Early incident communication often happens before the full story is known. People still need to understand what is confirmed, what is being checked, and what action to take. Clear uncertainty is more useful than a confident claim that the team later has to withdraw.
Understand the idea
Separate facts from working explanations. Name the affected service, practical impact, immediate action, owner, and next update point. Avoid presenting a suspected cause or an unverified scope as settled. Different audiences may need different detail, but the underlying facts should remain consistent.
- Facts
Say what has been verified and how.
- Unknowns
Name important gaps without turning them into claims.
- Actions
State the current response and who owns the next update.
A practical example
Imagine a team investigating unusual access to a shared folder. Its first update says the route has been restricted, the review of downloads is ongoing, and staff should not use the old link. It does not claim that no information left the system before the relevant records are checked.
What to do next
- Confirmed: The specific event or service impact supported by current evidence.
- Unknown: The important scope or cause questions still under investigation.
- Action: Containment, investigation, recovery, or support steps already authorized.
- Next update: A realistic time or trigger for further information and a contact route.
How to check the result
Keep a versioned communication record linked to the evidence and decisions available at the time. Update important changes through the agreed channel and involve the appropriate legal or privacy owner when required.
Leadership asks whether data was stolen, but we do not know yet.
Explain the evidence reviewed, the limits of that evidence, and the investigation underway. Do not translate “not yet confirmed” into either a guarantee or an allegation.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
