OperationalResilience.help
The Continuity Desk - important services, kept running
Home / Line 14 - Cyber recovery and restoration / Guide

Recovery Communication During an Outage

What to say while a service is down and coming back: honest status, clear limits, and updates that keep customers and staff acting on the same understanding.

Published 26 October 2026Checked against the regulation text on 26 October 2026Regime-dependent: EU under DORA, UK under FCA/PRA, labelled in the guide

The short answer

Recovery communication during an outage is the work of keeping customers, staff, and providers acting on the same understanding while a service is down and while it returns. It is not an announcement at the start and another at the end. It is a steady flow of plain information: what is affected, what is not, what customers can and cannot do, what the firm is doing next, and when the next update will come. Good communication does not make an outage shorter, but it reduces the second harm that outages cause, which is confusion, repeated attempts, and decisions made on wrong assumptions.

The discipline of recovery communication is to say what is known, to mark what is not yet known, and to avoid filling gaps with speculation. A firm that says a service will return at a time it cannot support, or that describes a cause it has not established, creates a second problem when the time passes or the cause proves different. A firm that says, plainly, that investigation continues and that the next update will come at a stated point, gives customers something reliable to plan around, even when the news itself is unwelcome.

Who needs to hear what?

Different audiences need different information, and recovery communication should be planned with that in mind. Customers need to know whether their service is affected, what they can do instead, and whether their money, records, or instructions are safe as far as the firm knows. Staff need to know what to tell customers, what not to promise, and where to direct difficult cases. Providers need to know what the firm expects from them and what the firm is doing on its side. Senior leaders and, where relevant, supervisors need a factual account of scope, decisions, and limits.

What should an update contain?

A useful update contains a small set of elements, stated plainly. Which service and which journeys are affected. What customers can still do, and what they should avoid doing for now, such as repeating a payment that may already have been processed. What the firm is doing, in general terms that do not compromise the recovery itself. And when the next update will come, even if that update can only say that work continues. Those elements give customers a basis for action, which is the purpose of communication during an outage.

Which channels, and what if they are affected?

Communication channels should be chosen for reach and reliability, not for convenience. A firm may use its website, its app, its telephone service, email, and social channels, depending on what its customers use and what remains working. The plan should consider the awkward case where the outage itself affects the usual channel. If the app is down, customers cannot read an in-app message. If the website is the affected service, a status page hosted on the same infrastructure may be down with it. Alternative channels, prepared in advance, prevent the firm from being silent precisely when customers most need information.

How is the return itself communicated?

The return of a service needs communication as careful as the outage itself. Customers should be told which journeys have returned, which remain limited, and what they should check, such as whether a payment completed or a balance looks right. Where a return is limited, the limits should be stated plainly, not hidden in general language about the service being back. A customer who acts as if full service has returned, when only part has, may create errors that recovery then has to untangle.

What does communication look like afterwards?

Afterwards, communication should close the loop. Customers who were affected should be told, in summary, what happened as far as the firm understands it, what was done to restore the service, and what the firm is doing to reduce the chance of recurrence. That account should be honest about its limits. Where investigation continues, the firm should say so rather than presenting an interim account as final. A closing message that proves incomplete damages trust more than an interim message that is openly incomplete.

Internally, the firm should review its communication as part of its lessons process. Which messages helped customers act correctly. Which messages were misunderstood, or arrived too late, or contradicted another channel. What did staff need that they did not have. Those questions turn communication from a reactive task into a capability that improves. Under DORA, which applies from 17 January 2025, the EU frame is labelled separately from the UK regime under FCA PS21/3 and PRA PS6/21, with their own dates. In either frame, the practical test is the same: did customers and staff, during the outage, understand enough to act sensibly. If not, communication, not just technology, needs fixing.

Primary sources on the record

Legal status: Regime-dependent and labelled in the guide. DORA applies from 17 January 2025. The UK regime has its own policy statements and dates, stated separately where the guide compares regimes. Application position for this topic: DORA: from 17 January 2025. UK: see the UK line for its own dates.

Follow the service map

Line 14 - Cyber recovery and restoration Cyber Recovery after Ransomware and Outages What cyber recovery really means after ransomware or an outage: checking backups, restoring clean, sequencing the return, and deciding when a service is safe to use again. Line 14 - Cyber recovery and restoration Recovery Testing and Rehearsal Rehearsals that actually teach: testing a restore under realistic conditions, finding where the plan breaks, and fixing the plan before an incident finds it first. Line 14 - Cyber recovery and restoration Recovery Evidence and Lessons What a recovery leaves behind: decision records, restore logs, and lessons that actually change the next plan, rather than a report that is filed and forgotten.