Which groups are stakeholders requiring tailored communication during incident response?

• A. Developers
• B. Regulators
• C. Attackers
• D. CISO, legal, PR, CEO, IT, customers

Answer: (D)

During incident response, you tailor communications to the groups that must make decisions, coordinate actions, or are directly impacted. The best-fit set includes the CISO, legal, PR, CEO, IT, and customers. Each role has specific needs: the CISO and IT teams need technical details, containment steps, and timelines; legal requires guidance on evidence handling, regulatory obligations, and potential disclosures; PR handles approved messaging, media strategy, and reputation management; the CEO needs high-level impact and risk information to guide executive decision-making; customers require clear, timely updates about service impact and remediation plans. This focused approach ensures information is accurate, appropriate, and actionable for those involved. Developers are typically more involved in remediation work rather than stakeholder communications, and regulators may be involved in disclosures but are not the core audience for ongoing incident-response communications. Attackers are not legitimate stakeholders to communicate with.