Incident Communication

Incident Communication

Draft incident communication templates for "$ARGUMENTS" covering internal alerts, management briefings, customer notifications, regulatory notifications, media statements, and post-incident summaries.

Prerequisites

Read .metapowers/security/$ARGUMENTS/00-govern.md. If this file does not exist, tell the user:

Phase 0 (Govern) has not been completed for "$ARGUMENTS". Run a Govern skill first (e.g., /security:security-policy $ARGUMENTS), or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check and log to .metapowers/security/$ARGUMENTS/skip-log.md.

Process

1. Read context files:

   • Read plugins/security/shared/incident-response-template.md for communication workflow reference
   • Read .metapowers/security/$ARGUMENTS/00-govern.md for organizational context and compliance requirements

2. Create internal alert template (security team):

   • Subject line format: [P{severity}] {incident_type} — {affected_system}
   • Content: detection time, detection source, initial indicators, affected systems, immediate actions taken
   • Distribution: severity-based (P1: all security + engineering leads, P2: security team + affected service owners, P3–P4: on-call responder)
   • Format for both email and chat (Slack/Teams) channels

3. Create management briefing template:

   • Executive summary: what happened (1–2 sentences, no jargon)
   • Business impact: affected services, users impacted, revenue implications, regulatory exposure
   • Current status: containment state, investigation progress
   • Actions taken: what the team has done so far
   • Next steps: planned actions with estimated timelines
   • ETA for resolution or next update
   • Cadence: P1 every 30 minutes, P2 every 2 hours

4. Create customer notification template:

   • What happened: clear, honest description in plain language
   • What data/services were affected: specific and accurate
   • What we are doing: immediate actions and ongoing investigation
   • What customers should do: password changes, monitoring recommendations, precautionary steps
   • How to get help: dedicated support channel, FAQ link
   • Timeline: when it happened, when we detected it, when we contained it
   • Follow-up commitment: when to expect the next update

5. Create regulatory notification template:

   • GDPR (72-hour requirement): nature of breach, categories and approximate number of data subjects, likely consequences, measures taken or proposed
   • State breach notification laws: adapt per jurisdiction (California, New York, etc.)
   • Sector-specific (HIPAA, PCI DSS, SOX): format per applicable regulation
   • Include: incident timeline, data types affected, affected individuals count, remedial measures
   • Legal review checkpoint before sending

6. Create media statement template (if needed):

   • Brief factual statement: what we can confirm
   • What we are doing: response actions in progress
   • Commitment: to transparency and protecting affected parties
   • Redirect: to official channels for updates
   • Spokesperson designation and talking points
   • What NOT to say: avoid speculation, admissions of fault, or technical details

7. Create post-incident summary template:

   • Incident overview: type, severity, duration, impact
   • Timeline: detection to resolution with key milestones
   • Root cause: what caused the incident
   • Response effectiveness: what went well, what could improve
   • Corrective actions: with owners and deadlines
   • Lessons learned: key takeaways for the organization

8. Define communication approval chain:

   • Internal alerts: security team lead approves
   • Management briefings: incident commander approves
   • Customer notifications: legal + communications lead approve
   • Regulatory notifications: legal counsel + CISO approve
   • Media statements: CEO/executive sponsor + legal + PR approve
   • Define maximum approval time per severity to avoid delays

9. Write the artifact to .metapowers/security/$ARGUMENTS/04-respond.md with heading:

   Incident Communication

   Include sections:

   • Internal Alert Template — format and distribution rules
   • Management Briefing Template — executive summary format and cadence
   • Customer Notification Template — plain-language communication format
   • Regulatory Notification Templates — per applicable regulation
   • Media Statement Template — approved messaging framework
   • Post-Incident Summary Template — review and lessons learned format
   • Approval Chain — who approves each communication type and maximum approval time

Output

The incident communication templates written to .metapowers/security/$ARGUMENTS/04-respond.md. Present a summary to the user highlighting:

• Communication templates created per audience
• Regulatory notification requirements addressed
• Approval chain and maximum approval times
• Spokesperson designation and media guidance