The question is no longer whether, but when your organization will suffer a consequential cyber incident. A crisis communications plan is mandatory ... as intended, and templates are suitable.