D. Invoke the organization's incident response plan.

Before preparing or sharing any communication, the first step an information security manager should take during a security incident is to invoke the incident response plan (IRP).

The IRP:

Provides a structured approach to handling the incident

Includes roles and responsibilities for communication

Ensures that all actions are coordinated, legally sound, and aligned with company policy

Helps prevent premature or inappropriate disclosure

Communication strategies—including what to say, when, and to whom—are typically defined within the incident response plan, or in a supporting crisis communication plan.