What was already said
As I discussed in my previous CSO article, putting a lawyer in a large incident channel does not make every conversation privileged. Operational facts and legal advice serve different purposes, and a crisis does not remove the need to control who participates in sensitive discussions. If the attacker was reading the channel, assume that every containment plan, every candid assessment of how the intrusion happened, and every draft customer statement posted there is now outside the company. Some of it may surface in an extortion demand. All of it may surface in discovery.
Plan as though the company will end up in court. The out-of-band channel should give teams a place to separate operational coordination from legal analysis, limit participation and begin building the record that regulators and plaintiffs may later examine: what was decided, by whom, on what facts and why. Legal should design that structure before the incident. Trying to create it during one, in a channel the attacker may be reading, compounds the problem.
What an out-of-band plan must solve
The mistake I see is starting with a backup application. Start with the failure scenario and map every dependency shared by the primary and emergency communications environments, including identity services, managed devices, mobile device management, administrative credentials and employee directories. If both channels depend on the same underlying component, that component remains a single point of failure.
