================================================================================ INCIDENT RESPONSE COMMUNICATION TEMPLATES Version : 1.0 Usage : Fill in all [BRACKETED] fields with incident-specific details. Incident : IR-2026-0409-007 (Operation Shadow Harvest) ================================================================================ ================================================================================ TEMPLATE 1: INITIAL NOTIFICATION TO EXECUTIVE MANAGEMENT ================================================================================ TO: [EXECUTIVE DISTRIBUTION LIST — CEO, CTO, CFO, CISO, General Counsel] FROM: [IR LEAD NAME], Incident Response Team DATE: [DATE AND TIME] SUBJECT: SECURITY INCIDENT — Initial Notification — Severity: [CRITICAL/HIGH] PRIORITY: URGENT EXECUTIVE SUMMARY -------------------------------------------------------------------------------- At [TIME OF DETECTION] on [DATE], our security operations team detected [BRIEF DESCRIPTION OF INCIDENT — e.g., "unauthorized access to internal systems and evidence of data exfiltration"]. Current Status: [ACTIVE RESPONSE / CONTAINED / UNDER INVESTIGATION] WHAT WE KNOW -------------------------------------------------------------------------------- - Initial detection occurred via [DETECTION SOURCE — e.g., "IDS alert, EDR detection, user report"] - [NUMBER] systems have been confirmed compromised - The attacker [BRIEF ATTACK NARRATIVE — e.g., "gained initial access via compromised SSH credentials, moved laterally to database and domain controller, and exfiltrated approximately X records"] - Data potentially affected: [TYPE OF DATA — e.g., "customer PII including names and Social Security numbers"] - Estimated number of affected records: [NUMBER OR RANGE] WHAT WE ARE DOING -------------------------------------------------------------------------------- 1. [CONTAINMENT ACTION — e.g., "Compromised systems have been isolated from the network"] 2. [INVESTIGATION STATUS — e.g., "Forensic analysis is underway on all affected hosts"] 3. [NOTIFICATION STATUS — e.g., "Legal counsel has been engaged to assess regulatory notification requirements"] 4. [RECOVERY PLAN — e.g., "Recovery operations will begin once eradication is confirmed complete"] BUSINESS IMPACT -------------------------------------------------------------------------------- - Services affected: [LIST AFFECTED SERVICES AND ESTIMATED DOWNTIME] - Customer impact: [DESCRIPTION — e.g., "Customer portal is offline during investigation"] - Financial exposure: [PRELIMINARY ESTIMATE IF AVAILABLE, otherwise "Under assessment"] - Regulatory implications: [e.g., "Potential GDPR/CCPA notification requirement — legal is evaluating"] NEXT UPDATE -------------------------------------------------------------------------------- The next status update will be provided at [TIME] or sooner if the situation changes materially. DECISION REQUIRED -------------------------------------------------------------------------------- [LIST ANY DECISIONS NEEDED FROM EXECUTIVES — e.g., "Authorization to engage external forensics firm (estimated cost: $X)", "Approval to notify affected customers", "Decision on law enforcement engagement"] Respectfully, [IR LEAD NAME] [TITLE] [CONTACT — PHONE AND SECURE EMAIL] ================================================================================ TEMPLATE 2: TECHNICAL UPDATE TO INCIDENT RESPONSE TEAM ================================================================================ INCIDENT: IR-[INCIDENT-ID] UPDATE #: [NUMBER] TIME: [DATE AND TIME UTC] AUTHOR: [ANALYST NAME] CLASSIFICATION: TLP:[WHITE/GREEN/AMBER/RED] CURRENT PHASE: [DETECTION / CONTAINMENT / ERADICATION / RECOVERY] STATUS SINCE LAST UPDATE -------------------------------------------------------------------------------- [Bullet-point summary of actions taken and findings since previous update] - [ACTION/FINDING 1] - [ACTION/FINDING 2] - [ACTION/FINDING 3] AFFECTED SYSTEMS UPDATE -------------------------------------------------------------------------------- | Hostname | IP | Status | Containment | Last Action | |------------- |------------- |---------- |------------ |------------------- | | [HOSTNAME] | [IP] | [STATUS] | [STATUS] | [LAST ACTION] | | [HOSTNAME] | [IP] | [STATUS] | [STATUS] | [LAST ACTION] | NEW IOCS IDENTIFIED -------------------------------------------------------------------------------- | Type | Value | Status | Context | |------- |--------------------------- |---------- |-------------------------- | | [TYPE] | [VALUE] | [STATUS] | [CONTEXT] | ATTACK TIMELINE UPDATE -------------------------------------------------------------------------------- | Time (UTC) | Source | Event | |-------------- |-------- |------------------------------------------------- | | [TIMESTAMP] | [SRC] | [DESCRIPTION] | IMMEDIATE ACTION ITEMS -------------------------------------------------------------------------------- [ ] [TASK 1 — assigned to ANALYST NAME — due TIME] [ ] [TASK 2 — assigned to ANALYST NAME — due TIME] [ ] [TASK 3 — assigned to ANALYST NAME — due TIME] BLOCKERS / ESCALATIONS NEEDED -------------------------------------------------------------------------------- - [BLOCKER 1 — e.g., "Need authorization to image DC-01 (will cause 15-minute AD outage)"] - [ESCALATION 1 — e.g., "External threat intel vendor has not responded to IOC enrichment request"] NEXT STEPS -------------------------------------------------------------------------------- 1. [PLANNED ACTION 1] 2. [PLANNED ACTION 2] 3. [PLANNED ACTION 3] Next update scheduled: [TIME UTC] ================================================================================ TEMPLATE 3: CUSTOMER NOTIFICATION DRAFT ================================================================================ NOTE: This template must be reviewed and approved by Legal and PR/Communications before distribution. Do not send without written authorization. -------------------------------------------------------------------------------- Dear [CUSTOMER NAME / "Valued Customer"], We are writing to inform you of a security incident that may affect your personal information. WHAT HAPPENED -------------------------------------------------------------------------------- On [DATE], [COMPANY NAME] detected unauthorized access to [DESCRIPTION OF AFFECTED SYSTEM — e.g., "a database containing customer account information"]. We immediately launched an investigation with the assistance of [EXTERNAL FORENSICS FIRM, if applicable] and took steps to contain the incident. WHAT INFORMATION WAS INVOLVED -------------------------------------------------------------------------------- Based on our investigation, the following types of information may have been accessed: - [DATA TYPE 1 — e.g., "Full name"] - [DATA TYPE 2 — e.g., "Email address"] - [DATA TYPE 3 — e.g., "Social Security number"] - [DATA TYPE 4 — e.g., "Account number"] [IF APPLICABLE: "We have no evidence that [SPECIFIC DATA TYPE — e.g., 'payment card numbers or passwords'] were accessed."] WHAT WE ARE DOING -------------------------------------------------------------------------------- Upon discovering this incident, we immediately: - [ACTION 1 — e.g., "Isolated affected systems to prevent further unauthorized access"] - [ACTION 2 — e.g., "Engaged a leading cybersecurity firm to conduct a thorough forensic investigation"] - [ACTION 3 — e.g., "Notified law enforcement authorities"] - [ACTION 4 — e.g., "Implemented additional security controls to prevent recurrence"] WHAT YOU CAN DO -------------------------------------------------------------------------------- We recommend that you take the following precautionary steps: 1. Monitor your financial accounts and credit reports for any suspicious activity. 2. [IF SSN INVOLVED: "We are providing complimentary credit monitoring and identity theft protection services through [PROVIDER] for [DURATION]. To enroll, visit [URL] or call [PHONE NUMBER] by [DEADLINE]."] 3. Consider placing a fraud alert or credit freeze with the three major credit bureaus: - Equifax: 1-800-XXX-XXXX / www.equifax.com - Experian: 1-800-XXX-XXXX / www.experian.com - TransUnion: 1-800-XXX-XXXX / www.transunion.com 4. Be cautious of unsolicited communications asking for personal information. FOR MORE INFORMATION -------------------------------------------------------------------------------- If you have questions, please contact our dedicated incident response line: Phone: [DEDICATED PHONE NUMBER] Email: [DEDICATED EMAIL ADDRESS] Hours: [OPERATING HOURS] Web: [INCIDENT RESPONSE FAQ PAGE URL] We sincerely regret any concern or inconvenience this may cause and remain committed to protecting your information. Sincerely, [EXECUTIVE NAME] [TITLE — e.g., "Chief Executive Officer"] [COMPANY NAME] ================================================================================ TEMPLATE 4: LAW ENFORCEMENT REPORTING ================================================================================ TO: [FBI Cyber Division / IC3 / Local Field Office / CISA] FROM: [COMPANY NAME], [CONTACT NAME AND TITLE] DATE: [DATE] SUBJECT: Cybersecurity Incident Report — [COMPANY NAME] REPORTING ORGANIZATION -------------------------------------------------------------------------------- Company Name : [COMPANY NAME] Address : [ADDRESS] Industry : [INDUSTRY SECTOR] Point of Contact: [NAME] Title : [TITLE] Phone : [PHONE] Email : [SECURE EMAIL] INCIDENT SUMMARY -------------------------------------------------------------------------------- Incident ID : [INTERNAL INCIDENT ID] Date Detected : [DATE AND TIME] Date Reported : [DATE AND TIME] Incident Type : [e.g., "Network Intrusion, Data Exfiltration, Ransomware Staging"] Severity : [CRITICAL / HIGH / MEDIUM / LOW] Ongoing : [YES / NO] DESCRIPTION OF INCIDENT -------------------------------------------------------------------------------- [DETAILED NARRATIVE — Include timeline, attack vector, systems affected, data compromised, and attacker TTPs. Be factual and specific.] [PARAGRAPH 1: How the incident was detected and initial findings] [PARAGRAPH 2: Scope of compromise — systems, data, users affected] [PARAGRAPH 3: Actions taken by incident response team] INDICATORS OF COMPROMISE -------------------------------------------------------------------------------- [Attach or embed IOC list. Include IP addresses, domains, file hashes, email addresses, and any other technical indicators.] See attached: IOC_Report_IR-[INCIDENT-ID].txt ESTIMATED IMPACT -------------------------------------------------------------------------------- Records affected : [NUMBER] Data types exposed : [LIST] Financial impact : [ESTIMATE OR "Under assessment"] Systems compromised : [NUMBER AND TYPES] Business disruption : [DESCRIPTION] PRIOR RELATED ACTIVITY -------------------------------------------------------------------------------- [Any prior incidents, threat intelligence, or suspicious activity that may be related. If none: "No prior related activity identified."] ASSISTANCE REQUESTED -------------------------------------------------------------------------------- [Specify what you are requesting — e.g., "We are reporting this incident for awareness and request any available threat intelligence on the IOCs listed above. We are willing to cooperate fully with any investigation."] ATTACHMENTS -------------------------------------------------------------------------------- [ ] IOC list (TLP:AMBER) [ ] Incident timeline [ ] Forensic summary report [ ] Network diagrams (sanitized) [ ] Malware samples (available upon request via secure transfer) ================================================================================ TEMPLATE 5: POST-INCIDENT REPORT OUTLINE ================================================================================ DOCUMENT: Post-Incident Report INCIDENT: IR-[INCIDENT-ID] AUTHOR: [IR LEAD NAME] DATE: [DATE — within 5 business days of incident closure] CLASSIFICATION: [INTERNAL / CONFIDENTIAL] -------------------------------------------------------------------------------- 1. EXECUTIVE SUMMARY -------------------------------------------------------------------------------- [2-3 paragraph overview covering: what happened, impact, resolution, and key recommendations. Written for non-technical leadership.] - Incident type: [TYPE] - Duration: [FIRST COMPROMISE] to [FULL RECOVERY] - Systems affected: [NUMBER] - Data impact: [SUMMARY] - Root cause: [ONE SENTENCE] 2. INCIDENT TIMELINE -------------------------------------------------------------------------------- [Complete chronological timeline from first indicator to incident closure] | Date/Time (UTC) | Phase | Event | |---------------- |------------- |----------------------------------- | | [TIMESTAMP] | [PHASE] | [DESCRIPTION] | 3. ROOT CAUSE ANALYSIS -------------------------------------------------------------------------------- 3.1 Initial Access Vector [How did the attacker get in? What vulnerability or weakness was exploited?] 3.2 Contributing Factors [What environmental conditions allowed the attack to succeed? e.g., unpatched systems, weak credentials, insufficient monitoring] 3.3 Attack Path [Step-by-step description of how the attacker moved through the environment, mapped to MITRE ATT&CK techniques where applicable] 4. IMPACT ASSESSMENT -------------------------------------------------------------------------------- 4.1 Data Impact - Records affected: [NUMBER] - Data types: [LIST] - Regulatory implications: [ASSESSMENT] 4.2 Operational Impact - Systems offline: [LIST AND DURATION] - Services degraded: [LIST AND DURATION] - Estimated cost: [FINANCIAL IMPACT] 4.3 Reputational Impact - [ASSESSMENT] 5. RESPONSE EVALUATION -------------------------------------------------------------------------------- 5.1 What Worked Well - [ITEM 1] - [ITEM 2] 5.2 What Could Be Improved - [ITEM 1 — include specific recommendation] - [ITEM 2 — include specific recommendation] 5.3 Response Metrics | Metric | Value | Target | Met? | |-------------------- |-------------- |-------------- |----- | | MTTD | [VALUE] | < 24 hours | [Y/N]| | MTTR | [VALUE] | < 72 hours | [Y/N]| | Containment time | [VALUE] | < 1 hour | [Y/N]| 6. RECOMMENDATIONS -------------------------------------------------------------------------------- [Numbered list of specific, actionable recommendations with owners and target completion dates] | # | Recommendation | Owner | Due Date | |-- |---------------------------------------- |--------- |----------- | | 1 | [RECOMMENDATION] | [OWNER] | [DATE] | | 2 | [RECOMMENDATION] | [OWNER] | [DATE] | 7. APPENDICES -------------------------------------------------------------------------------- A. Complete IOC List B. Affected Systems Inventory C. Forensic Evidence Chain of Custody D. Communication Log E. Regulatory Notifications Sent ================================================================================ END OF COMMUNICATION TEMPLATES ================================================================================