Corporate Communications During a Technology Incident

An outage, a data breach or a failed release puts a company in the spotlight within minutes. Customers cannot log in, staff field angry calls and social media fills with guesses. How you communicate in the first hours shapes trust long after the technical fix.

This guide is for communications leads, executives and technical managers. It sets out a practical approach to incident communications that works for a ten-person company and for a multinational with regulators in several countries.

Prepare in advance

Roles

Agree who does what:

• Incident lead: runs the technical response.
• Communications lead: owns messages and channels.
• Executive sponsor: approves sensitive statements and decisions.
• Spokesperson: the single voice to the media and the public.
• Legal and compliance: checks statements and manages notifications.
• Customer support lead: briefs front-line teams.
• People or internal communications lead: keeps staff informed.

Name deputies and keep contact details outside your normal systems, since email or chat may be down.

Channels

• A status page hosted separately from your main infrastructure, so it works when your systems do not.
• Email and in-app messages for affected customers.
• Social media accounts for short updates and links.
• A staff channel for internal briefings.
• A press contact and media statement process.
• A phone line or support message that points to the status page.

Templates

Write drafts for common cases such as outage, degraded performance, security incident and data exposure. Include blanks for what happened, who is affected, what you are doing, what customers should do and when the next update will be. Have legal review the text in advance.

Decision rules

Define severity levels, who can approve messages at each level and how fast. Set triggers for notifying regulators, insurers, partners and the board.

The first hour

1. Confirm the facts you have. What is affected, since when, and for whom?
2. Acknowledge quickly. A short message such as “We are aware of an issue affecting login and are investigating” is better than silence.
3. Set expectations. State when you will next update, even if there is no new information.
4. Brief staff. Support teams need the same facts customers receive, plus guidance on what to say and what to escalate.
5. Start a log of decisions, messages and times.

Writing good updates

• Lead with impact and what customers can do.
• Use plain language, short sentences and no jargon.
• State facts and label unknowns as unknown.
• Avoid blame, speculation and promises you cannot keep.
• Express empathy sincerely and briefly.
• Give times in a clear time zone, for example UTC, with a note for local times if you serve many regions.
• Keep a consistent format so readers can find the new part.

A simple structure works well: what happened, who is affected, what we are doing, what you can do, next update time.

Security incidents and data breaches

These carry extra duties:

• Involve legal counsel early.
• Check notification rules in each country where affected people live. Deadlines and content requirements differ and can be short.
• Notify affected individuals clearly: what data was involved, what the risks are, what you are doing and what they should do.
• Provide support such as a help line or credit monitoring where appropriate.
• Avoid statements about cause or attacker identity until confirmed.
• Coordinate with law enforcement and insurers when relevant.
• The incident response plan and the communications plan should link. Our article on incident response planning covers the technical side.

Different audiences

• Customers: need to know impact, workarounds and timing.
• Staff: need facts first, plus clear guidance for customer conversations.
• Executives and board: need a concise view of risk, cost and decisions.
• Partners and suppliers: need to know if their systems or data are affected.
• Regulators: need formal notices within required timelines.
• Media and social channels: need a short, accurate statement and a contact.
• Investors: in listed companies, disclosure rules apply and legal advice is essential.

Social media

Monitor mentions, respond to individual customers politely and direct them to the status page. Do not delete criticism. Correct factual errors with links to official updates. Pause scheduled marketing posts during a serious incident.

After the incident

1. Confirm resolution and thank customers for patience.
2. Publish a post-incident summary with a timeline, cause, impact and the steps you are taking. Share what you can without exposing sensitive security details.
3. Offer remedies where appropriate, such as service credits.
4. Hold a review with technical and communications teams. Update templates and plans.
5. Track trust measures such as support contacts, churn and sentiment.

Common mistakes

• Waiting for complete information before saying anything.
• Different people giving different facts.
• Over-promising a fix time.
• Technical jargon in customer messages.
• Hosting the status page on the same infrastructure that has failed.
• Forgetting staff, who then improvise.

Practice

Run a tabletop exercise at least once a year. Simulate an outage and a data breach, draft messages under time pressure and test approvals. Include executives, support, legal and technical teams.

How SoftSapien supports communications readiness

SoftSapien works with leadership and communications teams to build incident communications plans, templates and exercises, alongside technical response planning. Our corporate communications practice works with our cybersecurity consulting specialists so messages and technical facts stay aligned.

Contact us through the contact page to chat with our team, send a message or schedule a free consultation call.