Client executive briefing outline during IR

Overview

Executives need status, business impact, next 24–48h decisions, and confidence—not raw IOC lists.

Slide structure (15 min)

1. What we know (facts) vs what we infer (hypotheses)—clearly labeled.
2. Current impact: systems down, data classes potentially touched, customer-facing risk.
3. Actions taken: containment, evidence, law enforcement/insurer notifications if cleared.
4. Gaps: logging, backup integrity, unknown scope areas—no sugarcoating material uncertainty.
5. Decisions needed: ransom stance, comms to customers, overtime budget, vendor surge.

Tone

Calm, precise; avoid blame in first meetings—focus on resolution.

Cadence

Twice daily early crisis; taper as stable; written follow-up email summarizing alignment.

PR/Legal

Coordinate who speaks externally; no ad-hoc posts; holding statements pre-cleared.

Metrics for leadership

MTTC (time to contain), customers notified status, backup restore ETA—even if ranges.

Outcome

Signed decision log on contentious items (pay/not pay, disclosure timing) after counsel review.