Tell the right people what they need to decide

Incident declaration activates the organisation’s response structure according to its policy and assessment criteria. Record the trigger, known scope, observed impact, provisional severity, incident owner, and declaration time. You do not need a complete explanation of every event before escalating a credible urgent threat. You do need to make the uncertainty explicit and distinguish an investigated alert from a formally declared incident.

Escalation routes depend on the authority or capability required next. A service interruption may need a business owner’s decision; suspected exposure may require a specialist adviser; a supplier dependency may require vendor coordination. Specify the requested decision and when it is needed. A message sent to a large group without a responsible recipient creates visibility, but it does not establish that anyone accepted the task.

An executive summary should explain what is known, the service or business impact, current containment, significant uncertainty, and the decision or support requested. A technical update also needs actionable evidence references and task details. Keep both aligned to one controlled incident record. State the time of the update and the next planned communication so that an old assessment is not mistaken for the current position.

Identify legal advisers, public relations, customers, regulators, law enforcement, suppliers, and internal teams as applicable to the situation and approved plan. Different audiences need different details and approval paths. Route external statements and notification assessments through authorised owners and appropriate advisers. Do not invent a reporting deadline, claim a legal conclusion, or release sensitive evidence simply because a stakeholder requests an immediate answer.

Operational security applies to incident communications. The account, mailbox, or collaboration platform involved in the incident may also expose response discussions. Use the approved alternative channel when trust in the normal one is uncertain, and verify participant identity before sharing sensitive details. Limit distribution of credentials, indicators tied to sensitive infrastructure, personal information, and evidence locations according to actual need.

Keep a concise decision log alongside the technical timeline. Record who approved an action, the evidence considered, alternatives or trade-offs, and the follow-up check. Use controlled copies and a clear version or update time for briefings. Correct an earlier statement visibly when new facts change it, rather than quietly editing away uncertainty. Consistent, traceable updates help teams coordinate even when the assessment must evolve.