Board/Executive Team Brief Template
Use when every minute counts
Leaders need facts, not up-to-the-minute information. This format ensures updates are concise, consistent, and decision-ready – apply it to ransomware incidents and any significant disruption.
Three parts, one page; timestamps only; emphasis on decisions.
Maintain a consistent schedule (e.g., 10 a.m./2 p.m./6 p.m.) to reduce confusion in the mailbox.
- Number each brief; Maintain an organized PDF record for consultants and carriers.
Template (copy and paste)
Replace the text in parentheses. Keep the language factual. Avoid speculation until verified.

-
[Time-Stamp] -
Status: [Stable/Deteriorating/Improving] Incident Description: [1-3 bullets] Action Taken: [1-3 bullets] -
Next Steps: [1-3 bullets] Risks and Options: [List of Approvals or Agreements] -
Business Impact: [Applications/Sites/Individuals] Estimated Time for Next Update: [Estimated Time]
Rhythm and Allocation
Pick a rhythm and maintain it. Ensure distribution remains focused on key decision-makers. Archive for future consultants.
- Key: CEO, COO, CFO, GC, CISO/IT Head, Communications/PR.
- Act as Board Liaison Officer and Broker/Claims Adjuster, if appropriate.
- Archive PDF files, including versions, in the Evidence Directory.
Frequently Asked Questions
Don’t send it widely. Keep the list short to avoid leaks and confusion; instead, issue a well-organized FAQ separately for employees.
Don’t send it widely. Keep the list short to avoid leaks and confusion; instead, issue a well-organized FAQ separately for employees.