What should incident communications plans include?

• A. Only internal notifications.
• B. No defined roles; ad hoc responses.
• C. Rely on external media to disseminate information.
• D. Establish clear incident communication plans, roles, reporting channels, and stakeholder notifications; maintain evidence integrity.

Answer: (D)

The situation calls for a structured, controlled approach to sharing information during incidents. A strong incident communications plan isn’t just about sending notices; it sets up who talks to whom, through which channels, and when. It defines roles so there’s a clear speaker and a clear point of contact for each audience, preventing rumors or duplicate messages. It also specifies reporting channels and cadence—how updates are produced, by whom, and how frequently they’re delivered to leadership, technical teams, customers, regulators, partners, and other stakeholders.

Including stakeholders in the plan ensures that everyone who needs to know is informed in a timely and appropriate way, with messages that are consistent and accurate. The plan also emphasizes maintaining evidence integrity—preserving logs, copies of communications, and the chain of custody for any artifacts related to the incident—so investigations and post-incident reviews are credible and defensible.

These elements together create a disciplined response that supports decision-making, satisfies regulatory and contractual obligations, helps preserve trust, and enables a clear, coordinated recovery path. In contrast, focusing only on internal notifications, relying on ad hoc responses without defined roles, or depending on external media for messaging leaves gaps in control, timing, and accountability, and can lead to misinformation or delayed actions.