Engagement Communication

Control Statement

Incident and recovery information shall be shared with designated internal stakeholders, external partners and the public as the situation and the agency's obligations require, within stated periods.

Purpose. To ensure the people who must know, do — inside the agency, across the federal community, and among those the mission serves.

Discussion

This control covers three audiences with different clocks and is distinct from CE-7, which distributes the cycle Brief internally on a cadence. Internal stakeholder notification is an operational obligation; federal reporting to CISA and sector partners is frequently a statutory one with a defined window; and public communication during a recovery is where a federal agency's obligation to the people it serves becomes concrete. The framework's own material puts the community reporting case well: reporting is not altruism in a federal community — it is how the next agency's spoiling attack becomes possible, and how yours does.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Identify the internal stakeholders, external partners and public audiences to be informed.
2. L2Communicate incident information to each within stated periods.
3. L2Communicate recovery status and completion as the situation develops.
4. L3Record the statutory or policy reporting windows applying to each recipient, with provenance per GA4, and treat a missed window as a finding.
5. L3Define what may be shared with each audience at each stage, so operational sensitivity and the duty to inform are reconciled in advance rather than negotiated during.
6. L3Share indicators and tradecraft with sector partners and CISA once eradication permits, consistent with M10.05 and the agency's disclosure authorities.
7. L3Designate the communication authority per audience, since public communication is a command decision rather than an analyst's.
8. L3Provide recovery status to those affected by the mission impact, not only to internal stakeholders.
9. L4Measure communication timeliness against each stated window and trend it.
10. L4Measure the proportion of eradicated incidents that resulted in a community contribution, since a program that only receives from the community is not participating in it.
11. L5Review communications after each engagement against what recipients actually needed, and revise the audience and content definitions.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.