Glossary
Out-of-band communications
Communication channels that are independent of the systems affected by an incident, used when corporate email, chat or identity may be compromised.
Out-of-band communications are channels the incident-response team can use that do not depend on the environment under attack. If an attacker controls the identity platform, corporate email or chat, responders who coordinate there may be observed or locked out, and the systems themselves may be unavailable.
Common out-of-band arrangements include a separate messaging workspace or conference bridge not tied to corporate single sign-on, pre-registered personal or dedicated phones, printed or offline contact lists, and an agreed fallback meeting location. The channel must be set up, access-tested and known to the crisis team before it is needed.
Out-of-band plans should also cover how to verify identities (so an attacker cannot join the channel), where to store the incident log and how third parties such as the IR firm, insurer and outside counsel are reached.
Tabletop exercises test this with constraint injects: "email and chat are down", or "you suspect the attacker can read your email". See designing tabletop injects and the ransomware scenario.