SOP-004 · User Notification During a Security Incident

1. Purpose & Scope

Purpose: Define the process for providing timely and accurate communication to affected users and stakeholders during a security incident, including what to communicate, who to notify, and how to handle follow-up responses.
Scope: Applies to all security incidents where users need to be informed of impact, required actions, or organisational advisories. This includes single-user notifications, department-wide alerts, and organisation-wide advisories.

Affected User: A user whose account, device, or data has been directly impacted by the incident.
Advisory: A broader communication issued to warn users about an active threat (e.g. phishing campaign) even if they are not yet confirmed as impacted.
Communication Scope: The reach of the notification — single user, multiple users, department, or organisation-wide.

Incident Commander: Approves communication scope and content before distribution.
Communications Lead: Drafts notification content, coordinates distribution, and monitors responses.
Management / Leadership: Notified when executives are targeted or when the incident requires organisation-wide communication.

Incident summary and current status
Confirmed list of impacted users
Containment actions completed (or in progress)
Required user actions identified
Approved communication templates
Access to email platform, internal messaging platform, and incident management platform

Determine Communication Scope
- Single user
- Multiple users
- Department-wide
- Organisation-wide
Prepare Notification Content
- Include:
  - What happened
  - What actions were taken by the security team
  - What the user needs to do
  - What to avoid
  - How to report further suspicious activity
- Avoid:
  - Excessive technical detail
  - Unverified assumptions
  - Sensitive investigation details
  - Blame-focused language
Obtain Approval
- Have the Incident Commander and Communication Lead review and approve the notification content before sending.
Notify Affected Users
- Send communication to:
  - Directly impacted users
  - Managers (if required)
  - Leadership (if required, e.g. executives targeted)
Provide Required User Actions
- Clearly list what each user must do, e.g.:
  - Reset password
  - Re-register MFA
  - Reboot device
  - Report suspicious follow-on emails
Publish Broader Advisory (if required)
- Recommended if the campaign is widespread
Monitor User Responses
- Track:
  - Additional user reports
  - Questions or concerns raised
  - Newly identified impacted users
- Feed any new reports back to the investigation team to expand scope if needed.

All user notifications must be logged in the incident ticket, including content sent, recipients, and timestamp.
Broader advisories must be retained as part of the incident record.
Communication approval by the Incident Commander and Communication Lead must be documented.

Internal Communication:
- Use the organisation's primary communication platform (e.g. Slack, Teams) to coordinate notification creation and approval before distribution.

Escalation Criteria:

Condition	Action
Large-scale campaign confirmed	Issue organisation-wide advisory
Executives or VIPs targeted	Notify leadership directly
Additional user reports received after notification	Expand incident scope and update investigation team

Review Cycle: This SOP should be reviewed annually, or following any incident where user communication was delayed, inaccurate, or caused confusion.
Feedback Process: Feedback is collected during the Post-Incident Review. The Communications Lead is asked to comment on whether notifications were timely, clear, and effective.

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.