The organization shall determine internal and external communications relevant to the ISMS (what, when, with whom, how, who communicates).
Put simply: Design security communication: define what is shared, through which channels, by whom, and under which confidentiality rules.
More specifically, this requires that the organization:
a. Defines what must be communicated (incidents, changes, objectives, supplier requirements).
b. Defines when/how communication happens (frequency, channels, classification).
c. Assigns roles and authority for communication (customers, auditors, regulators, public).
