During a publicized incident, several employees have given conflicting statements to journalists, and the press is reporting contradictory details. What should the security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
When too many people talk, the story comes out as a game of telephone. You want one voice that says the same thing every time. Going totally silent isn't the answer either; it lets someone else write your story.
Full Explanation
Consistent, accurate external communication protects the organization's credibility and reduces legal and reputational risk. Incident communication plans therefore designate an authorized spokesperson, supported by communications and legal staff, and require all media inquiries to be routed to that person. Employees are reminded not to comment and are told where to direct questions. This ensures that statements are verified, consistent and approved before release. Allowing each department head to brief journalists multiplies the number of voices, which is the cause of the contradictory reporting, and increases the chance of disclosing unverified or sensitive information. Having the incident response team post technical updates on social media diverts responders from their work and risks releasing details that aid attackers or conflict with legal advice. Declining every inquiry until the work is finished leaves a vacuum that speculation will fill, and it may conflict with expectations of timely transparency toward customers and the public. Exam caveat: the spokesperson is usually from corporate communications or senior management, not the security manager, who supplies facts and reviews technical accuracy. Operational check: confirm the plan names the spokesperson and alternate, staff have been reminded of the media policy and statements are approved before release.