During a ransomware incident, your executive sponsor sends this email at 09:15: "Board call at 10:00. Give me the current business impact and what we are doing, in plain terms." You have technical findings but the eradication is still in progress. What should your update to the sponsor prioritise?
- AWhich services are down, the current containment status, and the expected next milestone in plain business language Correct
- BA packet-level breakdown of the C2 beacon intervals and the malware's registry persistence keys
- CA request that the board approve purchasing a new EDR platform before the call begins
- DThe full indicator-of-compromise list so the board can forward it to peer organisations
Why A is correct: An executive update should translate technical status into business impact and next steps, matching the audience and the decision they must support.
Why B is wrong: This is accurate technical detail, but a board-facing sponsor needs business impact and status, not indicators they cannot act on.
Why C is wrong: Procurement decisions belong in the lessons-learned phase, not a mid-incident status update, and pre-empting them derails the sponsor's immediate need.
Why D is wrong: Sharing raw IOCs with a board is the wrong audience and risks premature disclosure; the sponsor asked for impact and actions in plain terms.