Communication Plan
What is Communication Plan?
A documented strategy for communicating with internal and external stakeholders during security incidents, including templates and escalation procedures.
Terms that appear alongside communication plan
Each of these is named in at least one of the same controls as communication plan. The number is how many controls name both.
- remediation 2 shared controls
- incident reporting 2 shared controls
- cyber incident 2 shared controls
- ransomware 2 shared controls
- lessons learned 2 shared controls
- incident response 2 shared controls
Frameworks that govern communication plan
What the standards actually require on communication plan
Requirements naming communication plan across 6 standards, quoted from the control text.
Maintain a well-defined communication plan for managing stakeholders and public relations during and after an incident.
ASIC-CR-RR-5 · Stakeholder communication plan →The company must have a written procedure for withdrawing and recalling product. It names the recall management team and their responsibilities; gives guidance for deciding between recall and withdrawal and on the records to keep;
brcgs-global-standard-for-food-safety-issue-9::3.11.2 · 3.11.2 A documented withdrawal and recall procedure with team, decision guidelines, contacts and communication plan →Every member of the response team knows whom to contact during an incident, at what point and for what reason (technical specialists to restore service, management for updates); without a plan response slows and the wrong people are called.
sans-incident-handlers-handbook-and-picerl-methodology::P-c · P-c Communication plan: who the team contacts, when and why, including when to involve law enforcement →The objectives and direction for the business and for I&T set down in the I&T strategy are made known and understood by communicating them to the right stakeholders and users in every part of the enterprise.
cobit-2019::APO02.06 · APO02.06 Communicate the I&T strategy and direction →Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents, including early warning indicators, procedures to identify/track/log/categorise incidents by priority and se...
DORA-Art.17 · ICT-related incident management process →An external communication plan covers notifying the media of incidents where that applies.
ffiec-cybersecurity-assessment-tool-cat::D5.ER.Es.Int.3 · D5.ER.Es.Int.3 Escalation and Reporting (Intermediate 3) →Questions people ask about communication plan
What is Communication Plan?
Why is Communication Plan important for compliance?
Which compliance frameworks address Communication Plan?
Where can I learn more about Communication Plan?
See how Communication Plan applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.