CISO and Crisis Communication

Key Details

Cybersecurity Communication activities are essential in crisis situations and as regular communication of the CISO to stakeholders. Crisis communication is required for three specific focuses that are: Communicate to resolve the incident and the crisis; Communicate as a compliance notification required by law and regulators; and finally communicate to improve the reputation as a follow-up on an incident/crisis. Mastering communication activities is a must skill for cybersecurity leaders.

Time commitment

125 hours in total

• Readings: 12 hours before the module + 12 hours during delivery (24 hours)
• Lectures: 12 sessions × 2 hours each (24 hours)
• Case studies and workshops / Lab work: 6 hours × 12 weeks (72 hours)
• Project-specific self-study: 3 hours
• Module exam: Multiple-choice, proctored: 2 hours

Assessment

Three written assignments after sessions 5, 7, and 9 related to the development of relevant communication plans (40%). One final proctored exam (60%).

Subjects covered

1. The purpose of the communication activities in terms of Audience and business results. The impact of communication on the protection, detection, response and recovery activities related to cybersecurity.

2. Communication elements including the objective, the expected impact, the target audience, the communication channel, and the timing. How to build a communication plan.

3. Building a dashboard as a baseline for communication to key stakeholders. Contents of a dashboard and alignment with the four Dimensions of the Balanced Scorecard model.

4. The crisis communication – Part 1: Principles of Incident/Crisis management

5. The crisis communication – Part 1: Communicate to resolve the incident/Crisis

6. The crisis communication – Part 2: Cybersecurity related regulations and their notification requirements (NIS2, DORA, GDPR, etc.)

7. The crisis communication – Part 2: Conduct regulatory communication requirements

8. The crisis communication – Part 3: Business needs for preserving reputation. Build reputation requirements in line with business objectives.

9. The crisis communication – Part 3: Validate cybersecurity and communication activities in line with not-accepted reputational risks. Develop actions along with management and business leaders.

10. Awareness program objectives, audience and

11. Cybersecurity awareness tools: Phishing and user reflexes exercises, alignment with key threats and vulnerabilities; awareness as a full protection mechanism.

12. Putting it all together: case studies on major communication actions and campaigns before and after an incident.

Learning objectives

Learning outcomes that students should attain in the module: A. Knowledge: Familiarity with the major communication requirements in cybersecurity, including:

1. Regular leadership communication activities with various stakeholders, including senior management, users, and regulators.

2. Crisis communication serving three purposes: containing the incident or crisis, meeting regulatory notification requirements, and preserving organisational reputation.

3. Regular awareness activities as an essential control for improving the preparedness of the human factor. B. Skills: Possess the skills necessary to plan, develop, and conduct effective communication actions. C. Competences: Be able to create a comprehensive communication plan, including the design, timeline, identification of target audiences, definition of communication channels, formulation of messages, evaluation of impact, and recommendations for future improvement.