A contact directory is not a communications plan. The plan must be activatable under reduced trust, testable and regularly exercised.
A complete incident communication plan defines activation, decision roles, an independent contact tree, primary and fallback channels, permitted data, a standard situation format, escalation times, evidence separation, exercises and return procedures.
Name observable activation conditions such as identity-provider outage, suspected account takeover, manipulation indicators or ransomware. 'When required' is not an actionable trigger.
Primary and alternate roles can activate. Time, reason, affected trust boundary and next review are recorded immediately.
Contacts stored only in the affected directory or mailbox may be unavailable when needed. Keep a minimal protected offline or out-of-band tree with alternates.
The list has an owner, review cadence and a recorded last test.
Document purpose, protection boundary and exclusions for every channel. Phone may confirm identity but is poor for large evidence files; a messenger coordinates but still depends on endpoint and identity state.
Rank channels by remaining trust: primary, independent fallback, personal last resort and public status surface for approved statements.
Technical teams, leadership, staff, customers, authorities and media have different information needs. Name author, approver and route for every audience.
Use a standard fact, assessment, decision and next-time format. Avoid attribution and unconfirmed impact.
State which data class may cross which channel. Credentials, secrets, sensitive personal data and raw forensic artifacts often do not belong in the general room.
Record decisions quickly while original evidence remains in its controlled repository.
Exercise activation at least after material changes and at a cadence proportionate to criticality. Measure activation, reachability, identity confirmation, first correct update and open blockers.
Every finding receives an owner and deadline. A plan without tracked corrections is documented hope.
A contact directory is not a communications plan. The plan must be activatable under reduced trust, testable and regularly exercised.
After material changes and regularly according to criticality. Critical contact and switching paths should be exercised more often than a paper review.
Yes, with separate audiences, approvals and channels. Technical detail and public statements must not be mixed without control.
No. It structures communication capability and must be embedded into the organisation's incident, continuity and privacy model.
