Week 24

In this week's content we will be looking at cyber incident management: chronology, audience and uncertainty through a realistic Level 3 IT context. You will be required to reconstruct a fictional incident from safe evidence and write both a technical incident report and a short public-facing update.

Steps to complete:
1. Sequence shuffled incident events and distinguish timestamp fact from interpretation.
2. Combine the user statement, authentication log and service notes into one chronology.
3. Create columns for confirmed facts, reasonable inferences, unanswered questions and actions already taken.
4. Write a 400-word incident report covering scope, evidence, containment, impact, uncertainty and next steps.
5. Write an 80-word update that is transparent without disclosing unnecessary technical detail or making unsupported claims.
6. Compare the two audiences and identify where tone/detail appropriately changes.

By the end of the session you should have an incident timeline, technical incident report and accurate public-facing update.

Week 24 Student Resource Pack

Last Updated
2026-09-14 09:28:03