Generally speaking, in my experience, the disclosure of information is done in collaboration with the agencies.
I'll give you a very concrete example. The first time we named some of the countries involved in this incident, it was classified information. We did the work required to allow us to say that now, based on publicly available information and its impact on our operations, we can begin to say more about it.
It was therefore an iterative process, but it was not based on a government policy.