editione1.0.0
Updated October 9, 2023The first common element of both disaster recovery and incident response plans is the need to plan your communications during an emergency. There are many reasons why you don’t want to leave this to chance:
Your normal communication tools may not be available due to an outage or fault.
You may have no physical access to your communication devices, or other physical locations or equipment needed to use them.
You may not have reliable internet access.
Regardless of why you can’t just “do what you always do,” there are a number of key communications channels you need to establish when handling an incident or disaster. These include:
| Channel | Reason |
|---|---|
| Emergency Services | To coordinate any response needed from fire, ambulance, police, or other emergency support services. |
| Executive and Board | To communicate updates and briefings as the situation evolves. |
| Whole Company | To inform the team of the situation and any changes to operations as a result. |
| Media | To manage and respond proactively to media questions in the event of a publicized issue. |
| Customers | To support, soothe, and inform customers as the situation evolves, such that they know what to expect and are aware of any risks or service interruptions. |
| Internal Response Team | To communicate internally to collaborate on incident response or disaster recovery activity, as well as to capture the timeline of events as they emerge. |
When choosing appropriate communications channels and technologies, you should consider some of the following:
Does my audience have access to this channel?
Do we need any specialist equipment, accounts, or access that can be set up in advance?
Is this channel secure enough to send sensitive information during an emergency, or do you need to document guidance concerning what information can be shared and where?
Does my audience know where to expect communications?
Do I need evidence of this communication after the incident or disaster has ended?
The right communication channel is one that you can safely access, that can reach your required audience, and that will protect your communications in transit (while being sent) and at rest (once they have been sent). Remember that in stressful situations, choosing simple, reliable communication is much better for reducing stress than choosing cutting-edge, untested options. To that end, don’t forget that sometimes just picking up the phone and calling someone is the easiest path to get the job done.
For those items that need some form of evidence after the event, ensure that any verbal channels are followed up by written summaries, shared with both parties.
Whatever channels you choose, whether it be telephone, email, collaborative documents, or messaging platforms like WhatsApp, Signal, or Slack, remember to test them first—in fact, test the entire plan.
The second common element of both disaster recovery and incident response plans is the need to test that the plans work.
I know that it’s tempting to say “we have incidents all the time so we know what to do,” but in all honesty, just because you have incidents frequently, it doesn’t mean that they are representative of all the events you might need to deal with. There is also the question about who is “handling” your incidents. If you are responding from instinct, experience, or memory, that response is probably different from what is in your plan and may be difficult for someone else on the team to replicate.
important Every plan you create should be tested, at least once a year. It’s as simple as that.