IR Communication
Internal escalation, war room setup, SITREP format for non-technical leadership, and what not to put in writing during an active incident — because the emails you send at 3 AM become discovery documents in litigation.
It's 4 AM. The IR lead sends a Slack message to the general #engineering channel: "Heads up everyone — we have ransomware spreading, looks like about 200 machines, possibly including payroll servers. Think it came in through a phishing email last week. Still working it." Three problems: the #engineering channel is not a secure communication channel during an incident (attacker may have Slack access). The message is speculation, not fact. And "possibly including payroll servers" is now a written statement that legal will have to manage in every regulatory filing and litigation response. This chapter explains how to communicate during an incident without making it worse.
Secure Communication Channels
During an incident, assume any system connected to the compromised environment may be monitored by the attacker. Communication about the incident on those systems tells the attacker what you know and what you're about to do.
Communication Channel Risk During Incident
═══════════════════════════════════════════════════════════════════
HIGH RISK (attacker may have access):
├── Corporate Slack / Teams on compromised tenant
├── Corporate email (Exchange/O365)
├── Ticketing systems on-premises
├── Confluence/SharePoint (corporate wiki)
└── Any system authenticating to the compromised AD/Azure AD
LOWER RISK (use for incident communications):
├── Personal mobile phone (voice and SMS)
├── Out-of-band communication platform
│ (separate tenant, not SSO'd to corporate)
├── Signal or encrypted messaging app on personal devices
├── Bridge/conference call on carrier-level phone numbers
└── External IR firm's isolated platform
What to communicate on LOW RISK channels:
→ Confirmed findings (facts only)
→ Containment decisions
→ Escalation notifications
→ Instructions to the IR team
What NOT to communicate anywhere during the incident:
→ Speculation about attacker identity
→ Unconfirmed scope estimates
→ Legal liability language ("we think data was stolen")
→ Attribution (unless confirmed and authorized by legal)
Human-operated threat actors — ransomware operators and advanced APT groups — actively monitor compromised infrastructure for signs of IR activity. They look for EDR alert noise, password reset activity, and communications on platforms they can access. An IR team that communicates the investigation plan via corporate Slack while the attacker has an active session in the tenant is handing them the IR timeline. Sophisticated operators have delayed ransomware deployment specifically to observe IR preparation and then deploy at the moment of maximum disruption. Use out-of-band communications for anything operational.
Internal Escalation
Know in advance who needs to be notified at each severity level, and loop them in before they call you asking for an update — because a CISO who hears about a P1 incident from someone other than the IR team has already lost confidence in the response.
| Severity | Who to notify | When | Method |
|---|---|---|---|
| P1 — Critical | IR Lead → CISO → CIO → General Counsel → CEO brief | Immediately upon P1 declaration (within 15 minutes) | Phone call — no email for initial notification |
| P2 — High | IR Lead → CISO | Within 1 hour of P2 declaration | Phone call or secure message |
| P3 — Medium | IR Lead notification (may be async) | Within 4 hours | Secure message or email is acceptable |
| Any — PII/PHI/PCI involved | Legal / DPO immediately in addition to technical chain | Same time as CISO notification | Phone — legal counsel needs to manage the disclosure process from minute one |
HR involvement is triggered when the incident involves potential employee misconduct (insider threat), when forensic collection of a personal device may be required, when an employee's account was compromised and they need to be contacted, or when the investigation may result in disciplinary action or termination. Loop in HR early for insider threat incidents — HR's involvement changes both the investigation process and the legal requirements around employee data handling. Do not share forensic findings about specific employees with HR without legal counsel's guidance.
SITREP Format
A Situation Report (SITREP) is the briefing for non-technical leadership. It must answer their questions without requiring them to understand technical details. One page. Facts only. No speculation.
SITREP Template ═══════════════════════════════════════════════════════════════════ INCIDENT SITUATION REPORT IR-2026-023 | Classification: CONFIDENTIAL | [Date] [UTC Time] Prepared by: [Name], IR Lead ───────────────────────────────────────────────────────────────── INCIDENT SUMMARY Incident type: [Ransomware / Credential compromise / BEC / etc.] Current status: [Contained / Active / Eradication in progress] Severity: P[1/2/3] Incident declared: [Date Time UTC] WHAT HAPPENED [2-3 sentences. Facts only. No speculation. No technical jargon.] Example: "At approximately 03:15 UTC, our EDR detected malicious activity on 3 workstations in the Finance department. Investigation is ongoing to determine the full scope." BUSINESS IMPACT Systems affected: [List by criticality, not by hostname] Services disrupted: [What is unavailable right now] Data at risk: [Confirmed only — "investigation ongoing" if unknown] CURRENT ACTIONS ✓ [Completed action] — [Time] → [In progress action] — [Owner] — [ETA] ○ [Planned action] REGULATORY CONSIDERATIONS PII/PHI/PCI involved: [Yes/No/Under investigation] Notification obligations: [GDPR/HIPAA/state law — assessed by legal] Status: [Legal counsel engaged / Assessment in progress] NEXT UPDATE [Time of next SITREP — default: every 4 hours for P1, every 8 for P2] QUESTIONS / DECISIONS NEEDED FROM LEADERSHIP [Specific questions requiring executive decision, not information they should be aware of — e.g., "Authorization to engage external IR firm needed by [time]"]
Never write speculation as fact. "It appears the attackers may have accessed customer data" becomes a legal statement the moment it's written — even internally. The correct framing is: "Investigation is ongoing to determine whether customer data was accessed." Similarly: never attribute the attack in writing without legal counsel's sign-off. "This looks like a nation-state attack" or "probably the same group that hit [other company]" is defamatory if wrong and legally problematic if right. Write only what you can confirm. Every internal communication during an incident is potentially discoverable in litigation.
War Room Setup
A war room — whether physical or virtual — is the central coordination point for the IR team. Its purpose is to ensure everyone working the incident is synchronized, that decisions get made by the right people, and that work doesn't get duplicated or dropped.
| War room element | What it provides | Tool options |
|---|---|---|
| Communication bridge | Persistent voice/video for the active IR team — no waiting for someone to join a call | Dedicated conference bridge, Zoom/Teams on isolated tenant |
| Case management | Central place for incident timeline, evidence log, task tracking, findings documentation | TheHive, Jira (dedicated project), or even a shared doc on isolated drive |
| Shared analysis environment | Analysis artifacts visible to all analysts simultaneously — avoid duplicate work | Shared Jupyter notebook, SIEM dashboard, collaborative document |
| Incident timeline | Chronological record of every confirmed event — built in real time as findings come in | Shared Google Doc / spreadsheet, or TheHive timeline |
| Task board | Who is working what right now — prevents two analysts investigating the same machine simultaneously | Kanban board in TheHive/Jira, or a simple shared doc |
| Decision log | Every material decision documented with who made it, when, and based on what information | Running section in the incident document |
Shift Handoff
For P1 incidents running more than 8 hours, the IR team will hand off to the next shift. A bad handoff loses hours of work and context. A structured handoff takes 15 minutes and preserves continuity.
Shift Handoff Structure (15 minutes)
═══════════════════════════════════════════════════════════════════
1. Status brief (5 min):
"Here's where we are: [current confirmed scope], [containment
status], [active C2 severed/not severed], [current attacker
activity level if known]"
2. Open tasks (5 min):
Walk through the task board — what's in progress, who owns it,
what the incoming shift needs to follow up on
3. Critical evidence (3 min):
Where collected artifacts are stored, hash values recorded,
chain of custody documentation status
4. Escalation status (2 min):
Who has been notified, last SITREP sent, next update due
Handoff is documented in the case log — incoming shift lead
acknowledges receipt in writing (case comment timestamp)
Q & A
Q: The CEO calls directly asking for a status update before the SITREP is ready. What do you say?
Give a brief verbal update without speculating: "We have [X] confirmed affected systems. The team is actively working containment. I'll have a written situation report to you within [30 minutes / 1 hour]. Is there a specific business concern I should prioritize?" The goal is to give them enough to not feel uninformed while directing them to wait for the written report for details. Avoid sharing unconfirmed information verbally — verbal statements are recalled imperfectly and can become legal problems if inaccurately communicated further. The SITREP is the authoritative communication.
Q: A journalist calls asking about "the ransomware attack" you're currently handling. Who handles this?
Transfer immediately to Communications/PR and do not speak on record. Do not confirm or deny an incident exists. The correct response: "I'm not the right person to speak with about this. Let me connect you with our Communications team." Then immediately notify the IR lead, CISO, General Counsel, and Communications that media inquiries are happening — this is a material change in the incident that may affect legal strategy and disclosure timing. Confirm who has authorized any public statement before anything is said publicly. Media inquiries during an active incident often indicate the incident is already public knowledge, which may accelerate regulatory notification obligations.
Q: The IR team is using corporate Slack and you realize the attacker may have tenant access. What do you do?
Switch immediately to out-of-band communications (phone, Signal, a separate conference bridge) and do not assume Slack is secure. Assume everything discussed in the corporate tenant since the initial compromise was potentially observed. Assess what information in those channels could have tipped off the attacker — containment plans, specific system names, credential reset timelines — and factor that into the current threat model. If there's evidence the attacker accessed the communication platform, that's an additional finding to document and a vector to investigate as part of the incident scope.