Writing incident reports for executives

Write the incident report leadership reads: a one-page summary, a timeline that holds up, impact in business terms, root cause and contributing factors in blameless language, MTTD and MTTR computed honestly, actions with owners and dates, and what never to put in writing.

🔒 PROLesson·17 min read·Intermediate → Advanced

incident reportpost-incident reviewexecutive communicationMTTD MTTRblameless postmortemroot cause analysis

01What executives need from a report

✓What you will learn

Structure a report around the decisions executives need to make
Build a timeline and express impact in business terms
Separate root cause from contributing factors in blameless language
Compute MTTD and MTTR honestly and write actions with owners, and know what to leave out

An executive reads an incident report to answer four questions: what happened, how bad is it, is it over, and what do you need from me? Everything else is supporting evidence. Put the answers on the first page in plain language and push technical detail into appendices that engineers and auditors can use.

Section	Contents	Length
Summary	Two or three sentences: what happened, impact, current status	One paragraph
Impact	Customers, money, downtime, data, regulatory exposure, in numbers	Short table
Timeline	Key events in UTC with detection, containment and recovery marked	Ten to fifteen rows
Root cause and contributing factors	Why it was possible, not who clicked	Half a page
Response metrics	Time to detect, contain and recover against targets	A few lines
Actions	What will change, owner, due date, status	Table
Decisions and asks	Budget, risk acceptance, policy changes needed from leadership	Bullets
Appendices	Technical timeline, IOCs, scope evidence	As long as needed, not for executives

▭On the whiteboard · The first page in one look4 points

summary

On 13 Nov an attacker took over a finance mailbox and redirected one supplier payment of £48,500. Contained the next morning; £31,000 recovered so far.

impact

One payment, 1 mailbox, 37 emails read, no customer data, no system outage.

status

Contained; monitoring continues; recovery of the remaining £17,500 in progress with the bank.

asks

Approve phishing-resistant MFA for finance and execs (£14k), and a mandatory call-back rule for bank detail changes.

This is an advanced module

Incident handling & reporting is part of the Pro pass. 4 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access code See Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.