During a business-critical outage, the SOC analyst is building an incident stakeholder map while containment is underway and recovery is beginning. Which communication assignment is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Think of incident updates like airport announcements: executives need the flight status, not the engine blueprint. You should give leadership the business impact, recovery progress, and expected restoration time. If you bury them in packet captures or forensic timelines, the people making business decisions can't act fast.
Full Explanation
Incident communications should be tailored by audience and incident phase, not sent as one broadcast. Executive leadership owns business risk, customer impact, and recovery decisions, so their updates need concise business-impact status, containment or recovery progress, expected restoration time, and any major decisions required. That keeps the response focused while preserving operational tempo.
Engineering leads need technical triage details, affected systems, and remediation tasks, so giving them only high-level business-impact summaries would slow containment and recovery. Legal counsel needs guidance on evidence preservation, notice obligations, and approved wording, not raw packet captures by default, because raw network artifacts are forensic inputs rather than routine legal briefings. Customer support needs approved external messaging, customer-facing symptoms, workarounds, and escalation paths, not full forensic timelines, because excessive technical detail can create inaccurate or premature public statements.
Exam caveat: choose the audience whose decision needs match the requested information, not the team closest to the technical work. Operational check: before sending, ask whether the recipient needs a business decision, a technical action, a legal instruction, or customer-facing language.