Communication Matrix
Definition
A structured table in an IR plan that maps incident severity tiers to mandatory notification recipients, timelines, and communication channels. It removes ambiguity about who must be told, in what timeframe, and through which channel during an active incident.
- Lives in
- Incident response plan
- Rows typically
- Severity tiers (e.g. low, medium, high, critical)
- Columns typically
- Recipient, timeline, channel
- Purpose
- Removes ambiguity during an active incident
Common questions
Who is typically listed as a recipient in a communication matrix?+
Common recipients include the incident commander, legal counsel, executive leadership, affected business units, regulators where notification is legally required, and sometimes customers or the public for the most severe tiers, each mapped to a specific timeframe such as within one hour or within 24 hours.
Why does the matrix specify a channel as well as a recipient and timeline?+
During an incident the usual channel, such as corporate email, may itself be compromised or unavailable, so the matrix often specifies an out-of-band channel like a phone bridge or a messaging app outside the affected network for higher-severity tiers.
Related terms
- Business Continuity Plan (BCP)
- A document that specifies how an organisation keeps critical business functions operating during a significant disruption. The IR plan and BCP must...
- Disaster Recovery Plan (DRP)
- A plan focused on restoring IT systems and data after a major failure or destructive event. Often a subset of BCP. The...
- IR Plan
- The operational document that translates the policy into specific procedures, roles, severity tiers, communication chains, and recovery criteria. Versioned and reviewed at...
- IR Policy
- A management-approved governance statement that commits the organisation to an incident response programme, defines its scope, and grants authority to designated teams....
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...