One final consideration when preparing documentation is who will read an incident report versus a detailed forensic report. In general, the following are some of the personnel both internal and external to an organization that may read the reports associated with an incident:
- Executives: High-profile incidents may bring the attention of the CEO or CFO, especially if they involve the media. The executive summary may suffice, but do not be surprised if the senior leadership requires a more detailed report and briefing during and at the conclusion of an incident.
- Information technology personnel: These individuals may be the most interested in what the incident response analysts have found. Most likely, they will review the root cause ...
