Five Eyes agencies turn provider outage messaging into a pre-built control
CISA, the FBI and partner agencies in four countries now tell service providers to fix incident thresholds, escalation paths and status page wording before anything breaks, which hands customers something they can test after the fact.
The Watch · Security desk
What happened
- CISA and the FBI, with cybersecurity agencies from Australia, Canada, New Zealand and the UK, published joint guidance on how service providers should communicate during major IT and OT outages.
- Providers are told to drop vague phrasing such as "service degradation" and to open with affected systems, user impact, scope and known cause, without speculating on root cause.
- CISA's resource page tells critical infrastructure operators to assume telecommunications may be unreliable and to know what communication they should expect from their providers.
Why it matters
- Who has to decide decision Because the guidance ties messaging to legal and contractual obligations, provider comms behaviour becomes a procurement term rather than a matter of trust in someone's crisis judgement.
- What it limits constraint The operational security caveat limits what any plan can promise: anything published in the first hours of a suspected intrusion must not undercut containment, so the sayable set has to be agreed before the incident.
- What's now possible capability Downstream operators gain a concrete vendor interrogation: which threshold triggers a notice, who is authorised to speak, and which single page carries the truth.
- What it sets up precedent Guidance with no deadline still sets a yardstick, and the next large provider outage will be read against acknowledgement speed, actionable detail, transparency, accountability and update cadence.
Next story · Security · Oct 8
Ten agencies tie China-linked intrusions across several sectors to Integrity Technology GroupConfirmed13 publishers
The lever here is pre-commitment rather than advice. A threshold defined before an incident is a number somebody can check afterwards, and so are an escalation path, a named spokesperson and a status page designated as the single source of truth [4][9][11]. The guidance also tells providers to align external messaging with legal, contractual and sector-specific reporting obligations [12]. Contractual is the operative word: a customer can lift thresholds and update cadence into a renewal, then test them after the next outage.
Count what a provider needs on the shelf before anything breaks. According to The Cyber Express's summary of the document, the plan has to define incident thresholds, escalation paths and target audiences, then set procedures for three channels: status pages, customer and partner notices, and regulatory communications [4]. Three definitions plus three channel procedures is six artifacts, and none of them can be drafted while the phones are lit [16].
The hard instruction is the operational security one. Where malicious activity is suspected or confirmed, external communication must not compromise the investigation or containment, and the agencies warn against premature conclusions on root cause while it is still under investigation [5]. That judgement cannot sit with a communications lead alone, which is why legal, risk and compliance are placed on the same incident team as engineering, operations and customer support [8]. The useful content of the plan, in practice, is a pre-agreed list of what can be published while an intrusion is still live.
CISA's own resource page pushes from the buyer's side. Critical infrastructure owners and operators are told to assume telecommunications may be disrupted or unreliable, to keep crisis communications plans that integrate backup methods, and to understand the type of communication they should expect from their service providers [13]. The same page points that audience at CI Fortify material on isolating and recovering vital OT systems during a major incident [14]. Because an outage at one organization can cascade across interconnected systems [7], a downstream operator can now put specific questions to a vendor: which threshold triggers your notice, who speaks, and where is the single page.
Nothing in either publication is binding. Neither carries a deadline nor an enforcement mechanism [15]. Providers already posting time-stamped updates with scope, impact and a stated customer action will read the five principles and change nothing [6]. The delta shows up in renewal terms, where a customer now has a document signed off by agencies in five countries to quote instead of an opinion about what good looks like [17].
What to watch
- A sector regulator converting the five principles into a reporting expectation with a filing clock attached.
- Follow-on Five Eyes material written for buyers rather than providers, giving customers explicit assessment criteria.
- CI Fortify OT isolation guidance being paired with required customer notification steps rather than recommended ones.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+8
- Incentives30
- Confidence72
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA and the FBI, along with cybersecurity agencies from Australia, Canada, New Zealand and the UK, released new guidance on outage communications for service providers dealing with major IT and OT outages.
- [2]
The guidance is titled "Communicating Under Pressure: Best Practices for Service Providers" and was developed by CISA, the FBI and international partners.
- [3]
The guidance covers outages whether caused by cyber threat actors, human error, equipment failure or natural hazards.
- [4]
The agencies recommend establishing an outage communications plan before an incident; the plan should define incident thresholds, escalation paths, target audiences and procedures for status pages, customer and partner notices, and regulatory communications.
- [5]
If malicious activity is suspected or confirmed, external communications should not compromise investigations, containment or other response activities, and organizations are advised against premature conclusions while root cause remains under investigation.
- [6]
The agencies frame effective outage communications around five principles: immediate acknowledgement, technical and actionable information, transparency, accountability, and continuous updates.
- [7]
Outages at one organization may cascade across interconnected systems, increasing uncertainty and alarm.
- [8]
Organizations are advised to establish cross-functional incident teams involving engineering and operations, communications, legal, risk and compliance, and customer support.
- [9]
The guidance calls for clearly defined roles including an incident lead, a communications lead and a spokesperson.
- [10]
The agencies advise against vague descriptions such as "service degradation" and say outage messaging should lead with a concise summary covering affected systems, user impact, scope and known cause without speculation.
- [11]
Providers are advised to state what they know and do not know, use a single source of truth such as a status page, focus on actionable guidance rather than reputation management, and tell customers what action to take or that no action is required.
- [12]
The guidance calls for continuous, time-stamped updates showing the incident timeline, actions taken and recovery milestones, and for aligning external messaging with legal, contractual and sector-specific reporting obligations.
- [13]
For emergency planning, critical infrastructure owners and operators should assume telecommunications services may be disrupted or unreliable, keep crisis communications plans that integrate backup communication methods, and understand the type of communication they should expect from their service providers.
- [14]
CISA's CI Fortify initiative provides resources to help critical infrastructure organizations prepare to isolate and recover vital OT systems during a major cyber incident or crisis.
- [15]
Neither publication describes a compliance deadline, an enforcement mechanism, or a new reporting requirement; both are framed as best practice.
- [16]
The recommended plan implies six pre-incident artifacts: three definitions (incident thresholds, escalation paths, target audiences) plus procedures for three channels (status pages, customer and partner notices, regulatory communications).
- [17]
The signatory set spans five countries: the United States (CISA and the FBI), Australia, Canada, New Zealand and the United Kingdom.
- [18]
The guidance recommends parallel workstreams so technical teams diagnose and remediate root cause while communications teams manage external messaging and leadership handles strategy and regulatory requirements.
- [19]
Recommended audience segments include enterprise IT teams and security operations centers, employees and customers, government partners and regulators, critical infrastructure owners and operators, and the media and general public.
Sources
2 independent publishers whose own reporting we read for this story.
- cisa.govCommunicating Under Pressure: Best Practices for Service Providers
1 article · September 2, 2026
- thecyberexpress.comCISA, FBI Urge Clearer Communication During Major Outages
1 article · September 2, 2026
Topics and entities
Topics
- Joint Government Cyber Guidance
- Incident Communications and Status Pages
- Critical infrastructure resilience
Entities
- Communicating Under Pressure: Best Practices for Service Providers
- Federal Bureau of Investigation
- CISA