Your Business Goes Dark Tomorrow. What Do You Tell Customers?

David Jemmett, Chief Executive Officer

Key Takeaways

• Involve legal counsel early. Bring counsel into the response from the outset while authorized containment efforts move forward.
• Establish decision-making authority before a crisis. Know who can authorize critical actions and who takes charge when key leaders are unavailable.
• Communicate what you know, not what you assume. Give customers and employees verified information, acknowledge unanswered questions, and establish when they can expect updates.
• Know what your business needs to restore first. Identify critical operations, test recovery capabilities, and address gaps before an incident occurs.
• Practice the decisions your leadership team will face. Use tabletop exercises to uncover disagreements, clarify responsibilities, and prepare executives to respond under pressure.

It is 7:50 p.m. on a Friday. Your phone rings.

“I think we have been hacked.”

I receive calls like this from CEOs and other senior executives more often than you might imagine. The workweek is over, but suddenly they are facing decisions that could affect their entire business.

Critical systems may be unavailable. Employees need direction. The incident may affect customers. The executive on the other end of the phone wants to know where to begin.

What do you do first?

As a CEO, I think about cybersecurity in terms of the commitments we make every day. We promise customers we will deliver. Employees need to know they can depend on us. We ask investors and partners to trust our judgment.

A cyber incident can put all three commitments at risk.

This Cybersecurity Awareness Month, I want executive teams to consider a question. How prepared are we to lead when the systems our business depends on become unavailable?

Protecting Your Business Starts With the First Call

When executives call CISO Global about a suspected breach, we ask them to contact their attorney and have counsel retain us to support legal advice and, where appropriate, anticipated litigation.

While counsel arranges the engagement, we begin response work with the client’s authorization. Containment cannot wait. Counsel’s involvement should begin just as quickly.

Why does this matter? An incident can leave a business facing questions long after its systems come back online. How counsel structures the investigation and how the response team documents and shares its findings can affect the availability of attorney-client privilege and work product protection.

Having an attorney hire us does not automatically make every communication or report privileged. Counsel must structure and direct the legal investigation appropriately, and ordinary remediation work may remain discoverable.

I want executives to understand that their decisions during an incident extend well beyond the technical response. Bringing counsel into the response early supports informed decisions about communications, evidence, and legal obligations while our team works to contain and remediate the attack. 

The First Decision May Affect the Entire Business

Your security team may recommend taking systems offline to contain an incident. Operations wants to keep serving customers. Sales is worried about deliveries. Finance needs to process payments.

Each has a legitimate concern. Someone must weigh those concerns and make a decision.

Who has that authority? What information do they need? Who can act if the CEO is unavailable?

Your leadership team should answer those questions before an emergency.

Security teams bring technical expertise, but executives must also consider how those decisions affect revenue, employees, customers, and recovery.

Your Customers Will Remember What You Tell Them

Imagine calling an important customer and explaining that you cannot fulfill a commitment. Then imagine being asked, “Is our information affected?”

You may not have that answer yet.

Communicate what you know, acknowledge what you are still investigating, explain what you are doing, and establish when you will provide the next update. Coordinate with your response team and counsel so your statements reflect verified facts.

An unsupported assurance can damage credibility when new information emerges. Conflicting messages can create confusion that lasts beyond the incident itself.

Assign responsibility for customer and employee communications in advance. Give that person a clear path to the facts and a way to secure prompt approval for updates.

Recovery Needs a Business Order of Priority

Ask your team which operations must return first.

Can you take orders without your usual systems? Will you still be able to deliver your service? How would you reach employees if company email is unavailable? Which outside providers could interrupt your ability to operate?

Backups matter, but executives also need to know whether their teams can restore the business within an acceptable time.

When did your team last test recovery? What worked? What failed? Who owns the remaining gaps?

A recovery plan becomes useful when the people responsible for executing it have practiced together.

Put Your Leadership Team In the Scenario

You do not need technical expertise to participate in a cyber exercise. You need to understand your business and the decisions you are responsible for making.

At your next executive meeting, set aside 30 minutes for this scenario:

Your critical systems are unavailable. The cause is under investigation. A major customer is calling. Your employees need instructions.

Ask who takes charge, who can authorize operational changes, how you will communicate, and what you must restore first.

Pay attention to where the answers differ. Those disagreements show you where preparation is needed.

At CISO Global, we help organizations prepare for, detect, and respond to cyber threats. Executives need to participate in that preparation long before an incident occurs.

For Cybersecurity Awareness Month, make one commitment: rehearse the decisions your business cannot afford to improvise.

If your executive team faced this scenario tomorrow, which decision would create the most disagreement?