📣 Communications, public affairs, and legal

Before Prepare

• Pre-draft holding statements, FAQ skeletons, and stakeholder lists for a ransomware-style incident.
• Map regulatory and contractual notification obligations: FERPA, HIPAA (if applicable), GLBA, state breach laws, GDPR (for EU-resident data), grant requirements, and insurer terms.
• Establish out-of-band communication channels (mass notification, SMS, fallback web page hosted off your main domain) and test them.
• Identify and brief spokespeople; coordinate roles between communications, legal, IT, and senior leadership.
• Build trust ahead of time with student media, local press, and the campus community — an established voice helps in a crisis.

During Respond

• Use the IR plan’s communication cadence: frequent, factual, and consistent. Don’t speculate on attribution or scope.
• Coordinate every external statement with legal, IT, leadership, and (where relevant) law enforcement and insurer counsel.
• Be transparent about what you know, what you don’t, and what you are doing. Vague statements erode trust faster than honest uncertainty.
• Have a single source of truth (a status page or pinned campus channel) and direct everyone to it.
• Track all communications in the incident timeline; they are part of the regulatory record.

After Recover & learn

• Issue closing communications: what happened (at the appropriate level of detail), what was affected, what changed, and what people should do.
• File required regulatory notifications within statutory deadlines; document the analysis behind notification decisions.
• Conduct a communications-specific AAR: what messaging worked, what didn’t, where channels failed.
• Update playbooks, contact lists, and templates with what you learned.