Why Incident Response Communication Needs Automation—with Human Oversight

Summary

Manual incident communications can lag automated detection and strain trust. The article recommends automating coordination and update drafts while keeping human review, and describes proposed CIRCIA reporting deadlines.

Key points

• Incident communications remain largely manual even as organizations automate threat detection and response.
• A centralized crisis communication platform could coordinate status updates and notify stakeholders, including when normal channels are unavailable.
• Tabletop exercises and advance coordination with key contacts can help prepare organizations for incident communications.
• Organizations can automate incident timelines, stakeholder-notification tracking, and initial update drafts.
• The article recommends that a person verify communications before sending them because inaccurate breach notices can have legal and reputational consequences.
• The article says the proposed CIRCIA rule would require covered entities to report substantial incidents to CISA within 72 hours and covered ransom payments within 24 hours once in effect.

People