Incident recovery communication (RC.CO)

In this section, we will take a look at how we communicate our recovery to internal and external stakeholders. We will need to have plans in place for what we communicate and to whom. There are regulatory requirements that we must follow as well and we must ensure that we follow those guidelines so that we do not fall out of compliance.

RC.CO-03

Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders.

To meet the objectives of this control, we will need to review our contracts and compliance requirements that we have with our trusted third parties. This will require us to utilize our crisis communication plan (CCP) when communicating our recovery activities while reinforcing that we have our company’s and our customers’ best intentions at heart.

First, we need a way to securely share this information with others. While our immediate thought...