Incident response communication: legal, HR, public relations, regulators, law enforcement, customers

During a serious incident, what the organization says, to whom and when can matter as much as the technical response. Poorly handled communication can create legal liability, alert the attacker, damage reputation or breach notification laws. The IR plan should define who communicates with each group, and most external communication should go through designated people, not individual analysts. CySA+ expects you to know the role of each party: legal, HR, public relations, regulators, law enforcement and customers.