Start: Tell Us What Happened — in your words

• In a few sentences, how would you describe the incident as you understand it right now?
• When did you first notice anything unusual or receive the first alert? Options: Within the last hour, 1–6 hours ago, 6–24 hours ago, 1–3 days ago, More than 3 days ago, Unsure
• Who initially reported or detected the problem (role/team and channel)? Options: SOC alert/monitoring, End user report, IT/endpoint alert, Third-party vendor, Executive/board, Other
• What immediate symptoms are you seeing (e.g., encryption notice, service outages, unusual outbound traffic)? Please be specific.
• Is an internal team actively responding right now? Options: Dedicated security/IR team on incident, IT/operations only, No formal response team yet, Using external vendor already
• Which executives or business owners are currently briefed (select all that apply)? Options: CISO/Security Lead, General Counsel, CEO/President, CFO, Business Unit Head, Board or Board Chair, Not yet briefed

If This Were a Movie, Where's the Smoke?

• If an attacker still has a foothold, what single asset or system would you be most afraid they'd control next? Options: Active Directory / Domain Controllers, Email/Microsoft 365/Exchange, Backups or backup infrastructure, Customer database/PII, Payment/ERP systems, Production/cloud workloads, Source code/repos, Other
• Which systems or sites are already showing signs of compromise (list names, regions, or critical identifiers)?
• Which data types may be exposed or at risk (select all that apply)? Options: Personally Identifiable Information (PII), Protected Health Information (PHI), Payment Card Data (PCI), Intellectual property / source code, Financial records, Employee data, Other / Unsure
• Have you observed any indicators of exfiltration or large outbound transfers? Options: Yes — confirmed exfiltration, Suspicious large transfers (possible exfiltration), No evidence yet, Not sure / need investigation
• Are there ransom or extortion messages, threats to publish data, or external claims tied to this incident? Options: Ransom/exfiltration demands present, Threat actors claiming responsibility publicly, No threats yet, Unsure
• Roughly, what is the hourly estimated business impact if the affected systems remain impaired? Options: Under $10k/hr, $10k–$50k/hr, $50k–$200k/hr, Over $200k/hr, Do not know / need help estimating

Who Holds the Keys — and Who Needs to Know?

• Who in your organization can immediately grant the access our team needs to deploy sensors and collect forensic data? Options: CISO or Security Leader, IT/Infrastructure Director, Cloud Admin (AWS/Azure/GCP), Network Admin, No single person identified, Legal must approve
• Please list the primary decision-makers and the best phone/email for urgent escalation (name, role, preferred contact).
• Are there legal, regulatory, or contractual constraints that would limit what we can collect or where we can run tools? Options: GDPR / EU data restrictions, Sector regulation (e.g., HIPAA, FINRA), Customer NDAs or contracts, Law enforcement involvement required, No constraints identified, Unsure — legal must confirm
• Is a cyber insurance carrier, panel firm, or outside counsel already engaged or expecting notification? Options: Insurer notified and managing, Insurer on standby (retainer), Outside counsel involved, Notified none yet, Unsure
• Have you notified or do you intend to notify law enforcement at this time? Options: Yes — already notified, Plan to notify immediately, Do not plan to notify, Undecided / need guidance

What Would a Containment Win Look Like — Fast?

• If we removed the attacker within the next 4 hours, what exact systems, processes, or data would you expect to be protected or restored to call it a success?
• Which systems absolutely must remain online during containment efforts (select all that apply)? Options: Customer-facing services, Payment/transaction systems, Critical production PLC/OT, Communication/email systems, Backups and disaster recovery systems, None — can be taken offline if needed
• Are there blackout windows, release freezes, or high-risk business periods in the next 72 hours we must avoid interrupting? Options: Yes — provide details below, No critical windows, Unsure / need calendar check
• Which containment actions are off-limits under any circumstance (e.g., disconnecting domain controllers, taking backups offline)? Options: Disconnecting domain controllers, Shutting down production clusters, Modifying immutable backups, Blocking external connectivity to business-critical partners, No hard restrictions, Other
• What is the maximum acceptable downtime for your top three critical systems (list system and acceptable downtime)?

What Evidence Do We Have — and What Might Disappear?

• If we delay collecting volatile data (memory, packet captures) by one shift, what evidence do you fear will be lost?
• Which telemetry sources are currently available and accessible to us (select all that apply)? Options: EDR (endpoint detection) — specify vendor below, SIEM / central logging, Network packet captures / taps, Cloud provider logs (AWS/Azure/GCP), Authentication logs (AD/AzureAD), Pre-staged forensic sensors present, None available
• If you selected EDR or SIEM, can you provide credentials or a read-only access path now? Options: Yes — credentials available immediately, Yes — requires approval, No — credentials unavailable, Unsure
• When were backups last performed, are they isolated/offline, and have they been validated recently? Options: Backups current and isolated, Backups current but online, Backups outdated or unvalidated, No backups available, Unsure
• Has any system been restarted, reimaged, or patched since the incident began that might alter forensic evidence? Options: Yes — list systems below, No, Unsure

How Have You Tried to Fix This — and What Worked?

• What single mitigation action you took felt most effective at slowing or stopping the activity?
• Which of the following containment/remediation steps have already been attempted (select all that apply)? Options: Isolated infected endpoints, Blocked IPs/domains, Reset privileged credentials, Applied emergency patches, Restored systems from backup, Engaged internal/external vendors, None
• Who executed those steps (internal security, IT ops, third-party) and at what times?
• Did any attempted actions unintentionally reduce visibility or complicate evidence collection? Options: Yes — please describe below, No, Unsure
• On a scale, how confident are you that current measures fully removed the adversary? Options: Not confident (attacker likely present), Somewhat confident, Confident attacker removed, Unsure / need forensic validation
• Have you preserved a timeline or incident log of actions taken, and can you share it with our team? Options: Yes — timeline available, Partial notes only, No log kept yet

What Would Success Look Like for You — Beyond 'Back Online'?

• When this is fully resolved, what outcome would make leadership say this was handled perfectly?
• Which deliverables are critical for your acceptance of the engagement (select all that apply)? Options: Detailed forensic report, IOC list and detection rules, Executive incident summary, Malware reverse engineering, Regulatory disclosure-ready documents, Chain-of-custody evidence package, Post-incident remediation roadmap
• Who must sign off on the final deliverables (roles/names)?
• Do you anticipate needing support for external communications, regulator notifications, or customer disclosure? Options: Yes — immediate PR/legal support needed, Yes — legal only, No external communications expected, Unsure / need guidance
• Are there KPIs or timelines (e.g., restore within X hours, report within Y days) by which the engagement will be judged?

Practical Constraints — What Could Slow Us Down?

• What single operational or policy limitation is most likely to push our response from hours to days? Options: No admin/root credentials available, Change control approvals required, Procurement/PO process for vendor engagement, Legal or compliance freeze, Dependence on third-party/cloud provider, Other
• Do existing contracts, procurement rules, or corporate policies require additional approvals before we engage or deploy tools? Options: Yes — list required approvers, No, Unsure
• Is there an active retainer or emergency access agreement that covers this work and surge capacity? Options: Active retainer covering immediate work, Retainer exists but limited scope, No retainer — emergency engagement required, Unsure
• Are there budget limitations or PO requirements that could delay our deployment? Options: Yes — PO required before any work, Budget approved for emergency spend, Budget uncertain / needs approval
• Are there other ongoing incidents or industry-wide waves that could strain responder availability and affect SLAs? Options: Yes — high global activity expected, No — capacity seems available, Unsure

Next Steps — Who Owns What in the First 8 Hours?

• If we proceed now, who will be the single empowered point of contact for decisions in the first 8 hours? Options: CISO/Security Lead, IT/Infrastructure Director, Designated Incident Commander (name below), Legal counsel (for approvals), Other
• What is the preferred urgent communication channel for minute-by-minute updates? Options: Phone call (direct), Secure chat (e.g., Signal/Teams), Email (urgent threads), Incident war room (video), Ticketing system only
• Are there time-zone constraints or specific hours when we are NOT permitted to act? Options: No constraints — 24/7 OK, Restricted to business hours (specify below), Night/weekend restrictions apply, Unsure — need calendar check
• Do we need an NDA, written access authorization, or a formal PO before we begin any collection or sensor deployment? Options: NDA/access authorization required, PO/contract required, No formal docs required to start, Unsure — legal to advise
• Would you like us to schedule an immediate 60-minute incident kickoff to align scope, access, and next steps? Options: Yes — schedule now, Yes — within next 4 hours, Not now — schedule later, No, handle via messages

• Current State & Consequence Alignment
• Forensic Sensor Evidence Walkthrough
• Threat‑Intelligence Graph Mapping
• Containment Playbook Options & Tradeoffs Workshop
• Execution & Validation Checklist Alignment

• Confirm legal and evidence-preservation actions required before/after containment.
• Tie Graph Goals to Current/Business Risk
• Map attacker infrastructure to observed artifacts and identify specific containment cut-points.
• Provide prioritized list of nodes (network, host, cloud) to block with estimated effectiveness.
• Agree on confidence levels and residual risk after each potential block.
• Obtain explicit customer validation that the proposed cut-points align with their operational constraints.
• Freeze the list of prioritized block/containment targets and produce a one-page recommended cut plan.
• Update detection rules and firewall/IDS signatures for the IOCs identified in the graph.
• Deliver a short threat actor profile and observed TTPs tied to the customer's artifacts.
• Recap Proven Attacker Paths & Critical Assets
• Select a containment playbook with explicit owner and authorization path.
• Agree on the business-impact tolerance and rollback triggers for the chosen approach.
• Define acceptance tests that must pass to consider the attacker eradicated.
• Introductions and Objective
• Customer to authorize selected containment playbook and name an approval authority.
• Operations to prepare targeted playbook runbooks, including communications templates for execs and regulators.
• Forensics to document chain-of-custody steps to be executed immediately prior to containment.
• Confirm Chosen Containment Plan & Owner
• Obtain explicit go/no-go authorization with named approver and execution start time.
• Lock the validation checklist and acceptance tests that will be used to close the containment phase.
• Ensure evidence preservation and chain-of-custody actions are assigned and scheduled.
• Agree on communications cadence and escalation paths during execution.
• Operator team to begin containment execution per approved playbook at the agreed start time.
• Forensics to capture initial preservation artifacts and upload to the secure evidence repository.
• Schedule the first post‑execution validation checkpoint and the executive summary delivery.
• Produce and agree a single-sentence Current State that everyone can reference during the experience.
• Surface concrete consequences (business, legal, operational) to create urgency for containment decisions.
• Define a single-sentence measurable Future State that the Solution Experience must prove.
• Confirm telemetry and access needed for live sensor and graph demonstrations.
• Customer to deliver a 1-page incident timeline and list of impacted assets and decision-makers (by X hours).
• Seller to draft and circulate the agreed Current State, Consequence summary, and Future State one-liners.
• Technical owner to verify sensor access/read-only endpoints required for the walkthrough.
• Force customer validation that the evidence maps to their observed issues.
• Recap Current State & Future State
• Prove attacker presence (or absence) with time-stamped forensic artifacts.
• Identify initial indicators of exfil activity and which channels show data transfer.
• Confirm sensor coverage is sufficient for next steps or list gaps requiring immediate remediation.
• Export and circulate a signed IOC list (IPs, domains, file hashes, process names) from today's walkthrough.
• Tag and preserve involved endpoints and disk images for chain-of-custody.
• If gaps found, schedule immediate targeted captures or sensor redeployments.
• Playbook A: Surgical Endpoint Containment
• One‑Sentence Current State
• Live Graph Reconstruction
• Execution Timeline & SLA Windows
• Sensor Topology & Data Sources
• Evidence Preservation & Chain-of-Custody
• Quantify Consequence
• Playbook B: Network Segment Isolation (targeted)
• Identify Exfil Channels & Pivot Nodes
• Packet Capture Evidence
• Define One‑Sentence Future State
• Memory & Process Artifacts
• Playbook C: Aggressive Network Cut / Quarantine
• Confidence & Attribution Scoring
• Validation Checklist: 'Attacker Eradicated' Criteria
• Endpoint Telemetry Correlation
• Impact & Legal/Regulatory Considerations
• Forced Validation: Do these cut-points achieve the Future State?
• Communication & Escalation Cadence
• Evidence & Coverage Gaps

• Deploy forensic sensor suite (packet, memory, endpoint)
• Start continuous full-packet capture
• Acquire live memory snapshots from endpoints
• Image disks with verified chain-of-custody
• Collect and centralize endpoint telemetry
• Isolate and quarantine compromised systems
• Block attacker C2 and exfiltration channels
• Revoke compromised credentials and access tokens
• Malware reverse engineering and IOC extraction
• Threat infrastructure mapping via intelligence graph
• Coordinate evidence transfer with law enforcement
• Deliver forensic investigation report and disclosure package

Deploy forensic sensor suite (packet, memory, endpoint)

• Is pre-authorized deployment of sensors (agent or appliance) permitted under your current contracts/policies? Options: Yes, No, Pending Approval
• Which environments should sensors be deployed to? Options: On-premises, Cloud IaaS (e.g., AWS/Azure/GCP), SaaS (limited telemetry), OT/ICS, Hybrid
• Estimate the number of endpoints/hosts to target for initial sensor deployment Options: Less than 50, 50-250, 251-1000, 1001+, Unknown
• What operating systems and device types require sensors? Options: Windows, Linux, macOS, Network Appliances, Virtual Machines, Other
• Are privileged installer accounts, MDM access, or orchestration credentials available for sensor installation? Options: Yes - full access, Limited/temporary access, No - manual coordination required
• Are there any maintenance windows, change-control constraints, or blackout periods that would restrict immediate sensor deployment? Options: No restrictions, Yes - provide windows, Unknown

Start continuous full-packet capture

• Do you have network taps or SPAN ports available at key egress/ingress points for packet capture? Options: Yes - multiple tap points, Yes - limited tap/SPAN, No - will require inline sensors
• What capture retention policy is required (how long must full packets be retained for analysis)? Options: 24 hours, 72 hours, 7 days, 30 days, Custom
• Are there any bandwidth, storage, or privacy constraints that would limit full-packet capture? Options: No, Yes - bandwidth limited, Yes - storage limited, Yes - privacy/regulatory constraints
• Is decryption of TLS/encrypted traffic permitted for capture and analysis? Options: Yes - enterprise decryption available, No - cannot decrypt, Partial - some ingress points only
• Which network locations should be prioritized for continuous capture (e.g., internet egress, datacenter core, VPN concentrators)?
• What SLA is required for beginning packet capture after engagement start? Options: Within 1 hour, 1-4 hours, 4-12 hours, Next business day

Acquire live memory snapshots from endpoints

• Which endpoint classes require live memory capture (servers, workstations, cloud instances)? Options: Servers, Workstations/laptops, Cloud VMs/Instances, Network appliances, All of the above
• Are live-forensics tools approved for your environment, or is additional authorization required? Options: Approved, Requires approval, Not allowed
• How quickly must memory snapshots be acquired to meet investigative objectives? Options: Immediate (within 1 hour), Within 4 hours, Within 24 hours, Within 48 hours
• Is persistent forensic agent pre-deployed (enabling remote memory capture) or will captures require manual on-host access? Options: Pre-deployed agent available, Manual access required, Mixed/partially available
• Are there any endpoints with sensitive data or regulated workloads that require special handling during memory acquisition? Options: Yes - specify, No, Unknown
• Specify any constraints on memory snapshot size, transfer method, or storage location (e.g., cannot transfer offsite)

Image disks with verified chain-of-custody

• Which systems require full disk imaging (priority list or categories)?
• Is legal or internal compliance approval required before imaging systems? Options: Yes - requires legal signoff, No, Unknown
• Do you require a court-admissible chain-of-custody process and evidence packaging for images? Options: Yes - formal chain-of-custody, No - investigative copies only, Undecided
• Will imaging be performed onsite, via remote acquisition, or via cloud-provider snapshot? Options: Onsite forensic imaging, Remote/agent-based imaging, Cloud snapshot APIs, Mixed
• Are there encrypted disks or self-encrypting drives that will require key retrieval or vendor assistance? Options: Yes - keys available, Yes - keys not available, No
• How soon must imaging begin to preserve volatile evidence and minimize data loss risk? Options: Immediate (within 1 hour), Within 4 hours, Within 24 hours, Within 48 hours

Collect and centralize endpoint telemetry

• Which telemetry sources should be centralized (EDR, Sysmon, Windows Event, logs, application logs)? Options: EDR/Agent logs, Sysmon/Windows Events, Linux audit logs, Application logs, Cloud-native logs
• Is there an existing SIEM or log-aggregation platform to centralize telemetry into? Options: Yes - provide access, No - require temporary centralization, Limited/partial access
• What retention and indexing requirements do you have for centralized telemetry during the investigation? Options: 30 days, 90 days, Custom, Minimal (investigation only)
• Are there licensing or ingestion limits (events/day) that could prevent full telemetry centralization? Options: No limits, Yes - limits exist, Unknown
• Do you permit temporary elevation of telemetry collection (increased verbosity) for scope investigation? Options: Yes, No, Conditional - requires approval
• List any specific telemetry fields or applications that are critical for this investigation (e.g., mail server logs, VPN logs)

Isolate and quarantine compromised systems

• Do you authorize network-level isolation (switch port shutdown, VLAN change) and/or host-level quarantine (EDR block) for suspected systems? Options: Network-level allowed, Host-level allowed, Both allowed, Neither allowed without approval
• What is the acceptable impact threshold for isolation actions (e.g., tolerate downtime for critical systems?) Options: Low tolerance - avoid downtime, Moderate - some downtime acceptable, High - prioritize containment
• Are there segmented environments or critical availability constraints (e.g., medical devices, OT) that restrict isolation methods? Options: Yes - list constraints, No restrictions, Unknown
• Should quarantined systems remain available for remote evidence collection or be physically removed? Options: Keep online for remote forensics, Take offline and image, Case-by-case
• Are rollback or failback plans required for any isolation action we might take? Options: Yes - provide plans, No, Unknown
• Who must be notified/approve before isolation actions (roles or contact points)?

Block attacker C2 and exfiltration channels

• Do you allow proactive blocking of identified IPs/domains at perimeter and endpoint levels? Options: Yes - immediate block, No - requires approval, Conditional
• Which control points are available for blocking (firewall, proxy, endpoint policy, DNS, cloud security groups)? Options: Firewall/NGFW, Proxy/ProxySG, Endpoint controls/EDR, DNS filtering, Cloud security groups
• Are there concerns about false positives impacting business-critical traffic if broad blocks are applied? Options: Yes - high concern, Moderate, Low concern
• Do you require staged blocking (alert -> soft block -> hard block) or immediate hard blocks? Options: Staged/approval-based, Immediate hard block, Case-by-case
• Are egress filtering and data-loss prevention (DLP) systems integrated and available to assist with exfiltration detection/blocking? Options: Yes - integrated, No - not available, Partial/limited
• List any third-party services or partner connections where blocking could disrupt operations and require special handling

Revoke compromised credentials and access tokens

• Do you permit immediate revocation/rotation of user and service credentials implicated in the incident? Options: Yes - immediate, No - requires approval, Conditional
• Which identity systems must be updated (AD, Azure AD, IAM roles, API keys, cloud service accounts)? Options: Active Directory/AD, Azure AD/Entra, Cloud IAM (AWS/GCP/Azure), Service/API keys, Other
• Are there privileged accounts or service tokens that cannot be rotated without maintenance windows? Options: Yes - provide list, No, Unknown
• Do you require secret management or rotation automation as part of credential revocation? Options: Yes - use secret manager, No - manual rotation, Unsure
• Should revocations be logged and reported for legal/compliance purposes (include audit trail)? Options: Yes - mandatory, Optional, No
• Provide any exceptions or business-critical services where credential revocation must be avoided or scheduled

Malware reverse engineering and IOC extraction

• Do you require reverse engineering for binaries recovered from the environment to identify capabilities and persistence? Options: Yes - perform full RE, No - IOC extraction only, Undecided
• Are samples permitted to be taken offsite or shared with third-party analysts for analysis? Options: Yes - offsite allowed, No - must remain onsite, Conditional with redaction
• What turnaround time is required for IOC deliverables (hashes, YARA, network indicators)? Options: Within 24 hours, 48-72 hours, Within 7 days, Custom
• Should extracted IOCs be automatically pushed to blockers/EDR/SIEM after validation? Options: Yes - automatic push, No - manual approval, Case-by-case
• Are there specific analysis outputs required (behavioral summary, persistence mapping, deobfuscation steps)?
• Do you require malware provenance (e.g., linking to known threat actor groups) as part of the RE report? Options: Yes, No, Optional

Threat infrastructure mapping via intelligence graph

• Do you want our intelligence graph integrated with your telemetry to map attacker infrastructure in real time? Options: Yes - full integration, No - deliver as separate report, Limited integration
• Which external feeds or internal intel sources should be considered for correlation (provide list)?
• Do you require active disruption recommendations (e.g., sinkholing, takedown coordination) based on the mapped infrastructure? Options: Yes - recommend disruption, No - detection only, Need discussion
• How granular should mapping be (C2 IPs/domains, ASNs, infrastructure graphs, attacker TTP chains)? Options: C2 IPs/domains only, Full infrastructure graph + TTPs, High-level summary
• Are there legal or disclosure constraints on sharing intelligence-derived indicators outside your organization? Options: Yes - restricted, No, Conditional
• Do you want real-time alerting when intelligence graph identifies new infrastructure linked to this incident? Options: Yes, No, Email summary only

• Non-Disclosure Agreement (NDA)
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Service Level Agreement (SLA)
• Access & Authorization Consent
• Evidence Preservation & Chain-of-Custody Protocol
• Data Processing Agreement (DPA)
• Law Enforcement & Regulatory Coordination Consent
• Communication & Executive Escalation Plan
• Surge Capacity & Prioritization Assurance
• Billing, Rates & Payment Terms
• Change Order & Scope Modification
• Termination, Suspension & Exit Plan
• Roles, Responsibilities & RACI
• Insurance, Indemnity & Liability Allocation

• Executive Incident Closure & Risk Brief
• Technical Findings & Validation Review
• Remediation Implementation & Validation Checkpoint
• Legal, Compliance & Disclosure Coordination
• Lessons Learned & Continuous Improvement Workshop

• Assemble privileged evidence bundle with documented chain‑of‑custody for legal counsel.
• Confirm remediation tasks are completed to agreed acceptance criteria.
• Resolve or escalate blockers and allocate required resources.
• Schedule final verification and signoff for technical closure.
• Complete outstanding patches/configurations and report verification evidence.
• Run and document full restore/recovery tests where applicable.
• Enable and tune detection rules derived from IOCs and confirm alerts cleared.
• Confirm SLA adjustments or surge support scheduling if required.
• Jurisdictional Notification Requirements
• Agree on who will notify which regulators/customers and by what deadlines.
• Ensure privileged materials and evidence are protected and documented for potential legal processes.
• Confirm insurer requirements are met and public/customer messaging is approved.
• Produce and file regulator notifications according to jurisdictional timelines.
• Introductions & Objectives
• Provide insurer with requested documentation and open claim contact.
• Finalize and publish approved customer and public communications.
• Root Cause & Contributing Factors
• Produce a prioritized, time‑bound remediation and improvement plan owned by specific stakeholders.
• Update IR playbooks, evidence handling procedures, and detection content based on findings.
• Schedule and scope a follow‑up tabletop/exercise to validate implemented changes.
• Publish updated incident response playbook and circulation list.
• Implement top priority detection/enforcement changes and verify via test.
• Assign owners and set deadlines for backlog items in the tracking tool.
• Schedule a tabletop exercise within 60–90 days to validate improvements.
• Ensure executives understand the incident impact, remediation status, and residual risk.
• Obtain formal approval for disclosure recommendations and public statements.
• Assign accountable owners and deadlines for unresolved remediation and communications.
• Produce an executive one‑page incident summary for board and regulators.
• Approve and send agreed regulator/customer notification drafts.
• Assign owners and deadlines for each residual risk mitigation task.
• Schedule follow‑up check to confirm remediation closures and communications.
• One‑Sentence Current State & Investigation Scope
• Validate the investigative findings and confirm the scope of systems and data impacted.
• Confirm evidence that attacker persistence has been removed or identify remaining indicators.
• Agree on technical acceptance criteria and next steps to remediate outstanding risks.
• Deliver final forensic report, IOCs, and chain‑of‑custody package to stakeholders.
• Publish IOC set to detection platforms and implement blocking rules.
• Schedule targeted re‑scans and validation windows to confirm eradication.
• Hand off long‑term monitoring and playbook updates to SOC with timeline.
• Remediation Status Dashboard
• Validation Test Results
• Process, People & Tooling Gaps
• Privileged Material & Evidence Handling
• Forensic Evidence Overview
• One‑Sentence Current State
• Outstanding Blockers & Resource Needs
• Timeline & Key Findings
• Prioritized Improvement Backlog
• Exfiltration Scope & Data Impact Validation
• Regulator & Law Enforcement Coordination
• Insurance Claims & Documentation
• Eradication & Containment Validation
• Owners, Timelines & Success Metrics
• Business Impact & Consequences
• SLA Compliance & Capacity Review
• Plan Exercise & Verification
• Schedule Final Verification & Closure Criteria
• Remediation Outcomes & Residual Risk
• Open Technical Risks & Acceptance Criteria
• Public Statement & Customer Notification Drafts