DON’T PANIC!: An IR Guide to Communicating with Execs

Three security leaders from the financial sector open by framing the problem: incident responders must explain technical events to executives and other non-specialists who need to make business, risk, regulatory or insurance decisions. They note that the same approach suits any emergency communication, from fire departments to schools.

The core guidance is to lead with business impact, such as customer, financial and reputational effects, and keep reports short, ideally a few paragraphs. Writers should stick to known facts, use qualifiers when something is uncertain, avoid speculation and emotional language, and answer likely questions before they are asked. A useful structure starts with a bottom-line-up-front summary, then the response actions underway, with lessons learned added in later updates and a formal root cause report kept separately. Three before-and-after rewrites cover a ransomware intrusion, a zero-day in a widely used product, and a misconfigured device tied to a former employee's lingering access. The revised versions replace acronyms and framework references with plain descriptions and concrete counts, and they remove alarmist claims while noting the actions being taken.

The closing advice covers timing and review. Send an early update even when information is thin, tell executives when the next one will arrive, and account for regulatory or contractual deadlines. Some teams assign a separate person to handle communications so responders can keep working. Finally, have someone outside security with editing skills review drafts, and treat feedback as a way to improve.