## Purpose

Use this template as an initial communication when an incident may affect customers, suppliers, or other external parties but the investigation is not yet complete.

A holding statement should acknowledge the situation without making claims that have not yet been verified.

It should be adapted to the actual incident and reviewed by leadership and legal advisers where appropriate.

## Initial Holding Statement

**Subject: Security Incident Update**

We are currently investigating a cybersecurity incident affecting [SYSTEM / SERVICE / AREA].

We identified the issue on [DATE / TIME] and have taken steps to contain the situation and investigate its scope.

At this stage, our investigation is ongoing. We are working with [OUR INTERNAL TEAM / IT PROVIDER / CYBERSECURITY SPECIALISTS] to establish what occurred, determine whether information or services have been affected, and restore normal operations safely.

We will provide further information when we have verified details that are relevant to you.

If you experience any unusual activity or have an urgent question relating to this incident, please contact:

[CONTACT METHOD]

Thank you for your patience while we investigate.

[COMPANY NAME]

## Optional Service Disruption Wording

**If service availability is affected:**

“We are currently experiencing disruption to [SERVICE]. Our recovery team is working to restore the service safely. We will provide further updates as recovery progresses.”

## Optional Data Investigation Wording

If data exposure is being investigated but is not confirmed:

“We are investigating whether any information was accessed or affected. We will contact relevant parties directly if our investigation determines that further action is required.”

## Avoid Premature Statements Such As

- “There was no data breach.”

- “No customer information was accessed.”

- “The attacker has been completely removed.”

- “There will be no further disruption.”

- “The incident is fully resolved.”

Unless those statements have been appropriately verified.

## Approval Record

Prepared by: ____________________

Approved by: ____________________

Legal review: ____________________

Version: ____________________

Date/time approved: ____________________

## Practical Rule

Communicate what is known, distinguish it from what is still being investigated, and never create certainty that the evidence does not support.