Share the facts each audience needs

Useful updates turn shared facts into the next decision.

Keep one factual foundation

An incident update states known impact, actions, uncertainty, and decisions needed by a particular audience at a particular time. Engineering, leadership, and customers may need different detail, but their versions must not contradict the same underlying evidence.

Assume a fictional community fund is reviewing an application-portal outage. Leadership controls staffing for temporary manual intake; technical responders control diagnosis. This exercise concerns an internal update, not a legal notification determination or a message to send.

Supplied situation at 12:20

• U1: New applications have been unavailable since 12:05. The cause is still being investigated.
• U2: Data exposure has not been established or ruled out. Raw diagnostics contain applicant identifiers and internal details.
• U3: Manual intake could begin with two staff members. Leadership must decide whether to allocate them; responders will issue another update at 12:40.

Match information to the decision

Leadership needs the outage’s business consequence, uncertainty, staffing request, and next update time. It does not need a raw diagnostic attachment to decide whether to resource continuity. Technical responders should retain detailed evidence through the approved restricted channel.

Do not replace “not established” with “no exposure,” or call an unexplained outage a confirmed attack. If the next update brings no new finding, state that the assessment remains open and explain the current action rather than inventing progress.

A named update owner prevents conflicting versions. Keep the time of each assessment so later discoveries can revise conclusions without erasing what was known earlier.

Model structure: Verified impact; current uncertainty; decision and owner; next update. Tailor detail while preserving those facts.