. The organization may be following its technical incident response procedures exactly as intended, but its leaders now face a different challenge: communicating responsibly when the facts are incomplete, and the people affected are understandably concerned.

A technically sound response does not automatically produce a credible communication response.

Cybersecurity Preparedness Is an Organizational Responsibility

Cybersecurity has traditionally been viewed as a technical discipline, and for good reason. Protecting digital infrastructure requires specialized knowledge that most executives and communications professionals do not possess. It would be unreasonable to expect them to investigate a ransomware attack or determine how unauthorized access occurred. It is equally unreasonable, however, to expect cybersecurity professionals to carry the full responsibility for organizational communication, stakeholder confidence, and executive decision-making during an incident.

The National Institute of Standards and Technology addresses the broader nature of cybersecurity response in its 2025 publication, Incident Response Recommendations and Considerations for Cybersecurity Risk Management. Rather than treating incident response as an isolated technical activity, NIST encourages organizations to integrate it into their overall approach to managing cybersecurity risk. The guidance is significant because it recognizes that responding effectively requires preparation and coordination across organizational responsibilities.

Consider what happens when a North Carolina municipality experiences a ransomware incident that interrupts online payments, access to public records, or other essential services. Technical specialists may be working to contain the threat and restore operations, but residents still need to conduct business. Employees need to understand which services remain available and how to respond to questions. Elected officials may be hearing directly from constituents, while department managers are making decisions that affect daily operations. Each group is experiencing the same incident differently, and each needs information that reflects its responsibilities.

The difficulty is that organizations often prepare for these responsibilities separately. Technology develops its response procedures, legal counsel establishes notification requirements, and communications teams prepare general crisis messaging. Each function may be well organized within its own area of expertise, yet the organization can remain vulnerable at the points where those responsibilities intersect. The more consequential question is whether these professionals have worked together to establish how decisions will be made and information will move when circumstances become complicated.

The First Communication Problem May Be Inside the Organization

One of the more revealing aspects of a crisis is how quickly it exposes assumptions that seemed perfectly reasonable during normal operations. A leadership team may believe everyone understands the chain of command, only to discover that three departments have different interpretations of who can authorize a statement. A communications director may assume legal counsel will provide approved language, while legal counsel expects communications to prepare the initial draft.

Meanwhile, employees are asking supervisors for information, and those supervisors have received no guidance about what they can responsibly share.

These situations do not necessarily reflect poor leadership or inadequate professional expertise. They often develop because organizations have never examined how their individual responsibilities fit together under pressure. Communication processes that work adequately during an ordinary business day may become cumbersome when information is changing quickly, and decisions carry legal, operational, and reputational consequences.

This need for coordination is familiar to professionals who manage cybersecurity incidents from the legal side. Tawana B. Johnson, a partner and Vice Chair of the Data Privacy & Cybersecurity Practice at Lewis Brisbois, has extensive experience advising organizations on cybersecurity incidents, privacy requirements, and regulatory matters. During a 2025 SafeHouse Initiative podcast series, Johnson described her role as a breach coach as being "kind of a quarterback," a comparison highlighted in the firm's published recap of her discussion on cyber insurance and cyber claims.

The analogy is useful because a cybersecurity response may involve forensic investigators, attorneys, insurance carriers, technology specialists, organizational leaders, and communications professionals, all working within different areas of responsibility. Johnson's description reflects the importance of coordinating those resources and helping clients navigate an unfamiliar and often stressful process. For organizational leaders, it also raises a worthwhile question: If the professionals responsible for the technical and legal response must coordinate so carefully, why would communication be treated as something that can be organized later?

This is where a comprehensive crisis communication plan becomes valuable. PRiSM has previously explored the importance of crisis preparedness planning and developing a Preparedness Portfolio, an approach that brings stakeholder considerations, communication responsibilities, leadership decision-making, and reputational risks into a more cohesive framework. The objective is not to predict every circumstance an organization might encounter. It is to establish enough clarity around responsibilities and decision-making that people are not forced to negotiate those fundamentals while managing an active crisis.

Communicating When the Answers Are Still Developing

Perhaps the most uncomfortable position for an executive is being expected to explain something that the organization does not yet fully understand. During a cybersecurity investigation, leaders may know that suspicious activity has occurred without knowing whether information was accessed, which systems were affected, or how long the disruption will continue. Legal counsel may be evaluating notification obligations, while forensic specialists are still determining the scope of the incident. Unfortunately, the people seeking answers are rarely operating on the same timeline as the investigation.

There is a natural temptation to wait until everything is known before communicating. From a leadership perspective, that instinct is understandable. Nobody wants to release information that later proves inaccurate, create unnecessary alarm, or interfere with an investigation. But silence has consequences of its own, particularly when employees and customers can already see that something is wrong. In the absence of reliable information, people begin drawing conclusions from whatever details are available to them, including rumors, unofficial explanations, and speculation.

The challenge is not to eliminate uncertainty from the message, but to communicate responsibly within it.

That requires more judgment than simply promising transparency. Leaders must distinguish between information that has been confirmed, questions that remain unresolved, and details that cannot yet be disclosed for legitimate investigative or legal reasons. They also need to consider what stakeholders can reasonably expect next. An acknowledgment that an investigation is underway may be appropriate in some circumstances, but it becomes less reassuring when the organization offers no meaningful updates or fails to meet the expectations it has established.

A 2025 study published in Risk, Hazards & Crisis in Public Policy provides an interesting perspective on how organizational responses influence public confidence. Junghwa Choi and fellow researchers examined reactions to a hypothetical hospital data breach across government, nonprofit, and private organizations. Their research on restoring public trust after a data breach crisis found that procedural changes were particularly effective in rebuilding trust. Although the study examined hypothetical scenarios rather than actual breach outcomes, the findings suggest that stakeholders evaluate an organization's response partly through the actions it takes to address the problem.

That distinction matters. Expressions of concern have their place, especially when people may have experienced genuine harm or inconvenience, but reassuring language cannot carry the entire responsibility of restoring confidence. Organizations need to demonstrate that the incident is being investigated, that appropriate professionals are involved, and that corrective actions will be considered as reliable information becomes available. The communication should reflect the work, rather than attempt to compensate for its absence.

Of course, public communication must also be coordinated with legal requirements. Depending on the incident, organizations may have obligations involving affected individuals, regulators, insurance carriers, or other parties. The timing and content of those notifications can vary considerably, making qualified legal guidance essential. Communication professionals should be involved in preparing clear, accessible messages, but they should not independently determine the organization's legal disclosure obligations.

People Experience the Same Crisis Differently

Organizations frequently refer to stakeholders as though they represent a single audience, but the term can obscure important differences in how people experience an incident. An employee may be concerned about whether payroll information is secure or whether normal operations can continue. A patient may want to know whether medical records were affected. A customer may be considering whether to monitor financial accounts, while a vendor needs to determine whether connected systems present additional risk. Board members and regulators may be asking questions about governance, oversight, and compliance that would have little relevance to the general public.

These differences are not simply matters of tone or presentation. They affect what information people need in order to make decisions.

Research into consumer reactions following Facebook's Cambridge Analytica scandal illustrates how concerns about personal information can influence behavior. A 2023 study published in SAGE Open examined privacy breaches and consumer protection behavior, finding increased attention to privacy risks and protective responses following the incident, while also revealing the continued influence of perceived benefits on consumer decisions. In other words, people's reactions to privacy concerns are not always straightforward. Concern does not necessarily lead everyone to abandon a service, just as continued use should not be mistaken for complete confidence.

For organizational communication, this is a useful reminder that stakeholders are not merely evaluating whether a statement sounds reassuring. They may be deciding what actions to take, whether to continue a business relationship, or how much confidence to place in the organization's future commitments. A generic statement prepared for broad distribution may satisfy an immediate desire to communicate, but it may leave the most important practical questions unanswered.

Effective crisis preparedness therefore requires organizations to identify their audiences before an incident occurs and consider how their information needs may differ. This is particularly relevant for healthcare organizations, school districts, municipalities, financial institutions, and businesses entrusted with sensitive personal information. Communication must be accurate and consistent, but consistency does not require every audience to receive an identical message.

When a Cybersecurity Incident Becomes a Reputation Crisis

It is easy to assume that reputational damage follows automatically from a cybersecurity incident. Certainly, a serious breach can undermine confidence, especially when sensitive information is exposed or essential services are interrupted. But reputation is not determined by the incident alone. People also form judgments about the organization's response, the credibility of its leadership, and whether its actions reflect the promises it has made over time.

An organization that has spent years presenting itself as dependable and attentive to customer needs may find those qualities questioned when communication becomes inconsistent or difficult to obtain. Stakeholders who once accepted assurances without much thought may begin examining them more closely. Even routine interactions can take on new significance when confidence has been unsettled. A delayed response to an inquiry, an unclear explanation, or a commitment that goes unfulfilled may reinforce concerns that extend well beyond the original technical problem.

There is an important difference between managing reputation and managing appearances.

Research published in the Journal of Business Research in 2024 helps explain why that distinction matters. Matthew Hornsey and fellow researchers conducted two experiments involving 1,410 participants to examine how corporate apologies influence consumer perceptions. Their research on corporate apologies and organizational reform found that signals of meaningful reform could strengthen consumer trust and support, even when apologies also increased perceptions of organizational culpability. While the research addressed corporate scandals more broadly, its findings offer a relevant perspective for organizations considering how accountability and corrective action influence reputation recovery.

The temptation during a crisis is to concentrate on finding precisely the right words. Language matters, of course, but a beautifully constructed statement cannot make an unresolved problem disappear. Nor can an organization communicate its way around responsibilities it has failed to address. Credibility develops when the explanation, the decisions, and the actions behind them begin to align.

Leadership is especially visible in that process. Employees, customers, and community members may have little understanding of the technical complexities involved in a cybersecurity investigation, but they can recognize whether executives appear informed, whether explanations remain consistent, and whether concerns are being treated seriously. PRiSM has examined this relationship in Executive Image: Leading Through a Crisis, where leadership presence and communication are considered part of the broader reputation management process.

The objective should never be to create the appearance of certainty when certainty does not exist. It is to demonstrate that leadership understands its responsibilities, is seeking reliable information, and is prepared to make decisions that reflect the seriousness of the situation.

The Conversations Worth Practicing Before a Crisis

Most organizations recognize the value of testing cybersecurity systems. Vulnerability assessments, recovery exercises, and technical simulations help identify weaknesses before those weaknesses create serious consequences. Yet communication readiness is not always examined with the same discipline, even though the success of an incident response may depend on people making coordinated decisions under considerable pressure.

Imagine a school district conducting a cybersecurity crisis simulation. The exercise begins with suspicious activity involving an administrative system. Initially, the situation appears manageable, but as additional information emerges, employees begin asking whether they should continue using district technology. Parents express concern about student records, a reporter requests comment, and board members want an immediate briefing. The superintendent is receiving updates from the technology department, but legal counsel has not yet determined whether a reportable breach occurred.

What happens next is where the exercise becomes valuable. Perhaps the communications director discovers that the district has no established process for approving an initial statement. Perhaps department leaders disagree about what employees should be told, or the organization realizes that its backup communication procedures depend on the same systems currently affected by the incident. These are not necessarily dramatic failures. They are the kinds of operational details that can create significant confusion when nobody has considered them in advance.

In Crisis Simulation for Executive Leadership: Why Muscle Memory Matters in a Public Crisis, PRiSM explores how realistic exercises help leaders practice communication, decision-making, and organizational coordination before they face public scrutiny. Cybersecurity scenarios are particularly useful because they require participants to work with incomplete information while balancing technical, legal, operational, and reputational considerations. The goal is not to rehearse a perfect statement or predict exactly how an incident will unfold. It is to understand how the organization functions when familiar routines are interrupted.

A leadership team does not need to begin with an elaborate simulation to benefit from this kind of preparation. A thoughtful discussion can reveal a surprising amount. Who would authorize communication if the CEO were unavailable? How would employees receive instructions if email systems were compromised? Which stakeholders might require notification, and who would coordinate those decisions with legal counsel? How would the organization respond if information circulating publicly was inaccurate but the investigation had not yet established the full facts?

Questions like these can be uncomfortable precisely because they reveal how much organizations rely on assumptions. That discomfort is considerably more useful during a planning conversation than during an actual incident.

Frequently Asked Questions About Cybersecurity Crisis Communication

What is a cybersecurity crisis communication plan?

A cybersecurity crisis communication plan establishes how an organization will communicate with employees, customers, regulators, media, and other stakeholders during a cyber incident. It identifies communication responsibilities, approval procedures, stakeholder priorities, alternative communication channels, and processes for sharing verified information as circumstances develop. The plan should complement technical incident response procedures and applicable legal notification requirements.

Who should be involved in cybersecurity crisis communication?

Cybersecurity crisis communication requires coordination among executive leadership, IT and cybersecurity professionals, legal counsel, communications teams, and operational leaders. Depending on the organization and the nature of the incident, privacy officers, human resources professionals, governing boards, insurance representatives, and outside specialists may also have responsibilities.

When should an organization communicate after discovering a cybersecurity incident?

The appropriate timing depends on the nature of the incident, what information has been verified, who may be affected, and which legal notification requirements apply. Organizations should establish decision making and communication procedures in advance so they can respond promptly and responsibly without releasing inaccurate information or interfering with an investigation.

How can a cybersecurity incident affect organizational reputation?

Cybersecurity incidents can influence stakeholder confidence, particularly when personal information, financial data, or essential services are involved. The organization's response also matters. Communication consistency, executive accountability, corrective actions, and the fulfillment of commitments can shape how stakeholders evaluate its reliability after an incident.

How can North Carolina organizations strengthen cybersecurity communication preparedness?

North Carolina businesses, healthcare providers, educational institutions, municipalities, and nonprofits can strengthen preparedness by developing crisis communication plans, identifying stakeholder notification responsibilities, coordinating with technical and legal professionals, and conducting realistic crisis simulations. These activities help organizations identify communication gaps before an actual incident places their leadership and operations under pressure.

Preparedness Includes the Conversations We Would Rather Avoid

Cybersecurity Awareness Month is an appropriate time to review technical protections, employee training, and the systems organizations depend on to conduct business. Those responsibilities are essential, and the professionals who manage them deserve the resources and organizational support necessary to do their work well. But preparedness becomes incomplete when leadership assumes the communication challenges can be addressed after the technical response is underway.

There is a tendency to think of crisis communication as something an organization needs when an incident becomes public. In reality, many of the decisions that influence public confidence are made much earlier, when leaders establish responsibilities, determine how information will be shared, and decide whether their plans are worth testing. These preparations may never receive public attention. Ideally, they will not need to. Their value lies in reducing avoidable confusion when people are depending on the organization to respond responsibly.

At PRiSM PR FIRM, we work with organizations throughout North Carolina to strengthen crisis preparedness, executive communication, reputation management, and organizational resilience. Our approach emphasizes the communication systems, leadership judgment, and stakeholder relationships that deserve attention before a crisis occurs.

If your organization has recently evaluated its cybersecurity protections, consider whether the people responsible for communicating during an incident are equally prepared. Connect with PRiSM PR FIRM to explore how a crisis communication plan or leadership simulation can help identify vulnerabilities that may not appear in a technical security assessment.

Poised. Polished. Prepared.