Assume normal communications may be unsafe
Ransomware can disable more than files and applications. If attackers control email, identity, or collaboration accounts, the organization’s usual channels may be unavailable, monitored, or used to spread false instructions. A continuity plan should provide a separate way to coordinate decisions before that happens.
CISA’s StopRansomware guidance emphasizes incident planning, preservation of evidence, coordination with law enforcement, and prioritized recovery. FEMA and CISA planning guidance likewise treats communications as a core continuity dependency.
Define who activates the alternate channel
Name a primary incident leader and backup who can authorize out-of-band communications. Define the triggers: widespread account lockout, suspected email compromise, confirmed ransomware, loss of identity services, or direction from the incident-response team. Staff should not improvise a new group chat during the crisis without verification.
Maintain a printed and protected contact roster for leadership, technical responders, cyber-insurance contacts, legal counsel, critical vendors, banking partners, and appropriate law enforcement. Review it after personnel or vendor changes.
Choose channels independent of the affected environment
The alternate method should not rely on the same identity provider, devices, or network as daily operations. Options may include a separately administered emergency notification service, predefined telephone bridge, clean mobile devices, or an approved external collaboration tenant. Protect these channels with strong authentication and restrict membership.
Do not place sensitive forensic details, credentials, patient information, or legal advice into an informal messaging channel. Decide in advance what information may be shared and where privileged or regulated communications belong.
Verify identity and instructions
Attackers may impersonate executives or vendors during confusion. Use a call-back number from the protected roster, a verbal authentication phrase, or another prearranged verification method before accepting payment changes, recovery credentials, public statements, or destructive technical instructions. Rotate verification material after an incident or personnel change.
Separate audiences
Create communication tracks for the incident team, employees, customers, vendors, and public inquiries. Each needs a named approver and update cadence. Employees should know which systems to stop using and where to report observations. Customers need accurate service-impact information without speculation. Only authorized people should speak publicly.
Exercise the plan
Twice a year, simulate the loss of email and Microsoft 365 or Google Workspace. Contact the response team using the alternate method, verify identities, deliver a sample staff notice, and record how long it takes to reach essential decision-makers. Include a hurricane-season exercise because a regional outage may remove power, cellular service, or access to the office at the same time.
Evidence checklist
1. Named activation authority and backup.
2. Protected offline contact roster.
3. Independently administered alternate channel.
4. Identity-verification procedure.
5. Separate templates for staff, customers, vendors, and public updates.
6. Rules for confidential, regulated, and privileged information.
7. Documented exercises and corrective actions.
8. A process for retiring the emergency channel after recovery.
A recovery plan cannot work if responders cannot trust one another’s instructions. Out-of-band communications give leadership a controlled coordination path while the normal environment is being contained and rebuilt.