The organization should plan on-site communications for warning of imminent threat, emergency actions and departures from the plan, and off-site communications with agencies, policymakers, media and families. It should decide in advance what will and will not be shared and when, with a central decision point such as the emergency operations center to limit misinformation, and coordinate responses internally and with the public information officer, public relations or crisis communications staff, legal counsel, police and relevant agencies. It should set an approval chain (release authority) and choose a senior leader who knows the facts as spokesperson for briefings and written statements. Communications should be factual, timely, compassionate and respectful of victims' and families' privacy, supported by key messages, an updatable chronology or fact sheet, possibly a question-and-answer document (which may be posted online), with all public materials reviewed periodically. The first media statement should anticipate public concerns using facts confirmed and cleared by police and cover: that affected people are the top priority; what is known; that the organization is cooperating with police; what it has done and will do next; and a contact point. Media updates should follow a published timetable, balancing public interest against safety, security and privacy, possibly with credential checks, security support for disruption, and a clear timeframe, topics, prepared statement and questions. Mainstream and social media should be monitored to correct significant errors, with counsel helping remove offensive, violent or confidential content if needed. Other audiences, such as off-site staff, customers, vendors, local officials and community partners, should be kept informed about the incident, continuity and support for victims and families, with named leaders given talking points and draft messages for each audience.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.