USA – ILLINOIS Trends and Developments Contributed by: Jamie Singer and Meredith Griffanti, FTI Consulting, Inc.
from the jump. And, importantly, this equation includes outside cyber counsel. In cybersecu- rity matters, it is essential that legal and com- munications strategies are aligned, and com- munications teams are not inadvertently using messaging that could create additional legal risk. Additionally, it is important that companies are working with partners who understand the regu- latory aspects of these incidents and can antici- pate the public exposure that comes with certain regulatory disclosures, such as substitute notice and state attorneys general notifications. It is also crucial to engage communications partners who understand how to work with, and at the direction of, outside counsel. This helps to pro- tect legal privilege over communications work product, which is often traded back and forth between client-advisor teams and heavily edited and evolved as the incident unfolds. Cybersecurity trade media are a unique breed Cybersecurity trade publications, bloggers and security researchers tend to dominate when it comes to breaking news about an unfolding incident. But, they do not always operate like typical journalists. Cybersecurity media rou- tinely monitor the dark web and sometimes have direct lines of communication to threat actor groups. Additionally, these reporters often double as technical experts and are viewed by other media as credible sources of information. When it comes to that first piece of coverage in a cybersecurity trade publication, getting it right is critical; local and national media frequently take their cues from the cybersecurity trades about a new incident. This is why it is important to engage communications specialists who have longstanding relationships with cyber journalists, know what to anticipate from them, and can help balance the public narrative from the outset of an incident.
Highly technical concepts need to be translated for a general audience While information security teams understand the ins and outs of a cyber-attack and the technical aspects of remediation and recovery processes, most of the general public does not. Accord- ing to recent research from FTI Consulting’s Cybersecurity & Data Privacy Communications practice, CISO Redefined: Navigating C-Suite Perceptions & Expectations, during a cyberse- curity event, the majority of C-suite executives surveyed believe their Chief Information Secu- rity Officers (CISOs) are not completely pre- pared to communicate with the most important internal and external stakeholders. Translating highly technical concepts into clear, digestible and actionable information for non-technical audiences like customers, employees or media is critical during a cybersecurity matter. Enter cybersecurity communications experts, who liaise between information security profession- als, legal teams and communications teams every day – they understand different acronyms, tools and technologies that are associated with various attacks and threat actor groups. Ulti- mately, this helps to ensure important informa- tion makes its way into an effective and clear organisational response. Corporate communications/PR teams will be stretched Initial communications at the outset of an inci- dent are only the beginning. Once informed of a potential incident, questions and responses will be flooding in from stakeholders – such as requests for detailed security questionnaires, third-party attestations and one-on-one calls with information security teams. This means the company needs to maintain a centralised pro- cess for managing the inbound questions and again, ensuring consistent responses are going out. Such a process often requires having suf-
175 CHAMBERS.COM
Powered by FlippingBook