Policy Incident Communication Plan. Table of Contents

Transcription

1

2 Table of Contents Incident Communication Plan... 3 Overview... 3 Objective... 3 Policy... 4 Guidelines... 4 Request for Information... 5 Editorial or Letter to Editor Requests... 6 Requests for Interviews... 6 Emergency Response... 6 Unannounced Visit... 7 Press Releases... 8 Business Continuity Communication Lifecycle... 9 Pre-event... 9 Event Occurrence On-going event impact Resumption of business operation Post-event evaluation Best Practices News Conference Media Relations Best Practices Federal Computer Security Incident Handling Requirements Appendix Job Description Director Media Communications Social Networking Checklist Creating Twitter Accounts Creating LinkedIn account Creating and operating a blog Incident Communication Contact Form What s New

3 Incident Communication Plan Overview To survive an incident such as a business interruption, security breach, or a product recall, organizations need more than a successful communication strategy they need an incident communication plan. Principles of effective crisis and risk communication are: Be First: Crises are time-sensitive. Communicating information quickly is almost always important. For members of the public, the first source of information often becomes the preferred source. Be Right: Accuracy establishes credibility. Information can include what is known, what is not known, and what is being done to fill in the gaps. Be Credible: Honesty and truthfulness should not be compromised during crises. Express Empathy: Crises create harm, and the suffering should be acknowledged in words. Addressing what people are feeling, and the challenges they face builds trust and rapport. Promote Action: Giving people meaningful things to do calms anxiety, helps restore order, and promotes a restored sense of control. Show Respect: Respectful communication is particularly important when people feel vulnerable. Respectful communication promotes cooperation and rapport. Objective The overall objectives of an incident communication plan should be established at the outset. The objectives should be agreed upon, well understood, and publicized. For example, will the primary objective of the communications plan be for communications only to employees, and only during a disaster? Or is the intent to advise customers of interruptions to service? Or is it for investors and stockholders? Or regulatory agencies? Or is it some combination of these? Whatever the objectives they should be shared, supported by executive management, and widely communicated The specific objective of this incident communication plan is to define who will provide key communications during a crisis and the content, recipients, schedule, method of delivery, frequency, and priority of the communication. By outlining communications in advance, ENTERPRISE Protect the effect of a crisis on employees, associates, suppliers, and customers, Reduce the impact of bad publicity, maintain customer service, bolster relations with vendors and Addresses the concerns of other key stakeholders 3

4 Business Continuity Communication Lifecycle Understanding what is necessary in order to keep a business in operation during a crisis can help business spokesmen the problems they will need to anticipate and how they should respond to meet the enterprise s, employees, partners and medias needs. For communicators, it s vital to know that every emergency, disaster, or crisis evolves in phases. The communication, too, must evolve through these changes. By dividing the crisis into phases, the communicator can anticipate the information needs of the media, agencies, organizations, and the general public. For each of these phases, specific types of information need to be created and delivered to your audience. The phases of the communication lifecycle for an event are: Pre-event Event occurrence On-going event impact Resumption of business operation Post-event evaluation Pre-event Communication objectives during the pre-crisis phase target communication and education campaigns. These campaigns inform the public and the response community. The communicator s job is to be prepared by facilitating the following: Monitor and recognize emerging risks. Define target audience Educate target audience about the risks. Prepare the target audience for the possibility of an adverse event. Increase self-efficacy by suggesting actions that reduce the likelihood of harm. Provide warning messages regarding an imminent threat. Collaborate and cooperate by developing alliances with agencies, organizations, and groups. Develop consensus recommendations by experts and first responders. Create messages and test them for use in later stages. Build and test communication systems. 9

5 Federal Computer Security Incident Handling Requirements The National Institute of Standards and Technology (NIST) of the US Department of Commerce has a guide on how security incidents should be handled. This publication provides a detail discussion of the composition, interrelationships with others (before during after), and responsibilities of the Incident Response Team. Establishing an incident response capability should include the following actions: Creating an incident response policy and plan Developing procedures for performing incident handling and reporting Setting guidelines for communicating with outside parties regarding incidents Selecting a team structure and staffing model Establishing relationships and lines of communication between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies) Determining what services, the incident response team should provide Staffing and training the incident response team. Organizations should be generally prepared to handle any incident but should focus on being prepared to handle incidents that use common attack vectors. 14

6 Job Description Director Media Communications Position Purpose The Director Media Communications is responsible for leading all media contact initiatives and for providing and managing media relations enterprise-wide in support of enterprise business objectives. The Director Media Communications supervises the creative staff as well as composes, edits, and manages the production of a full range of material to effectively support the advancement goals of ENTERPRISE and conveys the enterprise s mission to diverse constituencies. Problems and Challenges The Director Media Communications manages the development, implementation, and coordination of internal and external strategic communications strategies, with the goal of establishing and maintaining a positive image of ENTERPRISE with its employees and the public. Develops and implements strategies and programs to communicate the ENTERPRISE s business objectives, culture, and values to its employees. This position oversees the alignment of communications plans with the strategic direction and positions of ENTERPRISE. Essential Position functions Principal Accountabilities 17 Directs and manages the day-to-day activities of creating and implementing strategic communications for both internal and external audiences. o Translates complex subject matter into simple, well-understood messages; o Develops strategic messages based on the ENTERPRISE s needs, positions and opportunities across a variety of platforms and various audiences; o Drives strategic programs to increase understanding of ENTERPRISE; o Enhances external presence with the right story and channels and right message for various audiences (employees, customers, media, general public, etc.); o Ensures all communications support ENTERPRISE goals and objectives; o Ensures channel and brand coherence with business plans; o Provides creative solutions in a highly collaborative environment to execute on time and within budget; o Serves in a critical-essential role for crisis communication. o Responsible for crisis management for the communications team. Provides strategic consultations to senior executives, content providers and colleagues, throughout ENTERPRISE o Manages the relationship with key internal stakeholders and directs the appropriate level of support. o Oversees media relations support for Executive Management.

7 Social Networking Checklist Communicating with people who work for you is as important as protecting the processes and data in your company. Your plan should cover: Scripts, step lists or cue cards so employees can perform critical tasks and communicate with customers up to established standards Cutover practice drills to uncover gaps in your plan as well as rehearse procedures Central communication points for disseminating further instructions Have a connection to the Internet that is INDEPENDENT of your company s network. If there is a disaster that impacts its network then you will have no way to execute these plans. Social networking can help to achieve those objectives. This is a brief list of tips and action items you can follow to start using social networking as a tool to assist in the Disaster Recovery and Business Continuity planning process. Creating Twitter Accounts What will be posting The sizes of the messages you send out on Twitter are very limited, so you'll tend to ask brief questions or post brief answers or announcements. Be careful not to release confidential or sensitive data. Create a hashtag (#) that is relevant to the event As a good practice create and manage a hashtag that describes the event and the company. For example #companynamehurricane. Then have someone follow the hashtag to ensure that the latest information is posted that hashtag. Keep your posts relevant and valuable When someone "follows" you on Twitter, they have searched for a Twitter account name and clicked the "Follow" button. They will expect that you post relevant comments or announcements with that account. Since they will be seeing or reading your posts, you want them to expect a certain kind of value and receive that. How many accounts? You will want two different kinds of Twitter accounts: one for yourself as an individual and another for your company or its major offering. For is for the Business Continuity Manger s individual communication is for the company's topic-specific comments 19

8 Incident Communication Contact Form 25

9 What s New Version 1.5 Updated section on Twitter communication Updated Best Practices Version 1.4 Added Federal Computer Security Incident Handling Requirements Updated Electronic Forms Version 1.3 Added more emphasis on social media and networking Updated electronic forms Version 1.2 Business Continuity Communication Lifecycle Incident Communication Contact Form Version 1.1 Updated policy to reflect social networks, automated news feeds and Internet sites Added Social Networking Checklist 26