While everyone’s hearts may be focused on Valentine’s Day this week, we would also do well to have our minds considering another, less noticed occasion – today is National Safer Internet Day. One of the greatest challenges in public relations work is helping a client through a crisis. Literally everything can be at stake – from public health or safety, to confidence in the client’s brand, to the organization’s very existence.

Every crisis seemingly comes from out of the blue. But today, organizations face a particularly malicious threat that comes out of the dark: a cyberattack. While the technology behind such an attack demands a new kind of high-tech operational response, addressing the communications aspects calls for a deft blend of tried-and-true crisis communications tactics and previously unheard-of factors. This combination can make it particularly difficult to craft an effective response, but the stakes are too high for anything less.

The first rule of cybersecurity communications is simply recognizing that we’re all vulnerable to this serious threat. Where cyberattacks were once aimed primarily at major banks, corporations, and government agencies, nowadays any organization can find itself in the crosshairs. The goal of these attacks is no longer limited to the theft of sensitive information – today, cyber criminals are equally happy shutting down a business until a ransom is paid.

Every organization presents a desirable target for cyber hackers, cyber terrorists, and others who may seek to disrupt electronic operations. In addition, threats can come from within your organization – either caused unwittingly by employees, or the result of intentional leaks of information or improper use of equipment.

Our standard guidelines for crisis communications certainly hold true for cyberattacks: have a plan … don’t lie … break your own bad news … never say no comment … and more. But cyber threats also carry their own set of rules and restrictions, and anyone with a cybersecurity plan (and that should be everyone) ought to incorporate these additional considerations:

• Digital information is at the core of many cyberattacks, and the wide range of information stored electronically means the response may need to engage a full team of experts – not just communications professionals, but also the victim’s legal team, outside computer forensics firms, and other appropriate vendors. Be prepared for lots of experts reviewing everything.
• Many kinds of data breaches will implicate government regulations because breaches can affect everything from banking information to medical records, from tax documents to credit card accounts. If your business suffers a data breach, your team may need to take multiple steps to return to the good graces of those whose regulatory authority could otherwise stop you in your tracks.
• Depending on the nature of your organization, a data breach or cyberattack may trigger notification requirements involving appropriate state and federal authorities. Your cybersecurity plan should include a list of state and federal notification requirements applicable to your circumstances.
• Finally, when the attack has subsided, you will need to re-establish your relationship with the public in order to get operations back to normal. One good step would be for the client to hire a computer forensics firm to determine how the attack happened – and to help the communications professionals craft effective messaging to reassure the public that it won’t happen again.

A cyberattack is just about the last thing any organization wants – but it cannot be the last thing to plan for. It’s a lot more complicated than simply turning the computer off and then back on.