Executive Incident Command Briefing

Template Overview

Major cybersecurity breaches require disciplined, legally privileged coordination between technical forensics teams, executive leadership, and regulatory counsel. The Executive Incident Command Briefing template provides an airtight structure for recording blast radius assessments, containment milestones, and notification timelines in sovereign Markdown.

Markdown Template Structure

Copy the block below or click Download .md File to add this template directly to your personal vault:

---
title: "Executive Incident Briefing: [INCIDENT-ID]"
date: [YYYY-MM-DD]
incident_commander: "[[Head of Information Security]]"
ciso: "[[Chief Information Security Officer]]"
legal_counsel: "[[External Breach Counsel]]"
severity: "SEV-0 / Critical Security Breach"
privilege_status: "ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL"
regulatory_clock_active: true
tags: [infosec, incident-command, breach-response, legal-privilege]
---

# Executive Cybersecurity Incident Command — [INCIDENT-ID]

## 1. Threat Profile & Blast Radius
- **Incident Vector:** [Credential Compromise / Supply Chain / Zero-Day / Ransomware]
- **Time of Earliest Infiltration:** [YYYY-MM-DD HH:MM UTC]
- **Time of Detection:** [YYYY-MM-DD HH:MM UTC]
- **Data Impact Assessment:** [Confirmed Exfiltration / Suspected Access / Contained]
- **Affected Systems & Cryptographic Status:** [List impacted infrastructure]

## 2. Containment & Remediation Timeline
| Timestamp (UTC) | Action Executed | Systems Affected | Verification Method | Lead Engineer |
|---|---|---|---|---|
| [HH:MM] | API gateway credentials revoked | Edge Ingress | Log verification | [[Security Lead]] |
| [HH:MM] | Lateral network segments isolated | Database Cluster | Network tap audit | [[Infra Architect]] |
| [HH:MM] | Memory forensics dump captured | Compromised Host | SHA-256 hash stored | [[DFIR Lead]] |

## 3. Legal & Regulatory Compliance Clocks
- **SEC Form 8-K Disclosure:** [Countdown: XX hours remaining]
- **GDPR Article 33 72-Hour Notification:** [Status & Lead Supervisory Authority]
- **Cyber Insurance Carrier:** [Notice formally submitted / Claim ID]
- **Law Enforcement Coordination:** [FBI / CISA notification status]

## 4. Executive Directives & Workstreams
- [ ] [[DFIR Lead]] Complete disk and memory forensic timeline.
- [ ] [[External Counsel]] Finalize draft regulatory breach disclosure.
- [ ] [[CISO]] Convene next executive synchronization in 4 hours.

Filled Real-World Example

Here is a realistic example demonstrating how this template captures actual deliberations:

---
title: "Executive Incident Briefing: SEC-2026-88"
date: 2026-10-10
incident_commander: "[[Vikram Sethi]]"
ciso: "[[Arthur Pendelton]]"
legal_counsel: "[[Helena Vance (Counsel)]]"
severity: "SEV-0"
privilege_status: "ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL"
regulatory_clock_active: true
tags: [infosec, incident-command, breach-response, legal-privilege]
---

# Executive Cybersecurity Incident Command — SEC-2026-88

## 1. Threat Profile & Blast Radius
Vikram Sethi presented initial forensic telemetry. Attacker gained ephemeral access to an outdated internal monitoring instance via an unpatched OpenSSH vulnerability. Zero customer database access occurred.

## 2. Containment Executed
At 08:30 UTC, infrastructure engineering severed public routing to the affected instance. Memory capture preserved with verified SHA-256 hash for forensic chain of custody.

## 3. Regulatory Assessment
Helena Vance affirmed that because zero customer personal data or material financial systems were accessed, statutory 72-hour notifications are not triggered at this stage. Continued forensic validation required.

## 4. Next Synchronization
Command bridge reconvenes at 14:00 UTC.

When to Use and When to Avoid

When to Use

• Use during executive war room briefings for high-severity cybersecurity breaches.
• Use when documenting legally privileged containment deliberations with external counsel.
• Use to track statutory regulatory disclosure deadlines under GDPR, SEC, or HIPAA.

When to Avoid

• Avoid for minor routine dependency vulnerability alerts or Dependabot PRs.
• Avoid for non-security infrastructure downtime (use the Incident Post-Mortem template).

On-Device AI Integration

Summarize your recording in Oyma with this local instruction:

Analyze the executive cybersecurity incident briefing recording:
1. Document threat vector details, detection timestamps, and data impact assessments.
2. Outline specific containment actions, forensic validations, and responsible engineers.
3. Record legal counsel determinations and regulatory disclosure requirements.
Output in clean, structured Markdown.

Your data remains securely on your Mac with zero cloud exposure.