Customer or Vendor Incident Holding Statement
Purpose
Use this template as an initial communication when an incident may affect customers, suppliers, or other external parties but the investigation is not yet complete.
A holding statement should acknowledge the situation without making claims that have not yet been verified.
It should be adapted to the actual incident and reviewed by leadership and legal advisers where appropriate.
Initial Holding Statement
Subject: Security Incident Update
We are currently investigating a cybersecurity incident affecting [SYSTEM / SERVICE / AREA].
We identified the issue on [DATE / TIME] and have taken steps to contain the situation and investigate its scope.
At this stage, our investigation is ongoing. We are working with [OUR INTERNAL TEAM / IT PROVIDER / CYBERSECURITY SPECIALISTS] to establish what occurred, determine whether information or services have been affected, and restore normal operations safely.
We will provide further information when we have verified details that are relevant to you.
If you experience any unusual activity or have an urgent question relating to this incident, please contact:
[CONTACT METHOD]
Thank you for your patience while we investigate.
[COMPANY NAME]
Optional Service Disruption Wording
If service availability is affected:
“We are currently experiencing disruption to [SERVICE]. Our recovery team is working to restore the service safely. We will provide further updates as recovery progresses.”
Optional Data Investigation Wording
If data exposure is being investigated but is not confirmed:
“We are investigating whether any information was accessed or affected. We will contact relevant parties directly if our investigation determines that further action is required.”
Avoid Premature Statements Such As
-
“There was no data breach.”
-
“No customer information was accessed.”
-
“The attacker has been completely removed.”
-
“There will be no further disruption.”
-
“The incident is fully resolved.”
Unless those statements have been appropriately verified.
Approval Record
Prepared by: ____________________
Approved by: ____________________
Legal review: ____________________
Version: ____________________
Date/time approved: ____________________
Practical Rule
Communicate what is known, distinguish it from what is still being investigated, and never create certainty that the evidence does not support.