School: Minister Destiny Testimony Schools Track: Adult Class: Certificate Topics — Year 1 (Foundations) · Home: Advocacy Certificate behind this topic: "Crisis Communication Planning After a Ransomware or Other Cybersecurity Attack" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 28, 2025) Founded and presented by: Muslim Ordained Minister Destiny Marie Morgan
This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. It teaches communication only — not how to investigate or fix a cyber attack. If you are in danger right now, call 911.
Before you start
- This school never asks your name. Your progress is saved only in your own browser on this device — the school collects and keeps nothing. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
- This topic is the communication side of a cyber crisis only: the plan, the roles, the words, and their order. Technical investigation and repair belong to qualified responders and are not taught here.
- Minister Destiny earned this certificate learning to speak honestly for people on their worst days. In Advocacy work, the first statement after a breach is often the difference between a community that trusts you and one that never does again.
The lesson
Part 1. Why Communication Needs Its Own Plan
When ransomware locks an organisation's systems, two emergencies happen at once. The first is technical. The second is human: staff, clients, and neighbours need to know what happened, what it means for them, and what to do next — from you, quickly and truthfully, before rumour fills the silence.
A crisis communication plan is the document written in a calm week that tells you what to do in the frantic one. With it, named people follow named steps: who gathers confirmed facts, who approves words, who speaks, who watches for questions and false reports, and who writes everything down. The plan does not make the crisis smaller. It makes your response faster, calmer, and honest — and honesty delivered early is the main thing the public remembers later.
This plan sits beside the technical response, never in front of it. Communicators do not investigate the attack and never announce technical conclusions — how attackers got in, what was taken, whether it is "contained" — until responders have confirmed them. The communicator's craft is turning confirmed facts into clear words, in the right order, for the right audiences.
Part 2. Inside the Plan — Audiences, Channels, and Pre-Written Pieces
A usable plan has five parts. First, a contact and role sheet: names, backups, and how to reach each person when email may be down — including an out-of-band method such as phone calls or a printed copy kept off the network. Second, an audience list: staff, the people whose information you hold, partners, regulators or funders where relevant, media, and the public — each with what they most need to hear. Third, channels that still work: a status page hosted separately from your main systems, social accounts with securely stored logins, a phone message, and printed notices. If your only route to people is the system that just failed, you do not have a channel — you have a hope.
Fourth, pre-approved templates: holding statements, staff notices, and a notification letter skeleton with blanks for facts, reviewed in advance by leadership and, where possible, legal counsel — scaffolding, so no one has to invent structure under stress. Fifth, a decision log: a running record of what was decided, by whom, at what time, and on what information. Memory fails in a crisis; the log does not.
Write the plan short enough to use, store copies in more than one place, review it yearly, and practise it with a tabletop exercise — a talked-through pretend incident — so the first use is not the real day.
Part 3. Roles — Spokesperson, Approver, and Monitor
Confusion about roles is where crisis communication usually breaks. Three roles are named in advance, each with a backup. The spokesperson is the public voice: one person who gives interviews and appears in statements, chosen for steadiness and clarity, not seniority alone. Everyone else refers questions to them — kindly, consistently, without improvising in hallways or comment threads.
The approver authorises statements to go out: usually a senior leader, advised by legal counsel where facts carry legal duties. The plan sets in advance who approves if they cannot be reached, and which pre-approved holding language may go without waiting. The monitor watches questions, coverage, and social conversation, logs rumours, and feeds the spokesperson what the public is actually asking — which tells you what the next update must answer.
Around these three sit supporting roles: internal briefer, web and phone-message keeper, and the decision log's keeper. In a small organisation one person may hold two roles — but the plan should say so openly and name who relieves them, because a multi-day crisis exhausts anyone working alone.
Part 4. Holding Statements and the First Hours
A holding statement is a short, truthful first message acknowledging what is known, saying what is being done, and promising the next update at a stated time — before full facts exist. Silence is also a message, and in a breach it gets filled by speculation and fear. A sound holding statement covers four things: what you know in plain words, what you do not know yet stated plainly, what you are doing at a general level, and when and where the next update will appear.
What a holding statement must never do is just as important. It never guesses at cause, scale, or who is responsible; never says "no data was taken" before that is confirmed; never promises containment; and never minimises ("just a minor glitch") when systems are visibly down. Each such sentence, if proved wrong, costs more trust than the incident itself. It also never blames victims or discloses details responders or law enforcement have asked be held back.
After the first statement, rhythm matters more than volume. Update at the promised times, even if the update is "no new confirmed facts; next update at 4 p.m." A kept schedule teaches audiences to wait for you instead of hunting rumours. Each update adds only confirmed facts, corrects earlier errors openly, and repeats the practical guidance affected people need.
Part 5. Working Alongside Responders, Law Enforcement, and Notification Duties
Crisis communication runs in sequence with the response, not ahead of it: the communicator sits in response meetings, hears what is confirmed versus suspected, and drafts from the confirmed column only. Responders and law enforcement may legitimately ask that certain details wait while an investigation is active. The communicator then says what can honestly be said ("we are working with law enforcement and cannot share investigation details") rather than inventing a vaguer falsehood.
Many breaches also carry notification duties: laws in many places require notifying affected individuals, and sometimes regulators, when personal information is exposed — details vary by jurisdiction and information type. This unit teaches notification only at that general level: know duties may exist, keep templates ready, get legal advice early, and never let a public-relations timetable overrule a legal one. A proper notification tells the person plainly what happened, what information was involved, what you are doing, what they can do, and how to reach a real human.
Tone decides how notification is received. Speak to affected people as people whose information was in your care: acknowledge the worry, apologise without theatrical language, give concrete protective steps, and do not bury key facts under legal padding. People forgive an organisation that tells them promptly and helps them; they do not forgive learning of their own exposure from the news.
Part 6. Internal Communication and the Days After
Staff hear news too — and if they hear it first from social media, you have told them what they are worth. Brief internal audiences early: what happened at the level staff may repeat, the exact referral sentence for client or reporter questions, and what not to speculate about. Give staff a short internal Q&A and update it as facts firm up.
As systems recover, communication shifts to accountability. The closing phase includes a post-incident report: what happened, what was communicated and when, what the investigation confirmed, what has changed, and what support remains for affected people. Then the lessons learned: an honest review of the communication itself — Was the first statement fast enough? Did a channel fail? — with the plan revised while memory is fresh.
Rebuilding trust is slow work in ordinary weeks: publishing the promised changes, keeping the help route open, reporting progress. The organisations that recover confidence are not the ones that never had a breach — they are the ones whose words during it turned out to have been true.
Words to know — Crisis Communication Planning — After a Ransomware or Cyber Attack
- Holding statement — a first message acknowledging an incident and promising the next update.
- Spokesperson — the named person authorised to speak publicly during the crisis.
- Approver — the named person who authorises statements for release, with a named backup.
- Monitor — the person tracking questions and rumours for the spokesperson.
- Decision log — the running record of decisions: what, by whom, when.
- Tabletop exercise — a talked-through rehearsal of a pretend incident that tests the plan.
- Breach notification — formal notice to affected people that their information was exposed; duties vary by law.
- Out-of-band — a backup method independent of affected systems.
- Post-incident report — the closing account of what happened, what was done, and what changed.
- Ransomware — software that locks systems or data and demands payment; here, the occasion for communication, not a technical subject.
Myths vs facts — Crisis Communication Planning — After a Ransomware or Cyber Attack
- Myth: Say nothing until you know everything. Fact: Silence gets filled by rumour. A holding statement lets you acknowledge the incident truthfully with partial facts and a promised update time.
- Myth: A reassuring guess ("no data was taken") calms people. Fact: An unconfirmed reassurance proved wrong destroys more trust than the incident. Say only what is confirmed.
- Myth: Anyone senior can answer reporters' questions. Fact: Unbriefed improvisation creates contradictions. One named spokesperson, with referrals from everyone else, keeps the record straight.
- Myth: The communication plan is the incident response. Fact: Communication runs alongside the technical and legal response, reporting confirmed facts — it never directs the investigation or announces its conclusions early.
- Myth: Once systems are restored, communication is finished. Fact: The post-incident report, support for affected people, and visible follow-through are what rebuild trust over the following weeks.
Think it through — Crisis Communication Planning — After a Ransomware or Cyber Attack
On a Tuesday morning, a small community services nonprofit finds its files locked and a ransom note on screen. By 9 a.m. the phones are ringing: clients cannot book appointments, a local reporter has heard "the computers were hacked," and a volunteer is about to post her own explanation online. The director asks you: "What do we say, and who says it?"
Walk it through: (1) Open the plan (Part 2): director as approver, you as spokesperson, board member as monitor; the out-of-band list works with email down. (2) Release the holding statement within the first hours (Part 4): systems affected, appointments paused, unknowns stated plainly, next update promised for noon — and no claim about whether client information was taken, because that is unconfirmed. (3) Brief staff and the volunteer (Part 6): one referral sentence, no personal posts. (4) Sequence with the response (Part 5): report only confirmed facts and say openly that investigative details cannot yet be shared. (5) If exposure is later confirmed, notification follows legal advice in plain language, with protective steps and a human contact — and the post-incident report (Part 6) closes the record.
Try this — Crisis Communication Planning — After a Ransomware or Cyber Attack
- ☐ Draft a one-page role sheet: spokesperson, approver, monitor, and a backup for each
- ☐ Write a holding statement with blanks for the facts, covering what is known, what is unknown, what is being done, and the next update time
- ☐ List the channels that would still work if that organisation's email and main website went down
- ☐ Write the one sentence staff use to refer reporter questions to the spokesperson
- ☐ Sketch a notification-letter outline: what happened, what information, what you are doing, what they can do, how to reach a person
Resources to keep — Crisis Communication Planning — After a Ransomware or Cyber Attack
- StopRansomware hub — Cybersecurity and Infrastructure Security Agency (cisa.gov) — the U.S. government's central ransomware page and joint #StopRansomware Guide.
- Data Breach Response: A Guide for Business — Federal Trade Commission (ftc.gov) — free official guide whose communication and notification sections model plain, prompt breach messaging.
- Crisis communication and ethics resources — Public Relations Society of America (prsa.org) — professional guidance and the PRSA Code of Ethics for honest crisis practice.
- Research library — Institute for Public Relations (instituteforpr.org) — free research on crisis communication and trust, for going deeper after this unit.
What you earned / what's next — Crisis Communication Planning — After a Ransomware or Cyber Attack
✅ Crisis Communication Planning — After a Ransomware or Cyber Attack complete (quiz score 80% or higher): You can build the communication side of a cyber-crisis plan — roles, channels, templates, and a decision log — write an honest holding statement, and sequence public, internal, and notification messages alongside responders without ever announcing unconfirmed facts.
Your certificate
Minister Destiny Testimony Schools Certificate of Completion — Crisis Communication Planning — After a Ransomware or Cyber Attack
This certificate is presented by Muslim Ordained Minister Destiny Marie Morgan
Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)
Date completed: ______________
You learned to prepare words for the worst day before it arrives — truthful, prompt, and kind to the people waiting to hear them. That steadiness is a form of advocacy. — Minister Destiny Marie Morgan
This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential.
What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.
Sources
- #StopRansomware Guide and StopRansomware hub — Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security (cisa.gov) — used for the incident setting, response sequencing at general level, and the principle of coordinating with law enforcement.
- Data Breach Response: A Guide for Business — Federal Trade Commission (ftc.gov) — used for breach communication planning and the plain-language model of notification.
- Code of Ethics — Public Relations Society of America (prsa.org) — used for honesty, disclosure, and safeguarding-confidences principles in crisis statements.
- Crisis communication research collection — Institute for Public Relations (instituteforpr.org) — used for evidence on prompt acknowledgement, update rhythm, and trust recovery.
Your Progress — On Your Device Only — Crisis Communication Planning — After a Ransomware or Cyber Attack
- Learning outcomes: On completing this unit, the student can:
- describe the parts of a crisis communication plan for a cyber incident and why each part exists
- assign and explain the spokesperson, approver, and monitor roles, each with a backup
- write a holding statement that states known and unknown facts without guessing or minimising
- sequence communication with the technical response and law enforcement without announcing unconfirmed conclusions
- outline breach notification at general level in plain, respectful language
- plan internal briefing and the post-incident report that closes the record honestly
- Study time: Approximately 2 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
- Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved only in your own browser on this device, and retakes are allowed.
- Level: Certificate Topics — Year 1 (Foundations) · Adult school · working rank on completion path: Freshman → Sophomore.
- Version: Version 1.0 — October 2026.
Minister Destiny Testimony Schools — Adult. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).