What is a holding statement?

A holding statement is a short, pre-approved message an organization issues early in an incident, before it knows the full facts. It acknowledges the problem, says what is being done, and promises an update, without guessing at cause or scope.

What it means in practice

A holding statement is usually two to four sentences. It’s written in advance from a template, so nobody is drafting from scratch at 7 a.m. with the website down. A typical one might read: “We are aware of a disruption affecting some of our systems. We have taken steps to contain it and are working with outside specialists to understand what happened. We will share more information as soon as we can confirm it.”

Good ones share a few traits. They say what’s confirmed. They say what the organization is doing. They say when or how the next update will come, and who to contact. They are plain and short. A public relations agency’s guidance recommends keeping them “short and sweet.” New Zealand’s national cyber security centre makes the same point in its public communications framework: a placeholder is better than silence.

What they leave out matters as much. Don’t guess at the cause. Don’t name an attacker. Don’t promise that no data was affected before the investigation has finished. The New Zealand framework gives that claim as an example of a statement an organization may later have to retract.

Two limits are worth knowing. First, a holding statement is not a breach notification. In Canada, PIPEDA requires organizations to report certain breaches to the Privacy Commissioner and to notify affected individuals directly, as soon as feasible after determining a breach occurred, where there is a real risk of significant harm. All 50 US states have their own breach notification laws, with their own rules on who must be told and when. A press line is not a substitute for any of them. Second, a holding statement goes stale fast. One communications commentator argues that relevance depends on recency, so a real update has to follow quickly.

Where it shows up in an incident

The communications lead or designated spokesperson drafts and issues it. The incident commander and legal counsel approve it. If you have cyber insurance, check whether the insurer or its breach counsel should see public statements before release.

The usual mistakes are waiting for perfect information, so rumour and social media fill the gap, and telling the public before employees, customers or affected partners hear it from you. Others are saying too much early and contradicting it later, using a template that doesn’t match the incident or was last reviewed years ago, and posting different statements on different channels. And there may be no way to publish at all. If email and the website are down, an out-of-band channel has to exist.

In a tabletop exercise

Sample inject: “At 7:40 a.m. a local reporter emails asking whether your organization has been hit by ransomware. Employees are posting that they can’t log in. The only approved statement on file is two years old and refers to a phone system. Who drafts a new one, who approves it, how long does that take, and where does it get published when the website and email are down?”

Discussion question: “What can we say truthfully at hour two that we won’t have to retract at hour 48?”

Sources

• New Zealand National Cyber Security Centre, Public communications for cyber security incidents: a framework for organisations
• High Profile, Be prepared: create holding statements before a crisis hits (a public relations agency)
• IPRA, Crisis management: a holding statement won’t hold for long
• Personal Information Protection and Electronic Documents Act, section 10.1 (Justice Laws)
• National Conference of State Legislatures, Security breach notification laws (January 2022)