How to protect reputation during a cybersecurity incident

MásQueDigital was born of a reputational attack on the senior leadership of a financial institution. I learned then something I still apply: the technical incident and the narrative incident are not the same, but they feed each other. If you do not have a habitable digital identity the day before, on the day of the attack you will only be able to react.

Audiences, not “the public”

An incident does not have one audience. It has several, with different duties. Treating them as a single statement is a way of worsening the damage.

• Employees: they need instruction, not slogans. They are the first channel of rumour.
• Clients and users: they need to know what to do and what they need not yet fear.
• Regulators and counterparties: they need facts, deadlines and an interlocutor.
• Board and shareholders: they need options and the time of the next decision.
• Press and social networks: they do not always deserve an immediate response.

Confirmed facts and information gaps

• Do not lie. A lie has a useful life of hours and a bill of years.
• Do not fill the silence with adjectives. “We are committed to excellence” is not a fact.
• Separate the confirmed, the probable and the unknown. A gap stated as a gap is a form of control.
• Do not let the attacker be the only one who publishes evidence. If there are verifiable facts, let them come from you, with a date and a scope.

Spokesperson protocol

Legal, technology and communications prepare. One person speaks. The rest of the organisation redirects. The board must know the situation sentence before it goes out, not read it in the press.

1. Name a spokesperson and an alternate before the incident.
2. Agree an internal channel to approve sentences, with a cut-off time.
3. Prohibit improvised debates on social networks and in television corridors.
4. Record every message issued: to whom, when, with what facts.

When to respond and when to keep silent

Respond when there is a fact the public can use, an obligation to notify or an imposture already circulating under your name. Keep silent when the only alternative is to fill with adjectives, discuss forensic nuances or fight with anonymous accounts. Coordinated silence is a form of communication. Debate with anonymous accounts is not.

That is why this site exists: so that the official source is not someone else’s clipping. During the incident, a situation sentence, a single channel, a commitment to update and zero improvised debates.