Give each public incident message four roles: a drafter, a fact checker from the investigation, a reviewer with legal or compliance authority, and a publisher. One incident communications lead owns the flow. Agree the roles and a fast path in advance, with delegates for each, because approvals decided during the incident are slow.
The roles
Incident communications lead. Owns what gets said, to whom and when. Keeps one timeline of every message. The FTC guide for breach response advises naming a single point person to release information and keep details current, which is the same idea.
Drafter. Writes plain text from the template. This can be anyone trained, often support or marketing.
Fact checker. A responder from the investigation who confirms each factual claim against notes. Nothing is published that this person has not read.
Reviewer. Legal counsel or a compliance owner. Their job is to catch regulatory timing, wording that creates liability and statements that contradict filings.
Publisher. Has access to the status page, website and mail tool, and posts only approved text.
A fast path and a full path
Define two paths in writing.
- Fast path for pre-approved templates and availability facts: the fact checker and the communications lead approve. Target minutes.
- Full path for anything new, such as scope, cause or customer instructions: add the reviewer, and for serious cases an executive.
Keep decisions out of chat noise
Run communications in its own channel or thread with only the roles above. Responders in the technical thread should not post externally, and the communications thread should not carry raw investigation chatter.
Name delegates
Each role gets a named backup and a phone number. Note who has authority when the executive sponsor is unreachable.
Keep an audit trail
Record the message text, who approved it, time and where it was published. Later reviews, regulators and customers may ask. It also supports the blameless review described in how to run a post-incident review meeting without blame.
Sources
Quick check
Can engineers post to the status page alone?
For template based availability updates yes, with a second reader for anything about security.
Is legal always needed?
For the fast path no. For scope, cause and notices, yes.
Last reviewed: 19 October 2026.
