================================================================================
  INCIDENT RESPONSE COMMUNICATION TEMPLATES
  Version  : 1.0
  Usage    : Fill in all [BRACKETED] fields with incident-specific details.
  Incident : IR-2026-0409-007 (Operation Shadow Harvest)
================================================================================


================================================================================
TEMPLATE 1: INITIAL NOTIFICATION TO EXECUTIVE MANAGEMENT
================================================================================

TO:       [EXECUTIVE DISTRIBUTION LIST — CEO, CTO, CFO, CISO, General Counsel]
FROM:     [IR LEAD NAME], Incident Response Team
DATE:     [DATE AND TIME]
SUBJECT:  SECURITY INCIDENT — Initial Notification — Severity: [CRITICAL/HIGH]
PRIORITY: URGENT

EXECUTIVE SUMMARY
--------------------------------------------------------------------------------
At [TIME OF DETECTION] on [DATE], our security operations team detected
[BRIEF DESCRIPTION OF INCIDENT — e.g., "unauthorized access to internal
systems and evidence of data exfiltration"].

Current Status: [ACTIVE RESPONSE / CONTAINED / UNDER INVESTIGATION]

WHAT WE KNOW
--------------------------------------------------------------------------------
- Initial detection occurred via [DETECTION SOURCE — e.g., "IDS alert,
  EDR detection, user report"]
- [NUMBER] systems have been confirmed compromised
- The attacker [BRIEF ATTACK NARRATIVE — e.g., "gained initial access via
  compromised SSH credentials, moved laterally to database and domain
  controller, and exfiltrated approximately X records"]
- Data potentially affected: [TYPE OF DATA — e.g., "customer PII including
  names and Social Security numbers"]
- Estimated number of affected records: [NUMBER OR RANGE]

WHAT WE ARE DOING
--------------------------------------------------------------------------------
1. [CONTAINMENT ACTION — e.g., "Compromised systems have been isolated
   from the network"]
2. [INVESTIGATION STATUS — e.g., "Forensic analysis is underway on all
   affected hosts"]
3. [NOTIFICATION STATUS — e.g., "Legal counsel has been engaged to assess
   regulatory notification requirements"]
4. [RECOVERY PLAN — e.g., "Recovery operations will begin once eradication
   is confirmed complete"]

BUSINESS IMPACT
--------------------------------------------------------------------------------
- Services affected: [LIST AFFECTED SERVICES AND ESTIMATED DOWNTIME]
- Customer impact: [DESCRIPTION — e.g., "Customer portal is offline during
  investigation"]
- Financial exposure: [PRELIMINARY ESTIMATE IF AVAILABLE, otherwise "Under
  assessment"]
- Regulatory implications: [e.g., "Potential GDPR/CCPA notification
  requirement — legal is evaluating"]

NEXT UPDATE
--------------------------------------------------------------------------------
The next status update will be provided at [TIME] or sooner if the
situation changes materially.

DECISION REQUIRED
--------------------------------------------------------------------------------
[LIST ANY DECISIONS NEEDED FROM EXECUTIVES — e.g., "Authorization to engage
external forensics firm (estimated cost: $X)", "Approval to notify affected
customers", "Decision on law enforcement engagement"]

Respectfully,
[IR LEAD NAME]
[TITLE]
[CONTACT — PHONE AND SECURE EMAIL]


================================================================================
TEMPLATE 2: TECHNICAL UPDATE TO INCIDENT RESPONSE TEAM
================================================================================

INCIDENT: IR-[INCIDENT-ID]
UPDATE #: [NUMBER]
TIME:     [DATE AND TIME UTC]
AUTHOR:   [ANALYST NAME]
CLASSIFICATION: TLP:[WHITE/GREEN/AMBER/RED]

CURRENT PHASE: [DETECTION / CONTAINMENT / ERADICATION / RECOVERY]

STATUS SINCE LAST UPDATE
--------------------------------------------------------------------------------
[Bullet-point summary of actions taken and findings since previous update]

- [ACTION/FINDING 1]
- [ACTION/FINDING 2]
- [ACTION/FINDING 3]

AFFECTED SYSTEMS UPDATE
--------------------------------------------------------------------------------
| Hostname     | IP           | Status    | Containment | Last Action        |
|------------- |------------- |---------- |------------ |------------------- |
| [HOSTNAME]   | [IP]         | [STATUS]  | [STATUS]    | [LAST ACTION]      |
| [HOSTNAME]   | [IP]         | [STATUS]  | [STATUS]    | [LAST ACTION]      |

NEW IOCS IDENTIFIED
--------------------------------------------------------------------------------
| Type   | Value                      | Status    | Context                   |
|------- |--------------------------- |---------- |-------------------------- |
| [TYPE] | [VALUE]                    | [STATUS]  | [CONTEXT]                 |

ATTACK TIMELINE UPDATE
--------------------------------------------------------------------------------
| Time (UTC)    | Source  | Event                                            |
|-------------- |-------- |------------------------------------------------- |
| [TIMESTAMP]   | [SRC]   | [DESCRIPTION]                                    |

IMMEDIATE ACTION ITEMS
--------------------------------------------------------------------------------
[ ] [TASK 1 — assigned to ANALYST NAME — due TIME]
[ ] [TASK 2 — assigned to ANALYST NAME — due TIME]
[ ] [TASK 3 — assigned to ANALYST NAME — due TIME]

BLOCKERS / ESCALATIONS NEEDED
--------------------------------------------------------------------------------
- [BLOCKER 1 — e.g., "Need authorization to image DC-01 (will cause
  15-minute AD outage)"]
- [ESCALATION 1 — e.g., "External threat intel vendor has not responded
  to IOC enrichment request"]

NEXT STEPS
--------------------------------------------------------------------------------
1. [PLANNED ACTION 1]
2. [PLANNED ACTION 2]
3. [PLANNED ACTION 3]

Next update scheduled: [TIME UTC]


================================================================================
TEMPLATE 3: CUSTOMER NOTIFICATION DRAFT
================================================================================

NOTE: This template must be reviewed and approved by Legal and PR/Communications
before distribution. Do not send without written authorization.

--------------------------------------------------------------------------------

Dear [CUSTOMER NAME / "Valued Customer"],

We are writing to inform you of a security incident that may affect your
personal information.

WHAT HAPPENED
--------------------------------------------------------------------------------
On [DATE], [COMPANY NAME] detected unauthorized access to [DESCRIPTION OF
AFFECTED SYSTEM — e.g., "a database containing customer account information"].
We immediately launched an investigation with the assistance of [EXTERNAL
FORENSICS FIRM, if applicable] and took steps to contain the incident.

WHAT INFORMATION WAS INVOLVED
--------------------------------------------------------------------------------
Based on our investigation, the following types of information may have been
accessed:

- [DATA TYPE 1 — e.g., "Full name"]
- [DATA TYPE 2 — e.g., "Email address"]
- [DATA TYPE 3 — e.g., "Social Security number"]
- [DATA TYPE 4 — e.g., "Account number"]

[IF APPLICABLE: "We have no evidence that [SPECIFIC DATA TYPE — e.g.,
'payment card numbers or passwords'] were accessed."]

WHAT WE ARE DOING
--------------------------------------------------------------------------------
Upon discovering this incident, we immediately:
- [ACTION 1 — e.g., "Isolated affected systems to prevent further
  unauthorized access"]
- [ACTION 2 — e.g., "Engaged a leading cybersecurity firm to conduct a
  thorough forensic investigation"]
- [ACTION 3 — e.g., "Notified law enforcement authorities"]
- [ACTION 4 — e.g., "Implemented additional security controls to prevent
  recurrence"]

WHAT YOU CAN DO
--------------------------------------------------------------------------------
We recommend that you take the following precautionary steps:

1. Monitor your financial accounts and credit reports for any suspicious
   activity.
2. [IF SSN INVOLVED: "We are providing complimentary credit monitoring and
   identity theft protection services through [PROVIDER] for [DURATION].
   To enroll, visit [URL] or call [PHONE NUMBER] by [DEADLINE]."]
3. Consider placing a fraud alert or credit freeze with the three major
   credit bureaus:
   - Equifax: 1-800-XXX-XXXX / www.equifax.com
   - Experian: 1-800-XXX-XXXX / www.experian.com
   - TransUnion: 1-800-XXX-XXXX / www.transunion.com
4. Be cautious of unsolicited communications asking for personal information.

FOR MORE INFORMATION
--------------------------------------------------------------------------------
If you have questions, please contact our dedicated incident response line:

  Phone: [DEDICATED PHONE NUMBER]
  Email: [DEDICATED EMAIL ADDRESS]
  Hours: [OPERATING HOURS]
  Web:   [INCIDENT RESPONSE FAQ PAGE URL]

We sincerely regret any concern or inconvenience this may cause and remain
committed to protecting your information.

Sincerely,

[EXECUTIVE NAME]
[TITLE — e.g., "Chief Executive Officer"]
[COMPANY NAME]


================================================================================
TEMPLATE 4: LAW ENFORCEMENT REPORTING
================================================================================

TO:       [FBI Cyber Division / IC3 / Local Field Office / CISA]
FROM:     [COMPANY NAME], [CONTACT NAME AND TITLE]
DATE:     [DATE]
SUBJECT:  Cybersecurity Incident Report — [COMPANY NAME]

REPORTING ORGANIZATION
--------------------------------------------------------------------------------
  Company Name    : [COMPANY NAME]
  Address         : [ADDRESS]
  Industry        : [INDUSTRY SECTOR]
  Point of Contact: [NAME]
  Title           : [TITLE]
  Phone           : [PHONE]
  Email           : [SECURE EMAIL]

INCIDENT SUMMARY
--------------------------------------------------------------------------------
  Incident ID     : [INTERNAL INCIDENT ID]
  Date Detected   : [DATE AND TIME]
  Date Reported   : [DATE AND TIME]
  Incident Type   : [e.g., "Network Intrusion, Data Exfiltration,
                     Ransomware Staging"]
  Severity        : [CRITICAL / HIGH / MEDIUM / LOW]
  Ongoing         : [YES / NO]

DESCRIPTION OF INCIDENT
--------------------------------------------------------------------------------
[DETAILED NARRATIVE — Include timeline, attack vector, systems affected,
data compromised, and attacker TTPs. Be factual and specific.]

[PARAGRAPH 1: How the incident was detected and initial findings]

[PARAGRAPH 2: Scope of compromise — systems, data, users affected]

[PARAGRAPH 3: Actions taken by incident response team]

INDICATORS OF COMPROMISE
--------------------------------------------------------------------------------
[Attach or embed IOC list. Include IP addresses, domains, file hashes,
email addresses, and any other technical indicators.]

  See attached: IOC_Report_IR-[INCIDENT-ID].txt

ESTIMATED IMPACT
--------------------------------------------------------------------------------
  Records affected     : [NUMBER]
  Data types exposed   : [LIST]
  Financial impact     : [ESTIMATE OR "Under assessment"]
  Systems compromised  : [NUMBER AND TYPES]
  Business disruption  : [DESCRIPTION]

PRIOR RELATED ACTIVITY
--------------------------------------------------------------------------------
[Any prior incidents, threat intelligence, or suspicious activity that may
be related. If none: "No prior related activity identified."]

ASSISTANCE REQUESTED
--------------------------------------------------------------------------------
[Specify what you are requesting — e.g., "We are reporting this incident
for awareness and request any available threat intelligence on the IOCs
listed above. We are willing to cooperate fully with any investigation."]

ATTACHMENTS
--------------------------------------------------------------------------------
[ ] IOC list (TLP:AMBER)
[ ] Incident timeline
[ ] Forensic summary report
[ ] Network diagrams (sanitized)
[ ] Malware samples (available upon request via secure transfer)


================================================================================
TEMPLATE 5: POST-INCIDENT REPORT OUTLINE
================================================================================

DOCUMENT: Post-Incident Report
INCIDENT: IR-[INCIDENT-ID]
AUTHOR:   [IR LEAD NAME]
DATE:     [DATE — within 5 business days of incident closure]
CLASSIFICATION: [INTERNAL / CONFIDENTIAL]

--------------------------------------------------------------------------------

1. EXECUTIVE SUMMARY
--------------------------------------------------------------------------------
   [2-3 paragraph overview covering: what happened, impact, resolution,
   and key recommendations. Written for non-technical leadership.]

   - Incident type: [TYPE]
   - Duration: [FIRST COMPROMISE] to [FULL RECOVERY]
   - Systems affected: [NUMBER]
   - Data impact: [SUMMARY]
   - Root cause: [ONE SENTENCE]

2. INCIDENT TIMELINE
--------------------------------------------------------------------------------
   [Complete chronological timeline from first indicator to incident closure]

   | Date/Time (UTC) | Phase        | Event                              |
   |---------------- |------------- |----------------------------------- |
   | [TIMESTAMP]     | [PHASE]      | [DESCRIPTION]                      |

3. ROOT CAUSE ANALYSIS
--------------------------------------------------------------------------------
   3.1 Initial Access Vector
       [How did the attacker get in? What vulnerability or weakness was
       exploited?]

   3.2 Contributing Factors
       [What environmental conditions allowed the attack to succeed?
       e.g., unpatched systems, weak credentials, insufficient monitoring]

   3.3 Attack Path
       [Step-by-step description of how the attacker moved through the
       environment, mapped to MITRE ATT&CK techniques where applicable]

4. IMPACT ASSESSMENT
--------------------------------------------------------------------------------
   4.1 Data Impact
       - Records affected: [NUMBER]
       - Data types: [LIST]
       - Regulatory implications: [ASSESSMENT]

   4.2 Operational Impact
       - Systems offline: [LIST AND DURATION]
       - Services degraded: [LIST AND DURATION]
       - Estimated cost: [FINANCIAL IMPACT]

   4.3 Reputational Impact
       - [ASSESSMENT]

5. RESPONSE EVALUATION
--------------------------------------------------------------------------------
   5.1 What Worked Well
       - [ITEM 1]
       - [ITEM 2]

   5.2 What Could Be Improved
       - [ITEM 1 — include specific recommendation]
       - [ITEM 2 — include specific recommendation]

   5.3 Response Metrics
       | Metric              | Value         | Target        | Met? |
       |-------------------- |-------------- |-------------- |----- |
       | MTTD                | [VALUE]       | < 24 hours    | [Y/N]|
       | MTTR                | [VALUE]       | < 72 hours    | [Y/N]|
       | Containment time    | [VALUE]       | < 1 hour      | [Y/N]|

6. RECOMMENDATIONS
--------------------------------------------------------------------------------
   [Numbered list of specific, actionable recommendations with owners
   and target completion dates]

   | # | Recommendation                          | Owner    | Due Date   |
   |-- |---------------------------------------- |--------- |----------- |
   | 1 | [RECOMMENDATION]                        | [OWNER]  | [DATE]     |
   | 2 | [RECOMMENDATION]                        | [OWNER]  | [DATE]     |

7. APPENDICES
--------------------------------------------------------------------------------
   A. Complete IOC List
   B. Affected Systems Inventory
   C. Forensic Evidence Chain of Custody
   D. Communication Log
   E. Regulatory Notifications Sent


================================================================================
  END OF COMMUNICATION TEMPLATES
================================================================================
