The CISA and Federal Bureau of Investigation (FBI) joint guidance outlines best practices for communicating during IT and operational technology (OT) outages caused by cyber incidents, human error, equipment failures, or natural hazards. It emphasizes clear, timely, accurate, and transparent communication to reduce uncertainty, limit speculation, maintain public trust, and coordinate messaging with legal, security, law enforcement, and incident-response needs.
CISA’s CI Fortify initiative complements this guidance by helping critical infrastructure organizations prepare to isolate and recover essential OT systems during major incidents. Organizations should maintain crisis communication plans that include backup communication methods, since telecommunications may be disrupted, and establish expectations for how service providers will communicate during outages or deliberate service isolation.