Megan M. Moloney (moloneymegan@gmail.com) is a Senior Strategy, Risk, and Compliance Manager at the Federal Bureau of Investigation in Washington DC.

Cyber incidents are no longer the purview of security and information technology professionals alone. Compliance officers, risk managers, and the full range of C-suite executives ignore this topic at their own risk. An important first step for senior executives is to establish and participate in cross-functional cybersecurity governance structures that span all verticals of the organization, including traditional outliers of compliance, risk management, human resources, and communications. This ensures that all entities within your business are actively contemplating their potential exposure and cyber security responsibilities. Once such structures are in place, members must assess the cyber security posture of the business, including but not limited to its readiness for and response to cyber incidents. A fundamental piece of preparing for and responding to a cyberbreach is effective communication with the government.

Let’s be honest. Over the past decade, there has been a tangible boardroom reluctance to share details about cyber security threats and intrusions with the government. This is understandable, because there are real concerns regarding legal and regulatory risk, privacy, and reputational damage. But this reluctance has also been and continues to be detrimental to the collective security of the country and businesses operating within it.

In 2013, Presidential Policy Directive 21, Critical Infrastructure Security and Resilience (PPD-21), identified 16 critical infrastructure sectors “whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.”^[1] ,^[2] In the time since, there has been tremendous coordination between the government and these sectors, but the increasing number of attacks on non-critical infrastructure demonstrates the need for this cooperation to expand to other industries. In 2016, Presidential Policy Directive 41, United States Cyber Incident Coordination (PPD-41), set forth that “significant cyber incidents demand unity of effort within the Federal Government and especially close coordination between the public and private sectors,” without singling out any industries.^[3] Meaningful coordination between the government and private sector entities of all flavors will not only improve preparedness and response, but may also, ultimately, save lives.

Government communications take many different forms. The ideal communication plan for your organization should be tailored to the size, industry, and known risks of the entity in question. That said, the general steps below apply to virtually all organizations and, if taken, will improve your positioning before, during, and after a significant cyber incident.