.webp)
If email went down tomorrow at 8 a.m., how would your staff know what to do?
In La Rochelle (France), a ransomware attack meant four weeks of working with paper and pencil, with 53 of 150 servers infected (French Senate, 2021). In Hamilton (Ontario, Canada), in March 2024, ransomware hit the city's systems, phone lines included, with effects felt for weeks, according to the Canadian Centre for Cyber Security. On the first morning, the problem is not the message but the channel, and for deskless staff the link is fragile even before the crisis: 63% of frontline workers say messages from leadership do not reach them (Microsoft Work Trend Index, 2022).
This guide is written for chief executives, internal communications leads, IT directors and CISOs in local government. It provides a protocol that fits on three pages and slots into the business continuity plan, together with the preparation and the exercise that make it reliable.
What's inside:
- The day nobody gets the email: why a local government under attack loses contact with its staff first, and what national cybersecurity guidance expects of a crisis communication plan.
- Three outages, one channel: email or a Microsoft 365 service unavailable, local IT compromised, Microsoft 365 tenant compromised, with a matrix showing the likely state of ten channels in each situation.
- Fallback channels by audience: five selection criteria and a grid covering office and field staff, dispersed sites, round-the-clock services, remote workers, elected officials and contractors.
- The 5-step protocol: from alert and qualification to closure and lessons learned, each step with an owner, a deadline and an exit criterion, plus the roles, their deputies and the incident log.
- The kit of 8 message templates: short versions under 160 characters, from the initial alert to the return to normal, written according to the FACET method recommended by ANSSI, the French national cybersecurity agency.
- Ready in 30 days: a four-week action plan covering the emergency contact list and its personal data framework, the offline toolkit, the continuity plan chapter and three Microsoft 365 settings.
- The annual tabletop exercise: a 12-point method, an illustrative "email unavailable" scenario and three success criteria (situation qualified within 1 hour, message 1 sent within 2 hours, 90% of managers reached within 3 hours).
- Where the mobile channel fits: what Jint Mobile App can and cannot do in each of the three situations, followed by a 12-point internal communications continuity checklist.
Why download it:
A protocol ready to insert into your continuity plan. The five steps, the roles and the incident log fit on three pages and add the internal communications chapter that continuity plans rarely cover.
Messages written before the crisis. The eight templates can be proofread now by a field team leader and a front desk employee, so that nobody has to draft them on the morning of the outage.
A realistic view of each channel. The guide states which channels remain credible in each situation, and why a compromised tenant requires a channel outside Microsoft 365, whatever the tool.
Grounded in public guidance. The recommendations draw on the guides of ANSSI and of the Canadian Centre for Cyber Security, and on Microsoft documentation.
