The Life Cycle Approach to Effective Crisis Communications in Mitigating Cyber Threats and Attacks

Abstract

Cyberattacks pose multifaceted risks, including physical, digital, economic, reputational and societal harm. Often starting as an attack on an organization’s intangible assets but quickly spreading to endanger tangible assets, cyberattacks are increasingly common globally. Once an attack becomes public, the targeted organizations faceintense scrutiny from employees, customers, the media, the wider public and the authorities. At this point, effective crisis communication becomes critical for mitigating damage and recovering from the crisis. Decision-making andcommunication during cyber incidents are complicated by uncertainty, operational issues, incomplete information, and even the potential for attackers to shape narratives through extortion or leaks. This paper examines communication challenges in cyber crises through the lens of framing theory and situational crisis communication theory (SCCT). Based on data analysed from interviews with key experts of eight organizations during recent Finnish cyberattacks, the paper identifies key factors that constitute effective cyber crisis communication. These include (1) organizational preparedness, (2) efficient information sharing and coordination, (3) a deep understanding of target audiences and the information environment, and (4) the essential role of communication in leadership. The findings highlight the importance of proactive, transparent and coordinated communication to maintain trust and boost organizational resilience. Practical recommendations in the form of three “no-L-principles” are provided: 1. Do not lessen, 2. Do not lie, and 3. Do not linger. Practical recommendations are provided to enhance crisis communications preparedness, improve real-time crisis communication, reduce risks, and strengthen organizational capacity to manage cyber crises.