Incident Holding Statements
Twenty-four pre-approved holding statements: ransomware, data breach, identity compromise, service outage, supplier breach and OT/safety, each for customers, staff, media and regulators. Plus the ten rules that keep a fast statement safe.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Pre-approved holding statements for six kinds of incident (ransomware, data breach, identity compromise, service outage, supplier breach and OT/safety), each written for customers, staff, media and regulators. Placeholders such as Wide World Freight Ltd, [date] and [contact] stay in the text and are filled in when a statement is used. Agree the rules first: confirmed facts only, no blame, one set of facts for every audience, and a promised time for the next update. The summary flags phrases that tend to be unconfirmed on day one.
Your context
Rules for every holding statement
Agree these with legal and communications before an incident. They are what make a fast statement a safe one.
State only confirmed facts. No speculation about cause, attacker, scale or data affected until the investigation confirms itmaterial
No blame: do not name or blame a supplier, an employee, a country or a threat groupmaterial
Every audience gets the same facts. Statements to customers, staff, media and regulators must not contradict each othermaterial
Approval route is fixed: incident commander confirms facts, counsel reviews, communications lead issues. Pre-approved templates need only fact confirmation
Each statement says when the next update will come, and that promise is kept even if there is little new to say
Tell people what to do (and not do): watch for phishing, reset a password, do not call the attacker's numbers, where to get help
Name one official channel (a status page or incident page) and say that other messages claiming to be from {{org}} may be fraudulent
Never comment on whether a ransom was or will be paid, or on negotiation
If email or collaboration tools may be compromised, statements to staff go out through a separate channel
Regulator and individual notifications are separate legal documents. Holding statements do not replace them and must not contradict them
Ransomware and extortion
For encryption, outage and data-theft extortion. In the generated document {{org}} is filled from your organisation name; placeholders such as {{date}} and {{contact}} stay in the template and are filled in when the statement is used.
Data breach
For confirmed or suspected access to personal or confidential data. In the generated document {{org}} is filled from your organisation name; placeholders such as {{date}} and {{contact}} stay in the template and are filled in when the statement is used.
Identity compromise and account takeover
For stolen credentials, session theft or compromised accounts. In the generated document {{org}} is filled from your organisation name; placeholders such as {{date}} and {{contact}} stay in the template and are filled in when the statement is used.
Service outage (cause not yet known)
For a major outage before anyone knows whether it is a cyber incident. In the generated document {{org}} is filled from your organisation name; placeholders such as {{date}} and {{contact}} stay in the template and are filled in when the statement is used.
Third-party or supplier breach
For incidents at a supplier, SaaS platform or service provider that affect {{org}}. In the generated document {{org}} is filled from your organisation name; placeholders such as {{date}} and {{contact}} stay in the template and are filled in when the statement is used.
OT and safety incident
For incidents that touch industrial or operational systems. Safety messages come first. In the generated document {{org}} is filled from your organisation name; placeholders such as {{date}} and {{contact}} stay in the template and are filled in when the statement is used.
What this template gives you
- The first hour of an incident is the worst time to write a careful statement. Write them now, get them approved, and fill in the facts later.
- Six incident types, four audiences each: customers and partners, staff, media and a regulator cover note.
- The rules are as important as the words: only confirmed facts, no blame, the same facts for every audience, and a time for the next update.
- The summary flags phrases that are usually unconfirmed early on, such as "no data was affected", "fully contained" or "sophisticated attack".
Frequently asked questions
What is a holding statement in incident response?
A short, pre-approved statement that confirms you are aware of an incident and responding, says what people should do, and promises the next update, without speculating about cause or impact. It buys time to establish the facts while showing you are in control.
Should a holding statement say whether data was affected?
Only if it is confirmed. Early on, "we are investigating whether any data was affected and will contact you directly if it was" is accurate. "No customer data was affected" often has to be retracted later, which does more damage than saying less.
Is a regulator holding statement the same as a breach notification?
No. A breach notification is a legal document with required content and deadlines, such as 72 hours from awareness under GDPR. The regulator note in this template is a cover note that goes with it; it does not replace it. Have counsel approve regulator wording.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.