IR Report Structure — Technical Post-Mortem, Executive Brief, and Compliance Documentation

A single incident generates multiple documents. The technical findings are the same — the presentation is tailored to what each audience needs to decide or do.

Technical Post-Mortem Template

# INCIDENT POST-MORTEM REPORT
**Case Reference**: IR-2024-0901
**Classification**: CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED
**Date**: [Report date]
**Prepared by**: [IR Team / Firm]
**Prepared for**: [Law Firm] on behalf of [Client]

---

## 1. Executive Summary
[2-3 paragraphs: what happened, impact scope, key actions taken, current status]

## 2. Incident Timeline (All times UTC)

| Time (UTC) | Event | Evidence Source |
|------------|-------|-----------------|
| 2024-09-01 14:22 | Phishing email received by user jsmith@company.com | Exchange mail flow logs |
| 2024-09-01 14:31 | User clicked malicious link; browser initiated download of initial stager | Proxy logs, EDR telemetry |
| 2024-09-01 14:32 | Initial stager executed; Cobalt Strike beacon established to C2 185.220.101.9 | EDR telemetry, Sysmon Event 1 |
| 2024-09-01 14:45 | LSASS process accessed for credential harvesting | Sysmon Event 10 |
| 2024-09-01 15:02 | Lateral movement to fileserver01 via WMI using harvested domain admin hash | Windows Security Event 4624 |
| ... | ... | ... |
| 2024-09-15 03:15 | Ransomware deployment triggered domain-wide | EDR, Sysmon, event correlation |
| 2024-09-15 03:17 | Security team alerted via EDR mass encryption alert | EDR console |
| 2024-09-15 03:45 | Network isolation completed | Firewall change logs |

## 3. Attack Chain — MITRE ATT&CK Mapping

Initial Access: T1566.002 — Spearphishing Link
Execution: T1059.001 — PowerShell; T1047 — WMI
Persistence: T1053.005 — Scheduled Task
Privilege Escalation: T1078.002 — Domain Accounts (hash)
Defense Evasion: T1140 — Deobfuscate/Decode Files
Credential Access: T1003.001 — LSASS Memory Dump
Lateral Movement: T1021.006 — WMI; T1550.002 — PtH
Impact: T1486 — Data Encrypted for Impact; T1490 — VSS Deletion

## 4. Scope of Compromise
  Systems Affected: [list]
  Accounts Compromised: [list]
  Data at Risk: [specific data categories, record counts]
  Duration of Unauthorized Access: 14 days (Sep 1 – Sep 15)

## 5. Root Cause Analysis
  [5 Whys analysis resulting in systemic root cause]

## 6. Forensic Evidence
  Evidence Item 1: Memory image of workstation01 — SHA-256: [hash]
  Evidence Item 2: Disk image of fileserver01 — SHA-256: [hash]
  [Chain of custody reference]

## 7. Indicators of Compromise
  [Appendix A — full IoC list in machine-readable format]

## 8. Recommendations
  [Numbered, prioritized, with owner and target date]

Executive Brief — One-Page Format

INCIDENT EXECUTIVE BRIEF
========================
Date: September 15, 2024
Incident: Ransomware — Business Operations Impact

WHAT HAPPENED
A sophisticated attacker gained access to our network on September 1 via a targeted 
phishing email. Over 14 days, they expanded access across our systems before deploying 
ransomware on September 15 at approximately 3:15 AM. 47 of 200 servers were encrypted.

WHAT WAS ACCESSED
• Operations: File servers, backup systems
• Data at Risk: Employee HR records (312 individuals), operational data, financial reports
• Customer data: Not affected — production database is on an isolated network segment

CURRENT STATUS
✓ All affected systems have been isolated
✓ Business operations restored using clean backups (12-hour outage resolved)
✓ Threat actor access has been terminated
⚠ Investigation ongoing to confirm full scope of data access

BUSINESS IMPACT
• 12-hour operational downtime
• Estimated remediation cost: $180,000 - $250,000
• Breach notification assessment in progress (legal counsel advising)
• Cyber insurance claim filed

IMMEDIATE DECISIONS REQUIRED
1. Approve emergency budget for remediation and enhanced monitoring: $250,000
2. Decision on public/customer notification: legal counsel recommends 2-week assessment
3. Authorize external forensic firm engagement: $80,000

WHAT CHANGES
[3-5 bullet recommendations in business language, with cost and timeline]

Retrieval Practice

The security team writes a post-mortem root cause as: 'User clicked a phishing link.' Legal counsel says this is inadequate for regulatory response. The technical team insists the user is the cause. How would you rewrite the root cause using 5 Whys analysis, and why is the framing important for regulatory and insurance purposes?

Reveal answer

5 Whys analysis from 'user clicked phishing link': Why did the attacker gain access? User clicked a phishing link. Why was the user able to execute the malicious payload? No application allowlisting or macro controls prevented execution of the downloaded stager. Why was there no application control? Application allowlisting was not implemented; risk acceptance decision was made 18 months ago with a plan to revisit. Why was the risk acceptance not revisited? No formal security control review process exists tied to threat landscape changes. Why does no formal review process exist? The security program lacks a governance framework mapping controls to threats and requiring regular gap analysis. Root cause: absence of a security governance framework that maps controls to active threats and triggers regular review of accepted risks. This framing matters for: (1) Regulatory response: GDPR and HIPAA assess whether 'appropriate technical and organizational measures' were implemented. 'User clicked link' suggests the organization had appropriate measures but a human failed — implies no systemic failure. 'No governance framework for control review' reveals a systemic gap in organizational measures — more honest but also supports a more structured remediation narrative. (2) Insurance: cyber insurers assess whether the organization had reasonable security practices. A root cause showing systemic process gaps may affect claim coverage; a well-documented remediation plan showing the gap is addressed supports the claim. (3) Future litigation defense: a systemic root cause with documented remediation shows the organization responded to the systemic issue — harder to argue negligence if the root cause was addressed.