The FBI, CISA and international partners have released new guidance on crisis communications during major IT outages — a document that speaks directly to comms teams who spend their days planning for the day the whole company goes dark.

The joint advisory lands at a moment when the question is not whether a major outage will hit, but who will explain it well when it does. Recent history gives practitioners plenty of case studies: global IT failures have grounded airlines, knocked banks offline and left retailers unable to process payments. In each case, the technical failure was only half the story. The other half was what organizations said — and how fast they said it.

What the guidance covers

The document from the FBI, CISA and partner agencies abroad sets out recommendations for how organizations should communicate with customers, employees and stakeholders while a major IT outage is in progress. The involvement of international partners signals that outage response is now treated as a cross-border operational discipline, not a domestic afterthought.

For comms practitioners, the core message is familiar but worth hearing from security agencies themselves: crisis communications planning belongs in the same room as incident response planning. The people who write the holding statements need to know the incident commanders before the incident, not during it.

Why security agencies are weighing in

When the FBI and CISA put their names on communications guidance, it reflects a shift in how regulators and law enforcement think about outage consequences. A silent organization during a major outage breeds speculation, rumor and — in some scenarios — panic. Clear, fast, honest messaging reduces the blast radius of an incident well beyond the help desk.

The guidance also implicitly acknowledges a dependency problem. Many organizations' crisis comms channels — mass email, intranets, collaboration platforms — run on the very infrastructure that fails during a major outage. Teams that have not rehearsed out-of-band communication find themselves with a statement ready and no way to deliver it.

What practitioners should do with it

Read the advisory, then pressure-test your own plan against it. The uncomfortable questions are the useful ones. Who is authorized to speak if the approval chain is unreachable? Where are the pre-drafted templates, and are they stored somewhere that survives the outage? Which channel reaches employees when the corporate network does not?

The record of recent mass outages suggests most organizations cannot answer those questions quickly. Joint guidance from the FBI, CISA and international partners gives comms teams new leverage to fix that — and a document from serious agencies that leadership will actually read.