Communicate
Communicate is a two-way exchange with interested parties: a statement of status, the explanation after an incident, and communication designed for the audience that has to understand it.
What clause 7.3.5 asks
Communication runs both ways. The board and interested parties exchange what each needs. A statement of security status, covering activities and issues, is one method. Communication is also how an entity is held to account by shareholders and others who now receive information on how security is run and whether it works. After an incident, the entity should explain the impact, the cause and the control changes made, to interested parties and, where appropriate, to the public. Each message should be designed for its audience and for what that audience should understand, which fixes content and channel. The board also reports outward that the entity practises security in keeping with its activities and priorities, ranks regulatory and interested-party expectations, advises each system's leadership on decisions, sets detailed objectives, promotes culture and trains people on their duties.
Why it matters
Communication is where governance becomes visible, and where it most easily becomes marketing. The clause asks for a truthful statement of status, including issues, and for an incident explanation that says what changed. Those two requirements rule out the polished assurance that says everything is fine and the post-incident note that says lessons were learned without naming a control. The clause also makes communication two-way. Listening to interested parties is part of the process, not a courtesy. And it gives the board an upward duty as well as a downward one: advise each management system of what needs attention and decision, and instruct the relevant parties on the objectives that support the security priorities.
What good looks like
Write a communication plan by audience: the board, the management systems, staff and contractors, customers, regulators and the public where relevant. For each, name the content, the channel, the owner and the cadence. Base the external statement on the same record the board sees, and include the issues as well as the achievements. Prepare an incident communication template that has slots for impact, cause and control changes, and test it once. Add a listening route so that interested party concerns reach the governance cycle rather than the complaints inbox.
Evidence a board or an auditor asks for
The communication plan by audience with owner and cadence; the statement of security status with its issues section; the incident communication template and a test record; the log of matters advised to each management system; the listening route and examples of what it surfaced.
- Record The communication plan by audience with owner and cadence
- Record the statement of security status with its issues section
- Record the incident communication template and a test record
- Record the log of matters advised to each management system
- Record the listening route and examples of what it surfaced
Where it commonly fails
- Interested parties told nothing about security until a breach
- Incident explanations that omit what changed
- An external statement that claims more than the evidence supports
What to do before publication
Before the edition 3 text is published, put clause 7.3.5 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.