Template principle
Keep the executive brief short enough to drive decisions. Put confirmed business impact and decisions required before raw technical detail.
Briefing fields
IncidentIncident name or identifier, severity and current status.
Executive summaryTwo or three sentences: what happened, what is affected and what the organisation is doing now.
Confirmed scopeAffected business services, identities, assets, locations, data and third parties that are confirmed.
Business impactService, financial, customer, safety, regulatory or operational impact that is confirmed or reasonably estimated.
Containment statusWhat has been contained, what remains exposed and what containment action is underway.
Evidence and investigationWhat evidence is preserved, what is known about the intrusion path, and which major questions remain unanswered.
Recovery statusServices restored, recovery sequence, blockers and criteria for normal operation.
Decisions requiredSpecific executive decisions with owner, deadline, options and consequence.
NotificationsLegal, privacy, regulator, insurer, customer, supplier, law-enforcement or public communication status.
Next updateTime of next scheduled executive update and the evidence expected before then.
Rules for a useful executive update
Separate confirmed facts, working hypotheses and unknowns.
State the business consequence before technical detail.
Name the decision owner and deadline for every executive decision.
Do not report attribution, data exposure or recovery certainty beyond the evidence available.
Keep an immutable or auditable record of major decisions and updates.
Boundary
This is a communication template, not legal advice, a disclosure notice, a regulator report or a substitute for organisation-specific crisis communication procedures.