From tldrsec.com: tl;dr: This paper by academics from the University of Warwick and the University of Kent, UK, lays out a framework for how organizations should communicate after a security incident. The post has some very good flowcharts and diagrams to follow while navigating an incident. https://tldrsec.com/blog/a-framework-for-effective-corporate-communication-after-cyber-security-incidents/