Trust is the entire product. For SaaS, identity, payments, security, and healthcare companies, the breach is the product crisis. Lost trust translates directly into customer churn, SOC 2 audit failure, and enterprise procurement disqualification.
The Regulatory Architecture
SEC Item 1.05. Form 8-K disclosure within four business days of determining a cybersecurity incident is material, plus annual 10-K disclosure of cybersecurity risk management. The SEC's SolarWinds enforcement action (October 2023, ongoing) reset the bar on what counts as material and what counts as misleading risk disclosure.
State breach notification laws. All 50 states plus DC, with timing ranging from "in the most expedient time possible" to specific 30-, 45-, 60-, or 90-day clocks. California (CCPA/CPRA), New York (SHIELD Act), Massachusetts, and Texas have the most stringent regimes. The communications team needs a 50-state matrix at the ready.
CISA and CIRCIA. The Cyber Incident Reporting for Critical Infrastructure Act mandates 72-hour incident reports and 24-hour ransom payment reports for covered entities across 16 critical infrastructure sectors, with phased enforcement through 2026 to 2027.
Sector-specific. HIPAA breach notification for healthcare (60 days, HHS portal, media if affecting 500 or more in a state), the GLBA Safeguards Rule for financial services, NYDFS Part 500 for New York financial institutions, PCI DSS for payment card environments, FERPA for education, and Sarbanes-Oxley for public companies.
International. GDPR (72 hours to the supervisory authority), UK ICO, Brazil LGPD, India DPDP Act, Australia OAIC, and the EU NIS2 Directive.
The Four Phases of a Cyber Crisis
Latent. The intrusion has occurred but is undetected. Average dwell time across published incident reports runs 180-plus days, and the company has no opportunity to act because it does not know. The latent phase is where the security investment pays or fails.
Acute. Detection through public disclosure. The threat actor may be active, the forensics are incomplete, the customer notification clocks are running, and the SEC clock starts on materiality determination. Acute phases run 7 to 30 days.
Managed. The incident is contained, forensics are substantially complete, notifications are sent, and the SEC 8-K is filed. The company is responding to follow-on questions, customer churn calls, audit findings, regulatory inquiries, and litigation. Managed phases run 30 to 180 days.
Residual. Class actions, SEC enforcement, state AG actions, customer lifetime value impact, and SOC 2 audit lift. Residual phases run 2 to 7 years; the Equifax 2017 residual phase ran more than five.
The First 45 Minutes
Activate the crisis team. CEO, CISO, CIO, General Counsel, Chief Privacy Officer, Head of Communications, Head of IR, outside counsel (privilege-aware), and an incident response firm (Mandiant, CrowdStrike Services, Unit 42, and similar). The IR firm seat is non-optional, and the choice shapes the narrative, as EPR shows in how forensic vendor selection shapes breach narratives.
Engage outside counsel for privilege. Before any external communication. Outside counsel structures the investigation under attorney-client privilege, manages the IR firm contract under privilege, and shapes communications language to preserve attorney work product protection.
Establish the technical facts. What is known about the intrusion vector, the data accessed, the systems compromised, and the duration. Forensics evolve; communications has to know what is locked and what is still moving.
Determine materiality and start the SEC clock. For public companies, the four-business-day clock under Item 1.05 begins at materiality determination. Documentation of the materiality assessment is itself evidence in subsequent enforcement.
Identify the audiences. Affected customers, the broader customer base, employees, regulators (SEC, state AGs, CISA, sector regulators), partners and vendors, law enforcement (FBI, Secret Service), investors, the press, and the security research community.
Draft the holding language. Forensically conservative, legally privileged-aware, and disclosure-clock compliant. Beauty of language is secondary; defensibility is primary. Hedge words such as "currently believe" and "based on our investigation to date" are not weakness, they are accuracy.
Brief the customer-facing staff. Sales, customer success, and support. The customer is calling them within hours. Frontline scripts and escalation paths prevent the brand from creating new exposures through improvisation.
The Response Architecture: Eight Layers
The 8-K. Securities disclosure, the legal floor for the public communication. Drafted by securities counsel, reviewed by the disclosure committee, filed within the Item 1.05 clock.
The customer notification. Direct, multi-channel, state-by-state compliant, covering the form, the offer (credit monitoring, identity protection), and the timing. For B2B SaaS, individual outreach to enterprise customers per contract requirements.
The regulatory communication. CISA report, state AG notifications, HIPAA breach notice to HHS if applicable, NYDFS for covered financial institutions, and international authorities under GDPR, LGPD, or DPDP.
The employee communication. Internal-first. Employees are calling family during the crisis, and what they say externally shapes the narrative.
The partner and vendor communication. Downstream and upstream parties affected, including SaaS customers if the company is a SaaS provider, or supply chain customers if the company is a vendor.
The press communication. Trade press first (Krebs, BleepingComputer, The Record, CyberScoop), then mainstream. Security researchers often have parallel information; engagement with the research community shapes how the breach is characterized. EPR's ranking of the cybersecurity publications AI engines cite most shows which outlets carry the most weight.
The investor communication. Beyond the 8-K, an analyst call, IR outreach, and financial impact framing.
The AI engine layer. ChatGPT, Claude, Perplexity, Gemini, and Google AI Overviews retrieve from the press substrate. The breach narrative the engines synthesize during the acute phase becomes the answer for every subsequent enterprise procurement query, which is why AI reputation management matters more in cyber than in most categories. The vendor-side picture is in how AI engines choose cybersecurity vendors.
The Categories of Cyber Crisis
Data breach. Unauthorized access to personal information. Most common, most regulated, longest tail: Equifax, T-Mobile, AT&T, Yahoo, Marriott. The retail precedent is the 2013 Target data breach.
Ransomware. Encryption and ransom demand, often with data exfiltration (double extortion). Operational disruption is often the most visible crisis layer: Colonial Pipeline 2021, Change Healthcare 2024, MGM Resorts 2023.
Nation-state intrusion. APT actors with strategic objectives, such as Microsoft Storm-0558 (2023), Midnight Blizzard (2024), and SolarWinds (2020). The communications layer involves federal coordination beyond standard regulatory engagement.
Supply chain compromise. Vendor or software-supply-chain compromise that flows downstream, as with SolarWinds (2020), Kaseya (2021), MOVEit/Clop (2023), and the Snowflake-credentialed customer breaches (2024).
Operational outage from misconfiguration. The CrowdStrike July 2024 outage is the structural case: a faulty content update grounded airlines, hospitals, and broadcasters globally. The communications response is studied for transparent technical detail and CEO-led accountability.
Insider threat. Departed employee data exfiltration, contractor abuse, or executive misconduct involving system access.
Vulnerability disclosure. Researcher-discovered vulnerability with a coordinated disclosure timeline. Different from incident response: the company has not been breached but must communicate about the fix and any in-the-wild exploitation.
Case Studies
CrowdStrike outage, July 2024. A faulty content update to the Falcon sensor caused Windows endpoints worldwide to fail. CEO George Kurtz led the response within hours, technical post-mortems were transparent, and the company published detailed root-cause documentation. The communications response is the post-2023 reference case for operational-failure incident handling. The full account is in how CrowdStrike handled the largest IT outage in history.
SolarWinds and the SEC, 2020 to 2024. The breach itself in 2020 was severe. The SEC charges against SolarWinds and its CISO in October 2023 reset the bar on what executives can say in 10-K cybersecurity risk disclosures.
Equifax, 2017. The canonical bad case: delayed disclosure, an executive stock sale during the latent phase that drew SEC scrutiny, a botched customer remediation site, and executive departures. The full account is in the Equifax breach communications case study.
Change Healthcare and UnitedHealth, 2024. ALPHV/BlackCat ransomware crippled pharmacy and provider billing for weeks. The communications response was criticized for opacity on impact and slow customer notification, and the CEO testified before Congress. The staged disclosure is covered in how UnitedHealth communicated about the Change Healthcare breach.
Colonial Pipeline, 2021. Ransomware shutdown of fuel distribution. The communications response was transparent on operational impact, the ransom payment decision was disclosed, and the federal coordination was visible.
MGM Resorts, 2023. Social engineering to the IT helpdesk by Scattered Spider, followed by ransomware deployment and multi-day operational disruption. The communications response was minimal initially; the case is studied for what happens when the company chooses silence and the threat actor narrates the breach instead. The timeline and ransom question are covered in how MGM Resorts responded to the cyberattack.
Case Application: Higher Education, the Most-Targeted Vertical
Higher education is the most-targeted vertical for ransomware and data breach attacks in the United States. Universities hold high-value data (research, financial, demographic, health), operate complex distributed networks, run heterogeneous IT environments, and have limited security budgets relative to corporate peers, which makes the general framework above especially concrete when applied hour by hour.
The First 24 Hours in Higher Education, Sequence
Hours 0 to 2. Incident confirmed by IT security. Crisis team activated: president, provost, CIO, CISO, general counsel, CCO, and board chair notified. Forensic response engaged, typically through a pre-negotiated incident response retainer. Decision made on system isolation, with affected systems taken offline if needed, and the insurance carrier notified.
Hours 2 to 6. Initial scope assessment: which systems are affected, what data was accessed, what the operational impact is. Initial stakeholder communications go internal first, with faculty, staff, and students notified that an incident is being investigated. Federal and state law enforcement are notified (FBI, state attorney general, applicable state agencies), and media monitoring is activated.
Hours 6 to 12. The full crisis communications team is operational. External communications strategy is decided and a public statement is drafted. Detailed stakeholder communications are planned for students, parents, faculty, alumni, donors, and trustees. Operations continuity decisions cover class schedules, payroll, and financial aid disbursements.
Hours 12 to 24. The public statement is issued and press inquiries are managed through a documented protocol. Affected individuals, students, employees, and alumni whose data may be exposed, are notified per state law requirements. The board is briefed and the Day 2 plan is locked.
What Institutions Get Wrong
Delayed external communications past 24 hours typically produce media coverage that frames the institution as evasive regardless of the underlying facts. Over-claiming, meaning public statements that minimize scope before forensic work completes, damages credibility when subsequent revisions become necessary. Under-coordinated stakeholder communications, where students, parents, faculty, alumni, donors, and trustees hear contradictory or sequenced information, erodes trust further. Inadequate forensic infrastructure is the most costly gap: institutions without pre-negotiated incident response retainers spend the first 12 hours selecting and onboarding a forensic firm, losing the time that determines containment success.
The Pre-Built Infrastructure Every Institution Needs
Six components should exist before any incident: a documented incident response plan specific to the institution, reviewed annually and tabletop-exercised quarterly; a pre-negotiated forensic retainer with a major incident response firm such as Mandiant, CrowdStrike, Kroll, or FTI; adequate cyber insurance coverage with the carrier briefed on the institutional environment (carriers now look closely at the plan itself, as EPR explains in why cyber insurance carriers vet your comms plan); pre-approved external communications templates for the most likely incident types (ransomware, data breach, system disruption, supply-chain compromise); tested and operational mass notification systems for stakeholder communication; and documented board and trustee briefing protocols with a pre-built escalation pathway, since the CISO board briefing is now a regulated, auditable communication.
Institutions that have built this infrastructure absorb cybersecurity incidents as operational events. Institutions that have not experience them as existential threats, and a meaningful share emerge with permanently damaged reputations, leadership transitions, and multi-year financial impact.
The Spokesperson Question for Cyber
CISO leads on technical narrative. The Chief Information Security Officer is the credible voice on what happened, how the company responded, and what the technical remediation involves.
CEO leads on existential and customer trust. The Tylenol pattern applies: for severe breaches affecting customer trust at scale, the CEO has to be visible. CrowdStrike's George Kurtz in July 2024 is the recent reference.
General Counsel leads on regulatory and litigation. SEC disclosure language, state AG engagement, and class action exposure.
Avoid the lawyer-only voice for customer-facing communications. Customer trust does not respond to defensive legal language. The communications function has to maintain an authentic voice while accepting legal and regulatory review.
Recovery in Cyber
Visible operational change. The security architecture actually changes, audit results improve, and the remediation work promised in week one ships and gets documented.
Sustained transparency. Quarterly progress reports on the remediation, engineering blog posts on architectural changes, and conference presentations on lessons learned. The security community trusts companies that show their work.
Customer and partner engagement. Direct outreach to affected customers with substantive remediation, not boilerplate credit monitoring, and enterprise account-level communication that re-earns the procurement decision.
Crisis Playbooks by Sector
Every industry faces different crises. These playbooks map the specific regulatory architecture, stakeholder layers, and response sequences for a given sector.
- Healthcare, CMS, TJC, HIPAA, sentinel events, ransomware, workforce action
- Beauty, TikTok virality, retailer delisting, MoCRA, product liability
- Tech and SaaS, outages, breaches, pricing crises, founder conduct, open-source disputes
- Crypto, exchange collapse, smart-contract exploit, depegs, SEC/CFTC/OFAC action
- Hospitality, viral guest incidents, food safety, mass casualty, brand standard failure
- Restaurant, four-phase sequence, covers protection, reputation recovery
- Entertainment, talent misconduct, on-set fatality, concert tragedy, content controversy
- Financial Services, bank run, compliance failure, trading loss, fraud disclosure
- Real Estate, property casualty, tenant safety, fair housing, REIT activist
- Manufacturing, OSHA, CPSC, NHTSA, EPCRA/CERCLA statutory clocks
- Pharma, FDA recalls, DOJ investigation, manufacturing failure, pricing scandal
Not finding your sector? Start with How to Build a Crisis Communications Plan (Master Framework) or Crisis Communications Failures: The Five Patterns That Repeat.
Agency Crisis Specialists
FTI Consulting, cybersecurity, manufacturing, and financial services crisis specialist offering SEC disclosure coordination, CISA engagement, ransomware response, and forensic investigation counsel.
5W, cybersecurity crisis and reputation practice, with proprietary AI-visibility research across the category.
Adjacent EPR Coverage
