What are best practices for crisis communication during a security incident?

• A. Post only on social media without approvals.
• B. Withhold all information until after investigation.
• C. Send conflicting messages to stakeholders.
• D. Designate a spokesperson, provide timely, accurate updates, use approved channels, and protect privacy while informing stakeholders.

Answer: (D)

Coordinated, timely, and privacy-aware communications are essential when a security incident occurs. Designating a single spokesperson ensures a consistent voice and avoids mixed messages. Providing timely, accurate updates keeps stakeholders informed about what happened, what is being done to address it, and what steps they should take next. Using approved channels directs information through trusted paths and helps prevent the spread of rumors. Protecting privacy while informing stakeholders means sharing enough detail to be useful while safeguarding sensitive data and complying with legal requirements. This approach is preferable to posting without approvals (which risks misinformation and noncompliance), withholding information until after investigations (which creates uncertainty and erodes trust), or sending conflicting messages (which damages credibility and creates confusion).