Incident Response

The Cynet 360 platform is the world’s fastest IR tool and includes automated attack detection and remediation

Learn More

Incident Response Template: Presenting Incident Response Activity to Management

Incident response is a critical, highly sensitive activity in any organization. When security incidents happen, especially if they turn into major breaches involving damage to the organization and its clients, management needs to get involved. Senior managers will want to understand the impact of the incident and react to it.

As a leader, or member, of an incident response team, you’ll need a way to easily communicate the details of a security incident to management, taking into consideration that they are not security professionals.

This page provides a useful template with tables you can copy and paste into your reports or presentations to management, that will help them understand what happened in an incident, how your team responded, what remains to be done, and lessons learned.

When a major security incident occurs in your organization, you will be required to report to management about what happened during the incident, how the threat was mitigated and key systems recovered, and what are the lessons learned for next time.

It is important to communicate about the incident to your management both during the response, and after its conclusion. This will give them full visibility and knowledge into the event and its potential risk.

In this page, we provide a template you can use to clearly report to management about a major security incident, how it was handled, next steps and lessons learned.

Also be sure to check out our guide to incident response planning, and our list of incident response plan templates created by leading organizations.

How to Use the Template

Here is how to use our template to create your incident report for management:

  • The template is built from tables you need to fill up in respect to your specific use case.
  • For prolonged investigations or incidents with many details, you can provide several reports, each covering a certain part of the incident investigation, each with its own threat and risk, containment, eradication and lessons learned.
  • When entering free text, please be as concise as possible
  • Make sure you remove any placeholder text before presenting the template.

1. Threat and Risk

Specify what happened in the incident, how you detected the threat, and the potential risk.

INCIDENT INVESTIGATION 
  Compromise  Privilege Escalation Credential Theft Lateral Movement  Data  Access  Data Exfiltration
Threat     V  
Details    SaaS account was compromised Pass the Ticket – XXX server was accessed  
THREAT DETECTION 
  IN-HOUSE 3RD PARTY
  Security Product Alert  Security team proactive 
Details EDR raised an alert Analyst spotted anomalous outbound traffic FBI notification 
POTENTIAL RISK
Free text explaining the type of incident
Example: Detected lateral movement might indicate an active malicious presence in the environment as well as other compromised assets 

2. Investigation Next Steps

Indicate who is managing the incident, whether there is a dedicated budget for responding or remediating the threat, and explain the next steps in the incident investigation process.

THREAT TYPE 
  In-House  IR Service Provider 
Case Manager   
DEDICATED BUDGET 
Purpose  Sum
  
  
INVESTIGATION DIRECTIONS

Free text in respect to the incident type

Example: 

  • Check if the compromised account has accessed sensitive resources
  • Examine outbound communication from the infected endpoints
  • etc.
ESTIMATED TIMELINE
 

3. Containment

Discuss which part of the environment was penetrated, and what was done to contain the damage. 

ROOT CAUSE 
Weaponized Email v
Malicious website x
Stolen credentials  
Insider  
THREAT TYPE 
Scope  Actions Taken
Number of compromised endpoints 2 Take offline
Number of compromised  servers 3 Take offline
Number Compromised user accounts 5 Disable & Reset Password
Number of encrypted  endpoints  Reimage
Number of encrypted servers  Reimage
Current Status all discovered compromised entities are mitigated 
Next Steps investigate the attack’s scope

4. Eradication

Specify what was done, or planned to be done, to remove the threat in the interim phase, how it will be eradicated for good, and the success rate of different types of attacks conducted as part of the incident.

Interim Eradication

INTERIM STATUS
  Mass Ransomware Malware Compromised User Accounts Malicious Outbound  Traffic
Malicious Activity Type XXX endpoints encrypted XXX instances XXX accounts  XXX sessions to XXX addresses
Status 54% back in production 92% removed 100% disabled and password reset 100% blocked
NEXT STEPS
  Mass Ransomware Malware Compromised User Accounts Malicious Outbound  Traffic
Malicious Activity Type XXX endpoints encrypted XXX instances XXX accounts  XXX sessions to XXX addresses
Status Continue reimaging   

Final Eradication Plan

MALICIOUS INFRASTRUCTURE & ACTIVITY REMOVED 
  Mass Ransomware Malware Compromised User Accounts Malicious Outbound  Traffic
Malicious Activity Type XXX endpoints encrypted XXX instances XXX accounts  XXX sessions to XXX addresses
Status 100% reimaged 100% removed 100% reset 100% blocked 
ATTACK DETAILS AND SUCCESS RATE
  Details Attack Success Rate 
Data Theft Insert info here Insert info here
Extortion   
Cryptomining  
Banking Credentials Harvesting  
Sabotage  
Other (specify)  

5. Recovery

Explain your plan for returning affected endpoints, servers, apps, and other organizational assets to production.

  Disabled/non available   Back to Production
Endpoints  Insert info here 
Servers   
Apps  
Cloud workloads  
User accounts  
Data  

6. Lessons Learned

Summarize the incident – what was the impact on the organization, what were the root causes that allows the attack to happen, the final timeline of the incident, and most importantly – what went well in the incident management process and what needs to be improved next time.

OVERALL ATTACK IMPACT
  Damage Details
Man hours Insert info here Insert info here
Payment to 3rd party  
Data loss  
Computing charges for cloud provider  
Production downtime  
Fines (per respective regulation)  
Attack Enablers Recommendations
Lack of sufficient security technology Implement EDR\Deception\UBA\Network Analytics\XDR\other
User insecure behavior Train users on security best practices 
Other (specify) Implement EDR\Deception\UBA\Network Analytics\XDR\other
FINAL ATTACK TIMELINE
Initial Compromise date Insert date here
  
  Initial Compromise > Identification Identification > Containment Containment > Eradication Eradication > Recovery
Time to conclude Insert time here   
  Identification Containment Eradication Recovery
POINTS TO REPRODUCE      
POINTS TO IMPROVE  Challenge    
Recommendation    

Automated Incident Response with Cynet

Cynet provides a holistic solution for cybersecurity, including the Cynet Response Orchestration which can automate your incident response policy. Users can define automated playbooks, with pre-set or custom remediation actions for multiple attack scenarios. Cynet automated playbooks also help detect threats to ensure that you only implement a manual response when it is necessary.

Cynet Response Orchestration can address any threat that involves infected endpoints, malicious processes or files, attacker-controlled network traffic, or compromised user accounts.

Learn more about Cynet Response Orchestration.

Dive In

Ebook Free Download

Securing Your Organization’s Network on a Shoestring

How to protect your resource-constrained organization’s endpoints, networks, files and users without going bankrupt or losing sleep.

DOWNLOAD NOW
Ebook Free Download

Securing Your Organization’s Network on a Shoestring

How to protect your resource-constrained organization’s endpoints, networks, files and users without going bankrupt or losing sleep.

DOWNLOAD NOW
SOLUTION BRIEF

Automated Threat Discovery & Mitigation

Secure your all organizational assets with a single platform. Cynet 360 protects across all threat vectors, across all attack stages.

DOWNLOAD NOW
SOLUTION BRIEF

Automated Threat Discovery & Mitigation

Secure your all organizational assets with a single platform. Cynet 360 protects across all threat vectors, across all attack stages.

DOWNLOAD NOW
FREE TRIAL

Deploy Cynet in Minutes and Try it for 14 Days

Try Cynet’s easy-to-launch prevention, detection and response platform across your entire organization - free for 14 days!

START YOUR TRIAL