It's important to be prepared for when a cyber incident happens to you.  Part of that preparation should include having a Cyber Incident Response Plan, and part of that plan should include how to communicate, who does the communication and what they should say.
A cyber incident or cyber attack can be an extremely stressful situation for all parties involved.  The urge to resolve it quickly and get back to normal, can mean steps are missed and misinformation shared.  A clear communication strategy means effective communication both during and after the incident.  The NCSC has recently published guidance about this 👉Effective Communications in a Cyber Incident

In summary:

1. Prepare your communications strategy in advance

• Outline roles, responsibilities and communication protocols.
• Identify any external contacts you would need to inform and have their information available.  Don't forget your usual communications channels may not be open to you, so make a plan about how you will do this.
• Test and review your plan by conducting table-top exercises.

2. Communicate clearly with different parties, and tailor your messaging where necessary

• Transparency helps build trust and credibility.
• You may need to manage media coverage, so have something pre-prepared.

3. Manage the aftermath

• Provide regular updates on the incident.
• Continue to engage.
• Consider sharing insights and lessons learned.

Additional information for SLT/Head teachers/CEO's:

As head of the organisation it will likely be your responsibility for responding to a cyber incident. Further help and advice from the NCSC 👉 https://www.ncsc.gov.uk/guidance/ceos-responding-cyber-incidents