5.2. Incident Response Reporting and Communication

💡 First Principle: Incident communication failures compound technical failures — organizations that handle a breach well technically but communicate poorly face regulatory sanctions, customer loss, and reputational damage that dwarf the technical impact of the incident itself.

IR reporting serves multiple, sometimes competing, audiences: technical teams need detail for response; executives need impact assessment for decision-making; regulators need evidence of compliance; customers need to know their data is safe; legal needs defensible documentation. Getting the content and timing right for each audience is as important as the technical response.

⚠️ Common Misconception: "Mean Time to Detect" and "Mean Time to Respond" measure the same SOC capability. MTTD measures monitoring and detection quality — how quickly your tooling and processes surface an incident. MTTR measures response process quality — how quickly you contain and remediate after detection. A SOC can have fast MTTD (good detection) but slow MTTR (inefficient response process), or vice versa.