Incident summary email to stakeholders template
Overview
After phishing containment, executives need concise narrative—not raw logs.
Sections
What happened; timeline; scope (mailboxes, funds at risk); actions taken; current status; next steps; support contact.
Tone
Factual, no unfounded blame; avoid technical acronyms without gloss.
Approvals
Legal reviews external-facing variant.
Archive
Save final PDF with incident ID.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...