Report early, then improve the facts
The first report should clearly separate confirmed facts, current scope, containment already performed, evidence still being collected, and the next update time. Waiting for perfect forensics can miss the deadline; presenting assumptions as facts creates a different risk. Build a process for progressive, attributable updates.
Design for fast scoping
Maintain a current data map, synchronized clocks, durable application and identity logs, request identifiers, processor contacts, and an incident decision log. Minimize where plaintext exists. If sensitive fields are replaced with opaque references on selected application paths, a database exposure on those paths may have a smaller data impact than an equivalent plaintext dump.
Say only what the evidence proves
A vault audit trail can show whether configured token reveal operations occurred through that vault during the investigated period. It cannot prove that no personal data left through an unmanaged export, an unintegrated service, a compromised endpoint, or another plaintext copy. Incident statements must preserve that boundary.
Run the six-hour drill
Choose a realistic data-leak scenario and time five actions: detect, preserve evidence, identify the reportable category, notify accountable leaders, and send the initial report. Capture gaps as engineering work. Repeat until the team can produce a defensible initial statement without inventing certainty.