A communications plan should identify internal and external stakeholders who may need notification, and may include third parties, law enforcement, or legal advice depending on the incident.

### Why this is right The communications plan should state how, when, and with whom the team communicates. The material specifically identifies clients and managed service providers as possible third parties, and says law enforcement or a lawyer may be relevant depending on the incident. ### The concept Stakeholder notification is planned in advance so the response team can communicate deliberately during a fast-moving event. The plan should provide a central point for employee reports and identify people or organizations who may need to be informed. The appropriate audience depends on the circumstances; the material does not say every incident requires notifying every possible party or contacting law enforcement. ### The other options - **False**: This would wrongly suggest that notification is limited to internal personnel or that external contacts never matter. ### Terms - **Managed service provider**: An external provider that manages or supports services for an organization. - **Law enforcement**: Government authorities responsible for investigating or enforcing laws. ### Remember Plan who may need contact, but select notifications according to the incident.