During a ransomware incident, rumours are spreading among staff that payroll data was stolen and that the company will close, and some employees are posting speculation online. What should the security manager recommend FIRST?
Select an answer to reveal the explanation.
Short Explanation
Rumours grow fastest in silence. If you don't tell your people what's going on, they'll fill in the blanks themselves, usually with the scariest version. A short, honest update beats a long silence every time.
Full Explanation
Employees are a key audience during an incident. Without information they speculate, share rumours externally and may make mistakes, such as using affected systems or responding to fraudulent messages that exploit the incident. Timely internal communication, approved through the incident communication plan, tells staff what is known, what is being done, what they should and should not do, where to direct external inquiries and when to expect further updates. That reduces rumour, supports operational continuity and reinforces the media policy. Saying nothing until the investigation is complete leaves a long information vacuum that rumours fill, which is the situation already occurring. Monitoring personal social media and disciplining employees addresses a symptom rather than the cause, raises privacy and employment law concerns and damages trust at a sensitive time. Sending staff the full technical investigation report discloses sensitive details that could aid attackers, may compromise legal privilege and overwhelms people with information they do not need. Exam caveat: internal messages can leak, so they should be written assuming external visibility and reviewed by communications and legal staff. Operational check: confirm a schedule of internal updates, a single source of truth such as an intranet page and a reminder of the media policy.