What is critical for incident communications management in Annex B?

• A. List only technical details in breach reports.
• B. Establish clear incident communication plans, roles, reporting channels, and stakeholder notifications; maintain evidence integrity.
• C. Freeze all communication to avoid panic.
• D. Assign communications to external vendors only.

Answer: (B)

At the heart of incident communications management is having a clear, predefined plan that sets who communicates what, when, and to whom, along with the channels used and who must be notified. This includes clearly defined roles and responsibilities, established reporting paths, and a structured list of stakeholders to keep informed throughout the incident. Maintaining evidence integrity—secure logging, proper handling of artifacts, and an auditable trail of communications and actions—ensures the incident can be understood, analyzed, and potentially used for legal or regulatory purposes later.

Why this fits best: it provides the discipline and coordination needed during an incident. Coordinated communications prevent confusion, ensure timely, accurate updates, support decision-making, and help manage stakeholder expectations. It also protects the integrity of the evidence and the incident timeline, which is crucial for investigations and lessons learned.

In contrast, merely listing technical details in reports omits who needs to know, how updates are delivered, and how to preserve evidence. Freezing all communication stops coordination and can worsen the situation by hiding critical information. Relying exclusively on external vendors for communications ignores internal accountability and can introduce delays and misalignment with organizational priorities.