The Cybersecurity and Infrastructure Security Agency (CISA) has urged service providers to prioritize clear, timely, and transparent communication during major IT or operational technology (OT) outages.
In newly published joint guidance, Communicating Under Pressure: Best Practices for Service Providers, CISA, the FBI, and international partners outlined how organizations should prepare for and manage outage communications affecting customers, critical-infrastructure operators, government entities, and the public.
Published September 2, 2026, the guidance applies to disruptions caused by cyberattacks, human error, equipment failures, natural hazards, or defensive actions such as isolating systems during an incident.
CISA Urges Service Providers to Provide Transparent Updates
A significant outage at a single provider can affect a broad range of interconnected services, creating cascading operational consequences across sectors.
Organizations dependent on telecommunications, cloud platforms, managed service providers, industrial systems, and other third-party infrastructure may lose visibility into the incident while facing immediate business and safety impacts.
CISA warned that uncertainty can rapidly fuel speculation, misinformation, and public alarm. Without reliable provider updates, affected organizations and end users may rely on incomplete information, social-media claims, or unverified reporting to determine the scope and expected duration of an outage.
The agency said organizations must treat communications as an operational component of incident response rather than an afterthought.
Service providers should establish communications processes before an outage occurs, including designated decision-makers, approved escalation paths, alternate communications channels, and procedures for engaging customers and government partners.
The joint guidance identifies clarity, accountability, and transparency as essential principles for crisis messaging.
Providers should deliver information that is accurate, audience-appropriate, and updated as the situation develops, while balancing legal obligations, operational security, containment activities, and law-enforcement considerations.
Initial outage notifications should explain what is known, identify the affected service or geographic area where possible, and state when stakeholders can expect the next update.
Providers should avoid overly technical or vague language that leaves customers unable to assess their exposure. Even when technical details remain under investigation, organizations can provide useful updates.
For example, a provider may confirm that it is investigating connectivity failures, outline whether restoration work is underway, identify available workarounds, and commit to a specific time for the next status report.
Consistent messaging across status pages, customer portals, media statements, call centers, and social channels is also important. Conflicting communications can undermine confidence and complicate response actions for downstream customers.
CISA emphasized that critical-infrastructure owners and operators should assume telecommunications services may become unavailable or unreliable during a cyber incident or broader crisis.
Crisis communications plans should therefore include backup methods for exchanging urgent information with service providers, customers, employees, emergency responders, and government agencies.
The guidance aligns with CISA’s CI Fortify initiative, which provides resources to help critical-infrastructure entities isolate and recover vital OT systems during major cyber incidents. Organizations may need to disconnect or restrict access to systems as a defensive measure.
Such actions can protect essential environments from further compromise, but they can also interrupt availability. Transparent, ongoing communication can help customers minimize disruption, make informed contingency decisions, and maintain trust throughout recovery.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 has urged service providers to prioritize clear, timely, and transparent communication during major IT or operational technology (OT) outages.){kind=link}