Ransomware hits the servers on a Friday afternoon, the phone rings, customers want answers, and the IT team is busy trying to figure out what happend. Who talks to the press? What do you tell clients? And how much time do you actually have before you need to notify the regulator?
Most Swiss SMEs have some kind of technical incident response plan, but almost none have a plan for the communication side of things: what to say, when to say it, and who is responsible for saying it. CISA (the US Cybersecurity and Infrastructure Security Agency), together with the FBI and international partners, published a guide in September 2026 that addresses exactly this gap: “Communicating Under Pressure: Best Practices for Service Providers”. It is written for large service providers, but the principles apply just as well to a 20 person company in Zurich.
Three principles
CISAs framework boils down to three words: clarity, accountability, transparency. That sounds obvious at first, but it really is not when your infrastructure is down and everyone around you is panicking. The most common mistake during cyber incidents falls into one of two extremes: complete silence while waiting for “confirmed information”, or premature statements that have to be walked back later. Both destroy trust, and once trust is gone it is very hard to rebuild.
We saw this play out during the Xplain hack in Switzerland in 2023. For weeks there was little to no communication from the affected federal agencies, the media pieced together the story on their own, and the resulting communication disaster arguably did more damage than the actual data theft..
What CISA recommends
The guide is surprisingly practical and goes well beyond the usual platitudes. Key points:
Before an incident (meaning now):
- Build a cross-functional team that handles communication during a crisis, and make sure it includes not just IT people but also someone for customer relations, someone who knows the legal requirements (revDSG breach notification!), and a designated spokesperson
- Set up backup communication channels because if email servers are down you need alternatives: SMS lists, phone trees, maybe even a WhatsApp broadcast
- Create templates for different scenarios like ransomware, data breach or system outage, and even though this sounds like overkill for a small company, even a one page document helps enormously when stress levels are through the roof
During the incident:
- Only communicate confirmed facts and avoid speculation entirely
- State clearly what you know, what you do not know, and what is still under investigation
- Give regular time-stamped updates even if there is nothing new (especially then, because it shows you are on top of things)
- Tailor information to different audiences because customers need different information than regulators or journalists
- For cyber attacks, coordinate with law enforcement and do not publish technical details that could help the attacker
That last point gets forgotten surprisingly often. If you publicly announce “we found and patched the vulnerability in our VPN”, the attacker knows they need to find another way in (or that their backdoor has not been discovered yet).
The Swiss context
Since September 2023 the revised Swiss Data Protection Act (revDSG) requires organizations to notify the FDPIC within 72 hours of discovering a data security breach that poses high risk to affected persons. 72 hours sounds like plenty of time but it really is not, especially when the ransomware hits on Friday afternoon and the deadline expires on Monday morning.
On top of that, since April 2025 operators of critical infrastructure must report to the NCSC within 24 hours. Without a communication plan organizations waste the first critical hours debating “what are we allowed to say” instead of focusing on containment and recovery. CISA specifically recommends parallel workstreams for this reason: one team handles the technical response, another handles communications, and a third manages leadership briefings and regulatory notifications. Even with five people you can split these roles in a way that makes sense.
What not to do
CISA explicitly warns against three things:
First: vague language and PR spin. “We take this incident very seriously” says exactly nothing and people can tell. Something like “On Tuesday at 2:30 PM we detected unauthorized access to our customer database, approximately 3000 customer records are affected, and passwords were stored in encrypted form” is far more useful.
Second: premature conclusions about root cause. While the investigation is ongoing say “we are investigating the cause” and not “a state-sponsored actor attacked us”, unless you actually know that for certain.
Third: inconsistent messaging across channels. If the internal email to employees says something different than the press release, someone will notice, and once that comes out you have a credibility problem on top of everything else.
Bottom line
The CISA guide is free and available in English. Even though it is written for service providers the principles work for any organization, and honestly most SMEs do not need a 50 page crisis plan anyway. One sheet of paper with the key phone numbers, a clear assignment of who handles communication, and two or three templates for the first customer notification already gets you quite far.
The question is whether you take the time to prepare all of this before something actually happens…