Communication is part of response
Technical teams, asset owners, leaders, vendors, and customer-facing functions need different information. Good communication separates confirmed facts from assumptions, states the evidence source and time, names the decision owner, and makes the next action visible. It avoids turning a preliminary alert into a public compromise claim.
Technical handoff template
- Current status, event window, affected or suspected entities, and confidence.
- Evidence reviewed, evidence gaps, containment state, and change identifiers.
- Open hypotheses, assigned owner, next query or validation step, and review time.
Executive status template
State the service or business context, what is known, what remains under review, actions underway, decisions needed, and next update time. Use bounded language such as "activity is being investigated" rather than asserting attribution, exposure, or impact without evidence.
Decision log
Record time, decision, alternatives considered, evidence, owner, approver, scope, expected impact, rollback condition, and next review. This gives later reviewers a way to understand why an action was proportionate at the time.
Common mistakes
Do not send raw sensitive evidence to broad audiences, omit uncertainty, or make notification promises outside the organization's approved process. Legal, privacy, regulatory, contractual, and customer communication requirements vary; engage qualified internal functions where required. This reference is not legal or regulatory advice.