When Email Is the Thing That's Down: Out-of-Band Communications

Halfway through the ransomware response, someone asks why the incident commander has not replied, and the answer lands: email is one of the systems that is down. The response plan, the contact tree, and the retainer details are all in the mailbox nobody can open.

Incident plans assume communication works. When the incident is the communication system, the plan's first hour is spent rebuilding the ability to coordinate instead of coordinating. Attackers inside the email system get the bonus of reading the response as it happens.

The fix is a small out-of-band layer: channels, contacts, and documents that live outside the systems most likely to be down, tested often enough that people remember they exist.

Key takeaways

• Assume email and the corporate directory may be unavailable or monitored during an incident.

• Stand up an alternate channel for the response team before one is needed.

• Keep printed or offline copies of the plan, the contact tree, and the retainer details.

• Include personal contact details for key responders, maintained with consent.

• Test the out-of-band path in every exercise, because unused channels rot.

Step 1: Decide what lives outside the blast radius

List what the response needs in its first hours: the incident plan, the contact tree with personal numbers, the retainer and insurer details, the credentials for the alternate channel itself. All of it must be reachable when email, single sign-on, and the file share are all down.

The test for the list is simple: could the response lead coordinate the first four hours from a phone on cellular, with the office network treated as hostile?

Step 2: Stand up the alternate channel

The alternate channel is usually a dedicated group on an end-to-end encrypted messaging app, restricted to the response team and key executives, set up and tested before it is needed. It is for coordination, not evidence: decisions that need records get moved to official systems once they recover.

This fictional example shows one company's out-of-band setup. It is an illustration, not a prescription.

Need	Primary	Out-of-band
Response team coordination	Email, chat	Dedicated Signal group
Contact tree	HR directory	Printed card, phone contacts
Plan and retainers	SharePoint	Printed copy plus personal drive
Board notification	Email	Phone tree from the chair

Two cautions: keep the group exercised and current, and keep personal numbers under a consent rule so the list stays maintained.

The pre-made decisions in the ransomware readiness briefing are only reachable if the channel to them survives.

Step 3: Print the critical pages

It feels archaic until it saves the day: a printed one-pager with the response team's personal numbers, the retainer hotline, the insurer's notification line, and the first-hour checklist, kept by the response lead and the executive sponsor.

Digital copies belong in a place reachable without corporate login: the personal cloud drive or the password manager's secure note. The point is not nostalgia for paper; it is that the plan cannot depend on the systems it exists to rescue.

Step 4: Exercise the path, not just the plan

In every tabletop, force the first fifteen minutes onto the out-of-band channel. Declare email unavailable at the start and let the team discover what it actually has: whether the group still exists, whose number changed, who never installed the app.

These findings are free in an exercise and expensive in an incident. The discussion of building a resilient incident response program makes the same point from the program level: resilience is the practiced version, not the documented one.

The related discussion of ransomware readiness is worth your time alongside this one. The related discussion of resilient incident response program is worth your time alongside this one.

Frequently asked questions

Is a consumer messaging app appropriate for incident coordination?

For coordination during the outage, yes, with rules: restricted membership, no sensitive evidence or customer data, and records moved to official systems afterward. The alternative being avoided is improvisation on personal SMS with no membership control.

How do we keep personal numbers current?

Tie the list to the exercise cycle: every tabletop starts by verifying the tree. A list that is tested twice a year stays current; one filed away rots quietly.

Should external counsel and the retainer be on the alternate channel?

The key external contacts belong on the printed tree. Whether they join the channel itself is a judgment call; what matters is that you can reach them when your normal identity and email are untrusted.

A Defensible Next Step

Run the thought experiment tonight: email, SSO, and the file share are down and possibly monitored. How does your response team coordinate its first hour? If the answer is 'good question,' build the out-of-band layer this month. Book a Decision-Clarity Call if you want it designed and tested.