Executive Incident Reporting

Purpose and Scope

Security incidents require communication beyond the technical team. Executives need to make decisions, boards need oversight, regulators may require notification, and customers may need to take protective action. This playbook covers tailoring incident communication for different audiences.

Prerequisites

• Incident facts: Verified information about what happened
• Impact assessment: Understanding of business and customer impact
• Legal review: Guidance on regulatory and contractual obligations
• Communications plan: Defined roles and approval processes
• Stakeholder list: Who needs to be notified and when

Know Your Audience

Executive Leadership

Executives need to:

• Understand business impact and risk
• Make resource and priority decisions
• Communicate with board and external parties
• Approve significant response actions

They do not need technical details about attack techniques or tool output.

Board of Directors

Board members need:

• High level understanding of the incident
• Business and reputational impact
• Confirmation that management is handling appropriately
• Oversight of regulatory and legal exposure

Regulators

Regulatory notifications typically require:

• Nature of the incident
• Categories of data or systems affected
• Number of individuals impacted
• Mitigation steps taken
• Timeline of events
• Contact information for follow up

Customers

Customer notifications should include:

• What happened in plain language
• Whether their data was affected
• What actions they should take
• What you are doing to address it
• How to get more information

Executive Briefing Structure

Initial Notification

When an incident is detected, notify leadership promptly with:

• Summary: One sentence description of what happened
• Status: Active, contained, or resolved
• Impact: Known or potential business impact
• Actions: What the team is doing right now
• Next update: When you will provide more information

Ongoing Updates

Regular updates during active incidents:

• Current status and any changes
• New findings or scope changes
• Decisions needed from leadership
• Resource or support requirements
• External communication requirements

Final Executive Report

After incident closure, provide:

• Executive summary (half page maximum)
• Timeline of key events
• Business impact summary
• Root cause (non-technical language)
• Remediation actions completed
• Improvements planned
• Risk assessment going forward

Writing for Non-Technical Audiences

Translate Technical Concepts

• "Credential stuffing attack" becomes "Attackers used stolen passwords from other breaches to try to access accounts"
• "SQL injection" becomes "Attackers exploited a vulnerability in our website to access the database"
• "Lateral movement" becomes "After gaining initial access, the attacker moved to other systems"

Focus on Impact

Lead with business impact, not technical details:

• How many customers affected
• What data was exposed
• Was financial information involved
• Service disruption duration
• Reputational and regulatory exposure

Avoid Jargon

• Spell out acronyms on first use
• Use analogies when helpful
• Provide a glossary for necessary technical terms
• Test communications with non-technical colleagues

Regulatory Notification

Common Requirements

Many regulations require breach notification:

• GDPR: 72 hours to supervisory authority for personal data breaches
• HIPAA: 60 days to HHS for breaches affecting 500+ individuals
• State breach laws: Varying timelines and thresholds by state
• SEC: Material cybersecurity incidents within 4 business days (8-K)
• Industry specific: PCI, NYDFS, and sector regulators

Notification Process

1. Work with legal to determine notification requirements
2. Identify applicable regulations and contractual obligations
3. Document the incident facts required for notification
4. Draft notification with legal review
5. Submit within required timeframe
6. Document submission and retain confirmation
7. Respond to follow up inquiries

Customer Notification

When to Notify

• When customer data was accessed or exfiltrated
• When customers need to take protective action
• When required by law or contract
• When customers may hear about it publicly

Notification Content

Customer notifications should be clear and actionable:

• Plain language description of what happened
• Specific data types that were affected
• Concrete steps customers should take
• Resources you are providing (credit monitoring, etc.)
• Contact information for questions
• Apology and commitment to improvement

Channels

• Direct email to affected customers
• Website notice for broader communication
• Customer support preparation for inquiries
• Media statement if public attention expected

Communication Cadence

During Active Incidents

• Critical incidents: Updates every 1 to 2 hours
• High severity: Updates every 4 to 6 hours
• Medium severity: Daily updates
• After hours: Define escalation thresholds for leadership notification

Post-Incident

• Executive summary within 24 to 48 hours of closure
• Full post-incident report within 1 to 2 weeks
• Board briefing at next scheduled meeting or sooner if significant

Approval Workflow

Define who approves communications:

• Internal updates: Security leadership
• Executive briefings: CISO or security director
• Customer notifications: Legal, communications, executive approval
• Regulatory filings: Legal and executive approval
• Public statements: Communications, legal, and executive approval

Common Mistakes

• Over-communicating details: Sharing more than necessary
• Under-communicating: Leaving stakeholders without information
• Speculating: Communicating unverified information
• Blame: Pointing fingers before facts are clear
• Late notification: Missing regulatory deadlines
• Inconsistent messaging: Different stories to different audiences

Templates and Checklists

Maintain templates for common scenarios:

• Initial executive notification
• Status update format
• Executive summary report
• Board briefing deck
• Customer notification letter
• Regulatory filing template

References

• NIST SP 800-61: Computer Security Incident Handling Guide
• CISA Incident Communication: cisa.gov/incident-response
• FTC Data Breach Response Guide: ftc.gov
• SEC Cybersecurity Disclosure Rules