During an active security incident at a SaaS company, journalists and investors begin calling engineers on the response team directly and asking what happened, how many customers are affected and whether data was stolen. What should the incident manager do?

Managing communication with relevant parties during an incident depends on a pre-approved communication plan that designates authorized spokespeople, identifies audiences such as customers, partners, regulators, media and investors, and sets what may be released and when. Routing every inquiry through that channel keeps statements consistent, legally reviewed and limited to information each audience needs, which protects the investigation and avoids admissions that later prove inaccurate. Letting responders answer directly creates inconsistent messages, distracts the people containing the incident and risks disclosing details that help the attacker or create liability. Publishing the full technical timeline and indicators while the incident is active can tip off the adversary and expose unconfirmed facts; detailed technical sharing goes to trusted parties under agreed rules, not to a public page. Refusing all communication fails mandatory duties: regulators and affected customers may be owed timely notice under law or contract, and silence erodes trust. Exam caveat: the plan should be written and tested before an incident, with legal and public relations input. Operational check: verify the plan lists named spokespeople and alternates, contact paths for each stakeholder group, approval steps for statements and an instruction telling staff to redirect external questions.