What it means
Attacker communications governance defines who may communicate with an adversary, under what authority, through which channels, and with what legal, safety, and evidence controls.
Why it matters
Uncoordinated contact can expose strategy, create legal risk, damage evidence, or conflict with law-enforcement and recovery decisions.
Practical focus
- Require explicit leadership and legal authorization
- Use designated personnel and controlled channels
- Preserve communications as evidence
- Coordinate with insurers, law enforcement, and specialists where appropriate
Common mistakes
- Allowing individual responders to engage directly
- Making commitments without authority
- Revealing defensive actions or sensitive facts
- Treating communication as separate from incident strategy
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: