Moderate impact incident
- Submit initial notification with scope and containment status.
- Indicate affected services and expected restoration timeline.
- Provide technical and management contacts.
High impact incident
- Provide operational impact on essential service delivery.
- Include evidence of spread/degradation risk.
- Provide update cadence for next 24 hours.
Critical / national impact incident
- Trigger emergency coordination and submit priority report immediately.
- Provide continuity risk to essential/public safety services.
- Maintain structured updates until stabilization.
Sharing information safely
- Classify sensitive intelligence before sharing (TLP style handling).
- Use secure/encrypted channels for forensic artifacts.
- Share minimum necessary information for triage and response.
Minimum notification details
Include incident start time, affected critical services, business/public impact, active containment actions, dependency impact, and accountable technical and executive contacts.