What should the final cyber-incident report achieve?¶

The final cyber-incident report should explain what happened, what the evidence proves, what remains uncertain and what actions or risks remain.

Evidential caution: that a technically detailed report is automatically a useful report.

What this means¶

A defensible report should distinguish:

incident scope;

affected systems and accounts;

timeline;

initial access;

persistence;

movement;

collection and exfiltration;

disruption or destruction;

recovery;

provider evidence;

technical attribution;

personal attribution;

offender claims;

response actions;

evidence gaps;

remaining risk.

Separate observed fact from interpretation.

Separate account, device, session, infrastructure and person.

Explain the evidential basis for each major conclusion.

Likewise, do not reduce a complex incident to one dramatic label.

The report should allow an investigator, supervisor, legal adviser, regulator or decision-maker to understand:

what is known;

how it is known;

what is not known;

what should happen next.

Where conclusions depend on external intelligence, provider interpretation or specialist analysis, identify that source and its confidence. The report should allow a later reviewer to distinguish independently observed facts from conclusions adopted from another body.

State that evidential dependency explicitly. The operational takeaway is:

================================================================================

What to check or do next¶

• Use clear and precise language.

Evidential limits¶

It may not be.

Do not bury important uncertainty inside technical detail.

The report should be usable without requiring the reader to interpret raw logs independently. Technical detail can be included or referenced, but the main findings should explain the supported sequence, evidential limitations and practical consequences in clear operational language.

Produce a report that connects technical evidence to scope, attribution, impact, uncertainty and next decisions without overstating what the records prove.