A government agency has told you a nation-state actor is inside your environment. The board needs a brief — but on partial, sensitive facts, and without tipping the adversary or cutting across law enforcement. This template gives you the structure: what you know, assess and don’t know; how the response is coordinated with the agency and counsel; what is being done (and deliberately held); the exposure and disclosure posture; and the decisions you are asking the board to make.
Educational template — not legal advice, and sensitive by nature. Coordinate its contents and timing with counsel and the notifying agency before sharing.
Free · no signup · adapt it in your own doc
APT / Nation-State Notification Board Brief
Privileged & confidential — prepared at the direction of counsel. This brief records what the board is told, and asked to decide, after a government agency (FBI/CISA) notifies the company that an advanced persistent threat (a nation-state actor) is present in its environment. It is written to be shared with care: coordinate its contents and timing with counsel and the notifying agency.
01Situation — what we know, assess, and do not know
Brief with calibrated confidence. Separate verified facts from assessments (with confidence levels) from open unknowns — do not present early assessments as certainty.
Notification received
Date/time and from whom — e.g. FBI field office, CISA
What we KNOW (verified)
Confirmed facts only — e.g. agency assessed actor presence; specific systems confirmed, if any
What we ASSESS (with confidence)
Working hypotheses — entry vector, scope, dwell — each marked high/medium/low confidence
What we DO NOT yet know
Open unknowns — full footprint, data impact, persistence, attribution
Assessed actor type
Nation-state / APT — avoid naming a specific nation until facts and counsel support it
Attribution to a specific nation is a high-stakes claim. State it as an assessment with a confidence level, or not at all, until verified facts and counsel support a public position.
02Source & coordination — agency, law enforcement, privilege
Record how you learned of this, what the agency has asked, and the legal posture of the response. Coordination with the notifying agency is a decision, not an afterthought.
Agency point of contact
Name / agency / channel — keep tight
Agency requests / holds
Any requested hold on actions or disclosure, and the window — documented in writing where possible
Privilege posture
Counsel engaged; investigation run under privilege; core team and need-to-know list
Handling caveats on indicators
e.g. TLP marking; who may see the sensitive indicators
Counsel engaged at the outset; work product created under privilege
Small, documented core team; sensitive indicators restricted to need-to-know
Containment and disclosure timing coordinated with the notifying agency (and documented)
Company retains its own decision authority — cooperation, not surrender of control
Describe what is being done and, importantly, what is being deliberately NOT done yet. A sudden mass wipe-and-reset can destroy evidence and tip the actor; posture changes must be invisible to the adversary.
Action
Status
Rationale / coordination
Evidence preservation
In progress / done
Preserve before any remediation; maintain chain of custody
Quiet expanded monitoring & logging
In progress
Out-of-band, avoiding changes the actor can observe; coordinated with agency
Footprint & persistence hunt
In progress
Assume extended dwell and multiple footholds before eviction
Coordinated eviction plan
Planned — not executed
One coordinated cut-over; timed with counsel and agency — NOT a reflexive wipe tonight
Do NOT reflexively wipe, reimage or force a mass reset before the footprint is understood and eviction is coordinated — doing so can destroy evidence and alert the actor to escalate or go dark.
Scope exposure regardless of whose systems were first touched, and run the disclosure/materiality assessment in parallel with the investigation.
Supply-chain / vendor angle
Possible entry via a managed service provider; whether peers may be affected; vendor coordination
Data & systems potentially affected
Data types, record estimates (marked as estimates), critical systems
Operational / business impact
Current and reasonably likely impact; OT/safety if relevant
Disclosure & materiality posture
Disclosure committee assessing materiality; SEC 8-K Item 1.05 clock runs from a materiality determination — see the 8-K memo
Delay path (if raised)
Item 1.05 delay is narrow: only a US Attorney General national-security/public-safety determination notified to the SEC — route through counsel, do not assume
A law-enforcement request does not by itself pause a securities-disclosure obligation. Assess materiality in parallel and route any delay request through counsel and the formal Attorney General channel.
05Decisions requested of the board
Be explicit about what the board is being asked to approve, note or defer — and resist the urge to over-rotate into premature public action.
Endorse the privileged, counsel-led response structure and the need-to-know model
Approve the coordinated eviction approach (and the decision NOT to wipe/reset reflexively)
Note the disclosure/materiality assessment running in parallel, and the narrow delay path
Approve the communications posture and timing (see next section) — no premature attribution or sweeping notice
Authorise budget/resources for forensics, counsel and agency coordination
Agree a cadence for updated briefings as facts develop
Public attribution and breach notifications should follow verified facts, counsel’s judgment and agency coordination — not the board’s understandable urge to act immediately.
06Communications hold & rationale
External communications are a controlled instrument. Sequence them so you neither tip the actor nor cut across a law-enforcement operation, and keep them consistent with disclosure obligations.
Current comms posture
Hold / limited / staged — and who may speak
Rationale for the hold
Avoid tipping the actor; avoid burning agency visibility; align with disclosure obligations
Trigger to revisit
What facts or events would move us to communicate, and through what channel
Never leak sensitive indicators or agency-restricted material in public or internal comms.
Keep external statements consistent with any securities-disclosure filing and with agency coordination.
One controlled voice — individual employees and directors do not make their own public statements.
Practice the decision
This brief records a call you can rehearse. The free Nation-State Notification Lab drops you into the first hours after the FBI’s call and grades you on ~14 of the exact decisions this brief documents — engage counsel, coordinate with the agency, whether to wipe and reset, how to brief the board, and what not to tip off.
TL;DR
What this template is
A board-ready brief for the moment a government agency (FBI/CISA) notifies you that a nation-state actor is in your environment: what the board is told, and what it is asked to decide.
Sections: the situation (known / assessed / unknown), source and coordination (agency, law enforcement, privilege), actions underway (quiet, coordinated containment), exposure and impact (supply chain, data, operations, disclosure), the decisions requested of the board, and the communications hold and its rationale.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Nation-State Notification Lab.
Educational template — not legal advice. Coordinate its contents and timing with counsel and law enforcement.
Frequently asked questions
What is this template for?+
It is a board brief a company can use when the FBI or CISA notifies it that an advanced persistent threat — a nation-state actor — is present in its environment. It structures what the board is told (what is known, assessed and still unknown), how the response is being coordinated with the agency and counsel, what is being done (and deliberately not done) to contain the actor, the exposure and disclosure posture, and the specific decisions the board is asked to make.
Why does it say not to wipe and reset immediately?+
Against a patient nation-state actor, a sudden mass wipe-and-reset destroys forensic evidence and tips the actor off before you understand their full footprint — they can burrow deeper, detonate, or go dark. The defensible approach is a quiet, coordinated eviction planned with counsel and the notifying agency: preserve evidence, hunt for every foothold, then remove access everywhere at once.
Does an agency notification change our disclosure obligations?+
A law-enforcement request does not by itself pause a securities-disclosure obligation. Assess materiality through your disclosure process in parallel — the SEC Form 8-K Item 1.05 clock runs from determining materiality. The only disclosure-delay mechanism is a US Attorney General determination of substantial risk to national security or public safety, notified to the SEC, so route any delay request through counsel rather than assuming the clock is paused.
Is this legal advice?+
No. It is an educational template, and the regulatory references are summarised for orientation and can change. A real nation-state notification must be worked with qualified counsel and in coordination with law enforcement; adapt this brief to your specific facts with them.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout