In an emergency, communication is one of the most powerful tools at your disposal. Effective and clear communication is imperative with both the BC/DR stakeholders and the institution as a whole. If you think you're over-communicating, you're not—more is always better.

Regular updates on a situation can help alleviate concerns across the community. Even if an update simply says, "There are no updates; we are still addressing the situation," those impacted can be reassured knowing it's being worked on.

For the community at large, updates every 12 or 24 hours are recommended. These updates should include the state of the situation and how users can get support. For leadership and key stakeholders, updates should be communicated every 4 to 6 hours. For those working to address the situation, updates should be made as often as needed.

Communication during an emergency should also flow both ways: staff should have a channel to communicate to the incident management team what members of the staff need in order to focus on recovery. In your BC/DR planning, specific procedures for communication should be developed. When possible, write templates that can be quickly customized with information each team needs. These templates should include an initial notification, updates, resources, resolution, and an after-action communication.

Communication types and styles will vary during an emergency depending on stakeholder involvement. Consider the following:

• Develop a responsibility matrix that includes all levels of the organization.
• Create a directory of team members with multiple contacts for each person.
• Make documentation readily available in more than one format.
• Keep documents updated throughout the emergency.
• Decide on a communication method (email, Slack, Teams, etc.) that everyone will use to streamline messages.

• Consult with leadership to determine how they should be communicated with.
• Identify a point person to communicate with leadership.
• Define a regular schedule for communications.

• Identify who will issue communications to the community, how communications will be sent, and how teams can provide updates to be included in communication.
• Define a schedule for how often communications should take place.
• Regularly assess whether the communication plan is effective.

• Compile a list of all services and all vendors impacted or involved in the incident (hardware, software, maintenance, value added reseller), with multiple contact methods for each.
• Document an escalation path for each vendor.
• Develop a quick-reference resource with contract response requirements for each vendor (i.e., each vendor's service-level agreement). Make the full contract available as needed.

Most of this information will be private, and people will have varying sensitivities about disclosing their contact information. Be sensitive to those concerns and only disclose contact information to those who need it.