Examples of communication
Annex C gives disclosure and ESG reporting as examples, and warns that communication can be misunderstood or reach the wrong audience.
This annex is informative. It explains and illustrates; it does not create a requirement. A finding cannot rest on it alone. The normative guidance is in clauses 6 to 8.
What annex C asks
Two examples are given. One is the stock market, where law or industry rules require companies to disclose security risks. The other is an environmental, social and governance report, through which an organization explains its efforts on environmental, social and economic matters to interested parties. Some of those reports describe privacy and data protection, security work and crisis management. The annex then warns about side effects: an audience may misunderstand a message or read more into it than was said, and a message may reach people it was not meant for. The warning is the useful part. A sentence written to reassure an investor can tell an attacker where protection is thin, and a sentence written for a customer can become a commitment in a tender.
Why it matters
Disclosure is a governance decision, not a communications task. The annex helps the board see why. A stock market statement carries legal weight and can be read by investors, customers and attackers. An ESG report is voluntary but can still create an expectation that the organization must meet. In both cases the audience will infer more than the words say, and the reach may extend beyond the intended reader. The warning about unintended effects is the practical core. A sentence written to reassure an investor can tell an attacker where the control is thin. A sentence written for a customer can become a commitment in a tender. The governance answer is to design the message for the audience and to check the inference, not only the accuracy.
What good looks like
Map the disclosures the organization must make and the ones it chooses to make. For each, name the audience, the legal or voluntary basis, the approver and the evidence behind the claims. Run an inference check: what would a customer, an investor, a regulator and an attacker conclude from this sentence? Remove or qualify claims the evidence cannot support. Apply the same review to incident communication. Keep the approved statements with the board papers so a later change can be traced.
Evidence a board or an auditor asks for
The disclosure map with audience, basis and approver; the approved statements with the evidence behind each claim; the inference check record; the incident communication reviewed against the same test.
- Record The disclosure map with audience, basis and approver
- Record the approved statements with the evidence behind each claim
- Record the inference check record
- Record the incident communication reviewed against the same test
Where it commonly fails
- A voluntary report that creates an expectation the organization cannot meet
- A disclosure that reveals control weaknesses to the wrong audience
- Claims in a customer statement that the evidence does not support
What to do before publication
Before the edition 3 text is published, put clause C on the annexes, informative agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.