Information/cybersecurity incident information shall be communicated and shared with the organization’s employees in a format that they can understand.
The organization shall share information/cybersecurity incident information with relevant stakeholders as foreseen in the incident response plan.