Who Hears What: The Incident Communication Matrix

Four hours into the incident, the technology is going fine and the communication is a mess. Employees heard from a screenshot. A key customer heard from a journalist. The insurer heard nothing, which will matter later. Everyone was informed eventually, just not by you, which means the story belongs to whoever told it first.

Incident communication fails for a predictable reason: it is improvised. The response plan covers servers and forensics in detail, then says 'stakeholders will be notified as appropriate.' In the moment, appropriate means whoever someone happened to call.

The fix is a matrix built in advance: for each audience, who tells them, what they are told, in what order, and through what channel. Writing it is an afternoon. Not writing it costs the first day of every incident.

Key takeaways

• Communication is a workstream with an owner, not a byproduct of the technical response.

• Pre-build the audience list: employees, customers, partners, insurers, vendors, board, media.

• For each audience, pre-decide the sender, the trigger, and the channel.

• Draft holding statements now; edit them under pressure later.

• Control the timing: internal audiences before external, always.

Step 1: List the audiences and their senders

Start with who needs to hear from you in a serious incident: all employees, key customers, critical suppliers, your insurer, your response retainer, the board, and possibly media and regulators. For each, name the sender now: the CEO calls top customers, the account manager calls the rest, HR writes to employees.

This fictional example shows the top of one company's matrix. It is an illustration, not a prescription.

Audience	Sender	Trigger	Channel
All employees	CEO via HR	Any S1 or S2 incident	Email plus town hall
Top 10 customers	CEO or account owner	Confirmed impact on their data or service	Phone call
Insurer	CFO	Any S1 incident	Broker, within 24 hours
Board	CEO	Per escalation triggers	Phone, then written summary

The matrix is short enough to print on one page, because in an incident nobody reads further.

Step 2: Pre-draft the holding statements

Every audience gets a holding statement: two or three sentences that say what happened in plain terms, what you are doing, and when you will update next. Draft these now, with brackets for the facts, and have counsel review the template.

The value is speed without sloppiness. The employee note can go out in an hour instead of a day, and it will not accidentally promise things the investigation has not established.

The thinking in the customer call before the breach is confirmed applies broadly: saying 'we are investigating and will update you by Friday' is almost always better than silence.

Step 3: Sequence internal before external

A rule that saves relationships: no external audience hears it before your own people. Employees who learn about the incident from a customer call cannot reassure that customer, and they will not trust the next internal update either.

Build the sequence into the matrix with times: employees at hour two, customers at hour four, partners at hour six. The times will slip in practice, but the order holds.

Keep the public surface consistent too; the discussion of status pages that outrun the incident plan shows what happens when the website tells a different story than the phone calls.

Step 4: Rehearse the matrix, not just the plan

In the next tabletop, run the communication workstream for real: draft the employee note in the room, role-play the customer call, check that the insurer's notification line works.

Communication findings are the cheapest to fix and the most damaging to skip. A holding statement with the wrong approval chain, or a customer list that lives in one person's inbox, is discovered in ten minutes of rehearsal or in the first hour of a real incident.

The related discussion of customer call is worth your time alongside this one. The related discussion of status page is worth your time alongside this one.

Frequently asked questions

Who owns the communication workstream?

One named person, usually from communications or the executive team, working alongside the incident lead. If everyone owns it, no one does, and the technical lead ends up writing emails at midnight.

What if we do not know yet whether data was taken?

Say exactly that, with the next update time. 'We are investigating, here is what we know, you will hear from us by Thursday' preserves trust. Silence invites your audiences to fill the gap themselves.

How much should counsel review?

Templates in advance, facts in the moment. Counsel should pre-approve the holding-statement structure so that during an incident the review is minutes, not days.

A Defensible Next Step

Open your incident plan and find the communication section. If it fits in one paragraph, build the matrix this month: audiences, senders, triggers, channels, and three holding statements. Book a Decision-Clarity Call if you want a working session to draft it.