A continuity plan without a communication plan is half a plan

Six in ten Flemish municipalities have no plan for what happens during a cyberattack, according to Audit Vlaanderen’s review of 89 local governments carried out between 2023 and 2025. Most of the minority that do have a continuity plan never address who tells citizens, staff and media what, and through which channel, once the systems citizens rely on go dark.

What a cyber incident communication plan is

A cyber incident communication plan is the pre-agreed set of decisions that determines who informs whom, in what order, through which channel, the moment a cyberattack or major system outage is confirmed. It sits beside the technical continuity plan, not inside it. The continuity plan restores servers, networks and data; the communication plan manages what citizens, staff, suppliers and journalists hear while that restoration is underway, which is why some PR specialists frame it as a specific subset of crisis communication. Audit Vlaanderen’s 2023-2025 review of 89 Flemish municipalities and intercommunales found that auditors only checked whether a continuity plan existed, never whether it included any communication protocol at all (Audit Vlaanderen, 2025). That distinction matters. An organisation can tick the box for business continuity and still leave every spokesperson, press officer and call centre agent improvising when email, the website and the phone system fail simultaneously.

The audit numbers go well beyond the six-in-ten headline

Audit Vlaanderen’s report bundles local ICT security audits carried out across Flanders between 2023 and 2025. Participation was voluntary: 77 of Flanders’ 300 municipalities and 12 intercommunales took part, so the sample skews toward organisations willing to be checked rather than a representative cross-section of every local government. Even among this self-selected, more security-conscious group, auditors logged 1,899 digital vulnerabilities, 353 of them rated high risk, and found not a single audited body free of weak spots (Audit Vlaanderen, 2025).

The password numbers are the clearest sign that the continuity gap is not an isolated planning failure. Across the 89 audited bodies, an average of 30% of tested passwords were weak enough to crack quickly, and weak passwords showed up on 18% of system administrator accounts, the logins with the widest access to a network (Audit Vlaanderen, 2025). The VVSG, the association representing Flemish cities and municipalities, acknowledges that many local governments are only now catching up, pushed by the European Union’s NIS2 directive rather than by internal initiative (VVSG, 2025). Auditors checked only whether a continuity plan existed, not its quality, so even the 41% of municipalities that pass on paper may still lack a tested, workable plan. For communication teams, this means the technical risk and the reputational risk arrive on the same day, often with no agreed script for either.

Why the Antwerp attack still sets the benchmark for what’s at stake

The reference point for Flemish public administrations remains the cyberattack on the City of Antwerp in December 2022, which disrupted services for months rather than days. Citizens could not request documents, staff lost access to internal systems, and the city had to communicate through improvised channels while its usual ones were stuck offline. The first hours after a breach decide how much of that disruption turns into a communication failure layered on top of the technical one.

Antwerp and the recent PHP2Shell episode make the same point. A channel that citizens expect to use, a website, an email address, a phone line, can disappear for reasons that have nothing to do with how well an organisation writes its public statements.

Why did the PHP2Shell flaws take government websites offline?

In October 2026 the same thing happened again, this time without a confirmed breach. Two critical flaws in PHP, the programming language behind WordPress and a large part of the web, were disclosed under the name PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both let an attacker run commands on a web server without a password or account, and AWS saw attackers exploiting them four days before the public disclosure, The Register reported. One of the two flaws was found by researchers working with OpenAI, a sign of how AI speeds up the hunt for weaknesses on both sides.

Governments did not wait. Authorities in Belgium, the Netherlands, Germany, France, Finland and the Czech Republic took websites offline to patch them, and the US National Security Agency advised disconnecting any system that could not be updated immediately, according to Al Jazeera. In the United Kingdom alone, 32 government services became unavailable. Most of those shutdowns were precautionary, yet for citizens the result looked exactly like an attack: the website they needed was gone.

That is the scenario most communication plans skip, a deliberate and planned outage. It still needs a holding statement on a fallback page or social channel, a short message to staff about which channels still work, and one owner who decides when to announce that the site is back. It starts with a simple question to your web partner: is the October PHP security update installed? Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and sites on PHP 8.1 or older need an upgrade.

What does NIS2 require once an incident is confirmed?

The NIS2 directive, formally Directive (EU) 2022/2555, tightens notification duties for essential and important entities, a category that now explicitly includes public administrations at local level across the European Union. Lauren Cuyvers of law firm Crowell & Moring notes that artificial intelligence is reshaping this picture from both directions: it helps attackers find and exploit vulnerabilities faster, while also giving defenders better detection tools, which makes the contract terms organisations sign with software suppliers more important than ever (Crowell & Moring, 2025).

1. An early warning within 24 hours of becoming aware of the incident.
2. A fuller incident notification within 72 hours, including an initial assessment of severity and impact.
3. A final report within one month, covering root cause and remediation.

Meeting these legal deadlines is a technical and legal task. It says nothing about what the organisation tells the public, staff or clients during that same window. A communication plan answers the question NIS2 doesn’t ask: who talks to whom outside the regulator, and why having that plan in writing matters long before an incident starts the clock.

Why this isn’t only a municipal problem

The audit covered local governments, but the structural problem isn’t limited to the public sector. Private Benelux companies split continuity and communication planning the same way, often because the two sit in different departments: IT owns the continuity plan, communication sits with marketing or an external agency, and the two documents are rarely tested together. A manufacturer that loses its order system, a healthcare provider that loses access to patient records, or a logistics company that loses tracking data faces the same first question a municipality faces: who tells clients, staff and media what, right now, while the technical team works.

NIS2 widens the circle of organisations with a legal notification duty well beyond critical infrastructure, so this is not a risk any Benelux company can file under somebody else’s compliance problem. The Flemish audit simply puts numbers on a gap that most organisations, public or private, already share.

Five pieces every cyber incident communication plan needs

Wouter Decruy of IT auditor Acen, who contributed to the audit findings, frames continuity planning around very concrete questions: who gets informed, in what order are systems restarted, and whether the organisation has rehearsed any of it as a digital fire drill. The same questions apply to communication. Five elements turn a continuity plan into one that also protects the organisation’s relationship with the people who depend on it.

• Pre-approved holding statements. One or two short statements, already drafted and signed off, that can go out within the first hour without waiting on legal review while the facts are still unconfirmed.
• Offline contact lists. Phone numbers and addresses for staff, suppliers, local press and key clients, stored outside the network that might be the thing that goes down.
• Channel fallbacks. A way to reach people when the website and email are both offline: SMS, a phone tree, social media accounts hosted elsewhere, physical notices at a town hall or office entrance.
• Spokesperson roles. One named spokesperson and one back-up, briefed in advance on what they can and cannot confirm before technical teams verify the facts.
• Rehearsal inside the continuity drill. Communication roles tested in the same drill used for technical recovery, at least once a year, not as a separate exercise added on later.

Questions people ask about cyber incident communication plans

What turns a written plan into a working one

A cyber incident communication plan only works if it has been rehearsed under the same pressure as the technical recovery it sits beside. Audit Vlaanderen’s review found that 59% of Flemish municipalities and 67% of intercommunales had no continuity plan at all, and auditors checked existence only, not quality, so a written plan sitting in a drawer counts the same as no plan in that audit (Audit Vlaanderen, 2025). In our own work advising Belgian organisations on crisis response, the plans that hold up under real pressure share one trait: communication roles were tested in the same drill as technical recovery, not bolted on afterward as a separate exercise nobody remembers. NIS2’s notification deadlines add a legal reason to get this right, but the reputational cost of silence during an outage, not the fine, is usually what persuades a board to finally approve the budget.

• Audit whether a communication plan exists separately from the continuity plan, not assumed to be included in it.
• Draft and pre-approve holding statements before an incident happens, not during one.
• Build an offline contact list and at least one channel fallback that does not depend on email or the website.
• Name a spokesperson and a back-up, and brief both in advance on what they can confirm.
• Rehearse the communication plan inside the same drill used for technical recovery, at least once a year.

Organisations that treat this as preparation rather than paperwork, and that build the habit of rehearsing before an incident starts the clock, are the ones still in control of the narrative once the systems come back online.