## Communicate Internally

### Notify and Update Stakeholders

* Communicate with stakeholders as part of the initial and update calls, as well as via event-driven updates on the call and chat.
* Coordinate independent updates (_e.g._, executive, legal) as required, but as infrequently as practicable, to keep the focus on investigation and remediation.
* Focus on the best assessment of the vector, impact, summary, and highlights of the timeline including remediation steps.  Do not speculate.

### Notify and Update Organization

* **Do not** notify or update non-response personnel until cleared by the Incident Commander, particularly if there is a risk of an insider threat.
* Coordinate updates for teams or the entire organization with executives and business leadership.
* Focus on the best assessment of the vector, impact, summary, and highlights of the timeline including remediation steps.  Do not speculate.

### Create Incident Report

* Upon incident closure, capture information in the [incident file](#create-incident-file) for distribution.  **If the vector, impact, summary, timeline, and activity reports are complete, this can be fully automated.**
* Distribute the incident report to the following: INCIDENT REPORT RECIPIENTS.
* `TODO: Customize incident report creation and distribution, if necessary`
