Chapter 9 — Communication, ethics and reporting
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes and connection"]
N1["9.1 Who must be told, and when"]
N2["9.2 Critical customers"]
N3["9.3 Public communication"]
N4["9.4 Ethics"]
N5["9.6 Reporting to executives and boards"]
N6["9.7 Practical activity"]
N7["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["9.1 Who must be told, and when"]
N2["9.2 Critical customers"]
N3["9.3 Public communication"]
N4["9.4 Ethics"]
N5["9.6 Reporting to executives and boards"]
N6["9.7 Practical activity"]
N7["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]
[Learning outcomes and connection]
|
v
[9.1 Who must be told, and when]
|
v
[9.2 Critical customers]
|
v
[9.3 Public communication]
|
v
[9.4 Ethics]
|
v
[9.6 Reporting to executives and boards]
|
v
[9.7 Practical activity]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes and connection
After this chapter you should be able to:
- identify every notification duty an incident can trigger — legal, regulatory, contractual, insurance — and run their clocks;
- write a holding statement and a critical-customer briefing that are accurate, useful and honest about uncertainty;
- apply ethical principles to communication: truthfulness, proportionality, fairness to individuals, and correction of errors;
- report incidents and programme status to executives and boards in a form that supports decisions.
Chapters 1–8 built and exercised the programme internally. This chapter faces outward.
9.1 Who must be told, and when
An incident at an essential service can start several clocks at once. Under NIS2, for example, entities must send the national CSIRT or competent authority an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month after the notification (Directive (EU) 2022/2555, Article 23). Other jurisdictions, sectors and contracts set different triggers and periods; personal-data breaches may carry separate duties; insurers usually require prompt notice. A coordinator prepares in advance a notification register: each duty, its trigger, recipient, deadline, content, owner and channel.
Two details decide whether you meet a clock: what starts it (detection, awareness, determination that the incident is "significant") and who records that moment. Agree both before incidents, and record the start time in UTC in the decision log.
9.2 Critical customers
Hospitals, care homes, dialysis patients, other utilities and emergency services may need to act before the public does. Their needs are practical: what is affected, what they should do, for how long, when the next update comes, and whom to call. Agreements with them (Chapter 2) often promise a call within a short period. Keep their contacts tested and keep the message free of technical detail.
Kestrel General Hospital's agreement promises a call within two hours of any event likely to affect supply or quality; its estates on-call, and out of hours the site duty manager, are the contacts.
9.3 Public communication
A holding statement is a short, factual message issued early, before the full picture is known. It says what is known, what the organization is doing, what (if anything) the public should do, and when more information will come. It does not speculate on cause or attribution, does not minimise ("no impact") without evidence, and does not reveal details useful to an attacker. The communications lead drafts; the accountable executive approves (Chapter 6); operations confirms any safety statement ("the water is safe to drink") is true.
9.4 Ethics
Communication about essential services carries public-safety weight. Four principles:
- Truthfulness — never state as fact what is assumed; never deny what you know.
- Proportionality — enough detail for people to protect themselves, no more; avoid causing unnecessary alarm and avoid helping attackers.
- Fairness to individuals — do not name or blame an employee or supplier publicly on incomplete information; human error is usually a system problem.
- Correction — when a statement turns out to be wrong, correct it promptly and visibly.
Internally, a blameless culture of reporting — people report mistakes and near misses without fear — gives the coordinator the early signals that external reporting depends on.
9.5 Worked example: the Saturday clocks (synthetic)
On Saturday 13 June 2026, at 21:40 UTC, the incident lead determines that unauthorised access to the supervisory network is a significant incident. Kestrel Vale's fictional rules mirror NIS2's 24 h / 72 h / one-month pattern; the hospital's agreement requires a call within 2 hours; the insurance policy requires notice within 48 hours. On Tuesday evening, the coordinator checks the register with Lab 9.
Lab 9 (save as lab09.py, run with python3 lab09.py):
# Lab 9 - notification clocks after an incident (offline, standard library only; synthetic obligations)
# The deadlines are ILLUSTRATIVE for the fictional Kestrel Vale jurisdiction; real duties come from your own
# law, regulator and contracts. The 24 h / 72 h / one-month pattern mirrors EU NIS2 Article 23.
from datetime import datetime, timedelta, timezone
UTC = timezone.utc
aware = datetime(2026, 6, 13, 21, 40, tzinfo=UTC) # incident judged significant (Saturday evening)
OBLIGATIONS = [ # name, hours after awareness, recipient
("Critical-customer call (contract)", 2, "Kestrel General Hospital"),
("Regulator early warning", 24, "Kestrel Vale CSIRT"),
("Insurer notice (policy)", 48, "insurer"),
("Regulator incident notification", 72, "Kestrel Vale CSIRT"),
("Regulator final report", 24*30, "Kestrel Vale CSIRT"), # 'one month' modelled as 30 days
]
SENT = {"Critical-customer call (contract)": datetime(2026, 6, 13, 23, 55, tzinfo=UTC),
"Regulator early warning": datetime(2026, 6, 14, 18, 5, tzinfo=UTC),
"Regulator incident notification": datetime(2026, 6, 16, 22, 30, tzinfo=UTC)}
NOW = datetime(2026, 6, 16, 23, 0, tzinfo=UTC)
for name, h, who in OBLIGATIONS:
due = aware + timedelta(hours=h)
sent = SENT.get(name)
if sent:
delta = (sent - due).total_seconds() / 3600
state = f"sent {sent:%a %d %H:%M}Z, {'LATE by' if delta > 0 else 'early by'} {abs(delta):.2f} h"
else:
state = "OVERDUE - not sent" if NOW > due else f"open, {(due - NOW).total_seconds()/3600:.1f} h left"
print(f"{name:35s} due {due:%a %d %b %H:%M}Z {state}")
Expected output (Python 3.13.5):
Critical-customer call (contract) due Sat 13 Jun 23:40Z sent Sat 13 23:55Z, LATE by 0.25 h
Regulator early warning due Sun 14 Jun 21:40Z sent Sun 14 18:05Z, early by 3.58 h
Insurer notice (policy) due Mon 15 Jun 21:40Z OVERDUE - not sent
Regulator incident notification due Tue 16 Jun 21:40Z sent Tue 16 22:30Z, LATE by 0.83 h
Regulator final report due Mon 13 Jul 21:40Z open, 646.7 h left
Three problems emerge. The hospital call was 15 minutes late: the coordinator was on the call with the regulator's duty officer and the comms lead believed she would phone the hospital — the two-responsible defect from Chapter 6 in real life. The insurer was never notified: nobody had the policy in the notification register. The regulator's 72-hour notification was 50 minutes late because the chief executive's approval was sought at 21:00 for a 21:40 deadline. The early warning, prepared from a template, went in early.
The coordinator records these facts in the decision log without blame, notifies the insurer immediately with an explanation, and adds two actions for the review: put the insurance duty in the register with an owner, and set internal deadlines for approvals (for example "approval requested no later than 6 hours before the external deadline"). The lab computes clocks; it does not decide what counts as "aware" — that remains a documented judgement.
9.6 Reporting to executives and boards
A short incident report for executives covers: what happened (facts, labelled confidence); impact on service and people; what has been done and decided; duties met and missed; risks now; decisions needed. Programme reports (monthly or quarterly) use the decision-driving metrics of Chapter 5 and the top consequence-ranked risks of Chapter 4.
For the Saturday incident, the executive report would show that the hospital call was fifteen minutes late, the insurer was not told and the 72-hour notification was late, with the causes found rather than names. It would end with the two actions for the register and the approval deadlines, and ask the executive to confirm both. Keep it to one page and attach the clock calculations, so that a reader can check each time without trusting the summary.
9.7 Practical activity
Draft a notification register for an organization you know with at least five duties. For each, write what starts the clock and who records it. Mark any duty whose source you have not verified.
Include contracts and insurance as well as law, since the Saturday incident showed that an insurer's notice period can be missed simply because nobody listed it. For each duty, name an owner, set an internal deadline for approval ahead of the external one, and record the source document with its clause. Check whether two duties are started by the same moment; if so, agree who records that moment and in which time zone. Review the register whenever a contract or policy is renewed.
9.8 Common errors and limits
- Notification duties discovered during the incident.
- No internal deadline for approvals, so the external deadline is missed.
- Holding statements that promise "no impact" before evidence exists.
- Naming individuals or suppliers prematurely.
-
Real legal duties vary; confirm yours with legal counsel and your regulator. This book's clocks are illustrative.
-
Leaving one call, such as the hospital briefing, to two people who each assume the other will make it.
- Starting each clock from a different moment because nobody agreed what counts as aware.
- Forgetting contractual and insurance duties because the register lists only regulators.
Exercises — chapter 9
EX041 — Read Lab 9. Objective: interpret notification clocks. Inputs: Lab 9 output. Steps: for each obligation, state the status and the root cause of any miss using 9.5. Expected evidence: five rows. Rubric: 3 = hospital late 0.25 h (unclear responsibility), early warning met, insurer overdue (not in register), notification late 0.83 h (late approval), final report open with 646.7 h; root causes are process, not people; 2 = statuses only; 1 = partial; 0 = none.
EX042 — Write a holding statement. Objective: communicate early and honestly. Inputs: the utility is investigating unauthorised access to systems that monitor water treatment; operations staff are running two stations manually; water quality tests are normal. Steps: write a statement under 120 words. Expected evidence: statement. Rubric: 3 = facts only, what is being done, what customers should do (nothing unless advised; how updates will come), next update time, no speculation or attacker-useful detail, safety statement only as confirmed by operations; 2 = minor speculation; 1 = "no impact, all fine"; 0 = none.
EX043 — Brief the hospital. Objective: critical-customer communication. Inputs: same incident; east zone pressure may drop for up to 4 hours tomorrow during a controlled switchover. Steps: write the call script. Expected evidence: script. Rubric: 3 = effect in hospital terms, timing, safety of water, what the hospital may need to do (stored water, priorities), next update, 24 h contact; asks what the hospital needs; 2 = no question to the hospital; 1 = technical detail; 0 = none.
EX044 — Ethical dilemma. Objective: apply principles. Inputs: a journalist asks whether a supplier's engineer caused the incident; internal evidence suggests the supplier's stolen laptop was involved, unconfirmed. Steps: write the answer and justify. Expected evidence: answer and reasoning. Rubric: 3 = declines to attribute or name on unconfirmed information, explains investigation ongoing, commits to update, reasoning cites truthfulness and fairness; 2 = correct answer without reasoning; 1 = names supplier; 0 = none.
EX045 — Fix the approval process. Objective: prevent late notifications. Inputs: 9.5. Steps: design internal deadlines and delegation for the three external clocks. Expected evidence: design. Rubric: 3 = internal deadlines before each external one, named deputy approvers when the chief executive is unavailable, templates prepared, clock start recorded in UTC by the incident lead, insurer added to register; 2 = deadlines only; 1 = "be faster"; 0 = none.
Chapter synthesis
Incidents start several clocks at once; know them in advance, agree what starts each and who records it, and set internal approval deadlines ahead of external ones. Critical customers need practical messages early; the public needs truthful, proportionate holding statements. Communicate without blame or speculation, correct errors visibly, and report to executives with facts, impact, decisions and duties.
Continue studying — chapter 09 of 12
← Chapter 08 · Course chapter index · Chapter 10 →
Continue to the next authored lesson.