Use a dated timeline
Record event, detection, affected work, actions, and current state with evidence. Do not turn an early suspicion into a confirmed cause.
Limit sensitive detail
Include only what the response owner needs and use approved channels for confidential material. Do not distribute credentials or unnecessary personal data.
End with explicit asks
State the decision, owner, deadline, and evidence needed next. Keep the brief open until the response owner confirms the state.