# Executive Brief Template v1.0

Ultra-condensed one-page template for executive decision-makers.

---

## Template Structure

### Physical Layout
- **Format:** Single page, letter size (8.5" × 11") or A4
- **Margins:** 0.5" all sides
- **Font:** Monospace 10pt for ASCII version; use clean sans-serif for printed
- **Maximum Lines:** 60 lines of text
- **Sections:** Fixed order, clearly separated

---

## ASCII Template

```
╔═══════════════════════════════════════════════════════════════════════════════╗
║                           EXECUTIVE BRIEF                                     ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  TO:           [Recipient Name/Title]                                         ║
║  FROM:         [Analyst Name]                                               ║
║  DATE:         [YYYY-MM-DD]                                                   ║
║  RE:           [Case Name] - Investigation Summary                            ║
║  CLASSIFICATION: [LEVEL]                                                      ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  1. SITUATION IN 50 WORDS OR LESS                                             ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  [Exactly what was investigated and why. No jargon. One paragraph only.]    ║
║                                                                               ║
║  Example: We investigated John Doe's digital footprint following concerns  ║
║  about unauthorized data access. The investigation covered public records, ║
║  social media, and professional networks over a 30-day period.             ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  2. KEY FINDINGS (MAXIMUM 3)                                                  ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  ■ FINDING 1: [Most important - one sentence only]                            ║
║    Impact: [What this means for the organization]                             ║
║    Confidence: [HIGH/MEDIUM/LOW]                                              ║
║                                                                               ║
║  ■ FINDING 2: [Second most important - one sentence only]                     ║
║    Impact: [What this means]                                                  ║
║    Confidence: [HIGH/MEDIUM/LOW]                                              ║
║                                                                               ║
║  ■ FINDING 3: [Third most important - one sentence only]                    ║
║    Impact: [What this means]                                                  ║
║    Confidence: [HIGH/MEDIUM/LOW]                                              ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  3. RISK SUMMARY                                                              ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  OVERALL RISK: [CRITICAL/HIGH/MEDIUM/LOW]                                     ║
║                                                                               ║
║  ████████░░ Risk Score: XX/100                                                ║
║                                                                               ║
║  Risk Breakdown:                                                              ║
║  ┌─────────────────┬─────────┬─────────────────────────────────────────────┐  ║
║  │ Type            │ Level   │ Brief Description                           │  ║
║  ├─────────────────┼─────────┼─────────────────────────────────────────────┤  ║
║  │ Financial       │ [█/░]   │ [One phrase: e.g., "Funds at risk"]         │  ║
║  │ Reputational    │ [█/░]   │ [One phrase]                                │  ║
║  │ Legal           │ [█/░]   │ [One phrase]                                │  ║
║  │ Operational     │ [█/░]   │ [One phrase]                                │  ║
║  │ Physical Safety │ [█/░]   │ [One phrase]                                │  ║
║  └─────────────────┴─────────┴─────────────────────────────────────────────┘  ║
║                                                                               ║
║  █ = Significant risk    ░ = No significant risk                              ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  4. IMMEDIATE ACTIONS REQUIRED                                                ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  TIMEFRAME    ACTION                                          OWNER           ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║  □ 24 hours   [Highest priority action]                       [Name/Dept]     ║
║  □ 72 hours   [Second priority action]                        [Name/Dept]     ║
║  □ 1 week     [Third priority action]                         [Name/Dept]     ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  5. WHAT WE RECOMMEND                                                         ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  DO:                                                                          ║
║  • [Recommendation 1 - max 10 words]                                          ║
║  • [Recommendation 2 - max 10 words]                                          ║
║                                                                               ║
║  DO NOT:                                                                      ║
║  • [What to avoid - max 10 words]                                             ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  6. WHAT WE DON'T KNOW                                                        ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  Critical Gap: [Most important unknown - one sentence]                        ║
║  Impact: [What we can't decide without this info]                             ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  7. BOTTOM LINE                                                               ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  [Single sentence summary that answers: "Should we be worried?" and "What    ║
║   should we do right now?"]                                                    ║
║                                                                               ║
║  Example: We have verified moderate security concerns requiring immediate    ║
║  password resets and additional monitoring for 90 days.                    ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  CONTACT: [Name] | [Email] | [Phone] | Full report: [Reference/Link]         ║
║  Confidence Level: [XX%] | Methodology: Public records only | Legal: ✓ Reviewed║
║                                                                               ║
╚═══════════════════════════════════════════════════════════════════════════════╝
```

---

## Section-by-Section Guidelines

### Section 1: Situation

**Rules:**
- Maximum 50 words
- One paragraph only
- No technical terms
- Explain both WHAT and WHY

**Good Example:**
```
We investigated concerns about unauthorized data access by reviewing John Doe's 
public digital footprint including social media, professional networks, and public 
records over 30 days.
```

**Bad Example:**
```
OSINT investigation conducted utilizing advanced reconnaissance techniques including 
domain enumeration, social media scraping, and metadata analysis to identify potential 
indicators of compromise in subject's digital attack surface.
```

---

### Section 2: Key Findings

**Rules:**
- Maximum 3 findings
- One sentence per finding
- Include impact statement
- Label confidence clearly

**Finding Format:**
```
■ FINDING: [Subject] [Action] [Object] [Context]
  Impact: [Consequence for organization]
  Confidence: [Level based on source quality]
```

**Example Findings:**
```
■ FINDING 1: John Doe accessed sensitive customer database outside business hours.
  Impact: Potential data breach affecting 10,000+ customer records.
  Confidence: HIGH (verified through 3 sources)

■ FINDING 2: Doe shared confidential information on personal social media account.
  Impact: Intellectual property exposure, competitive disadvantage.
  Confidence: HIGH (screenshot evidence archived)

■ FINDING 3: Doe contacted competitor via encrypted messaging app 12 times.
  Impact: Possible data exfiltration or corporate espionage.
  Confidence: MEDIUM (indirect evidence only)
```

---

### Section 3: Risk Summary

**Risk Score Calculation:**
```
Risk Score = (Impact × Likelihood) + (Threat Level × Vulnerability)

Where:
- Impact: 1-5 (1=minimal, 5=catastrophic)
- Likelihood: 1-5 (1=remote, 5=imminent)
- Threat Level: 1-5 (based on actor capability)
- Vulnerability: 1-5 (based on exposure)

Score Ranges:
0-20:   LOW       (Green)
21-40:  MEDIUM    (Yellow)
41-70:  HIGH      (Orange)
71-100: CRITICAL  (Red)
```

**Risk Matrix:**
```
┌─────────────────┬─────────┬─────────────────────────────────────┐
│ Risk Type       │ Status  │ Meaning                             │
├─────────────────┼─────────┼─────────────────────────────────────┤
│ Financial       │ ████░░░░ │ Moderate - $50K-250K potential    │
│ Reputational    │ ████████ │ Critical - Media coverage likely  │
│ Legal           │ ██░░░░░░ │ Low - Compliance review needed    │
│ Operational     │ ██████░░ │ High - Business disruption risk   │
│ Physical Safety │ ░░░░░░░░ │ None - No physical threats found  │
└─────────────────┴─────────┴─────────────────────────────────────┘
```

---

### Section 4: Immediate Actions

**Action Format:**
```
[ ] [TIMEFRAME] [SPECIFIC ACTION] [OWNER]
```

**Priority Levels:**
- **24 hours:** Stop immediate harm, secure critical assets
- **72 hours:** Mitigate ongoing risk, begin investigation
- **1 week:** Implement monitoring, complete review

**Examples:**
```
□ 24 hours   Revoke Doe's system access and credentials      IT Security Lead
□ 24 hours   Preserve all Doe's system logs and emails       Legal/IT
□ 72 hours   Forensic review of accessed customer data       Data Protection
□ 72 hours   Notify affected customers if breach confirmed   Communications
□ 1 week     Complete audit of Doe's access history          Compliance
□ 1 week     Implement additional access controls            IT Security
```

---

### Section 5: Recommendations

**Format:**
- Maximum 2 "DO" items
- Maximum 1 "DO NOT" item
- Each item: maximum 10 words

**Examples:**
```
DO:
• Initiate formal internal investigation immediately
• Engage external legal counsel within 48 hours

DO NOT:
• Confront Doe before legal review complete
```

---

### Section 6: Critical Gap

**Purpose:** Identify the most important unknown that affects decision-making.

**Format:**
```
Gap: [What we don't know]
Impact: [Why it matters for decisions]
```

**Examples:**
```
Gap: Whether Doe shared data with competitor.
Impact: Cannot assess full scope of damage or legal exposure.

Gap: Doe's motivation for accessing database.
Impact: Unclear if malicious intent or negligence.

Gap: Whether other employees involved.
Impact: Single incident vs. coordinated breach changes response.
```

---

### Section 7: Bottom Line

**Rules:**
- Exactly one sentence
- Must answer two questions:
  1. Should we be worried? (Yes/No/Qualified)
  2. What should we do right now? (Primary action)

**Examples by Risk Level:**

**CRITICAL:**
```
We have confirmed active data exfiltration requiring immediate system lockdown, 
legal engagement, and potential law enforcement notification within 24 hours.
```

**HIGH:**
```
We have verified significant security concerns requiring immediate access revocation 
and 90-day enhanced monitoring of affected systems.
```

**MEDIUM:**
```
We have identified potential policy violations requiring internal review and 
enhanced supervision for 30 days pending further investigation.
```

**LOW:**
```
We have found minor compliance issues that can be addressed through standard 
HR procedures without immediate business impact.
```

---

## Color Coding for Printed Version

### Recommended Colors (for printed/screen display)

| Section | Color | Usage |
|---------|-------|-------|
| CRITICAL risk | Red (#DC2626) | Header, risk score, urgent items |
| HIGH risk | Orange (#EA580C) | Risk indicators |
| MEDIUM risk | Yellow (#CA8A04) | Warnings |
| LOW risk | Green (#16A34A) | Positive indicators |
| Headers | Navy (#1E3A8A) | Section titles |
| Text | Black (#000000) | Body text |

### Visual Elements

**Risk Indicator Boxes:**
```
┌─────────────────────────────────────┐
│  🔴 CRITICAL RISK DETECTED          │
│  Immediate Action Required          │
└─────────────────────────────────────┘
```

**Checklist Items:**
```
☐ Incomplete    ☑ Completed    ⚠ Attention Required
```

---

## Quality Checklist

Before finalizing the Executive Brief:

- [ ] Total length is exactly one page
- [ ] Situation section is ≤50 words
- [ ] Maximum 3 findings included
- [ ] Each finding is one sentence
- [ ] No technical jargon used
- [ ] Risk score calculated and displayed
- [ ] At least one action item per timeframe (24h, 72h, 1w)
- [ ] Bottom line answers both required questions
- [ ] Contact information complete
- [ ] Confidence level stated
- [ ] Legal review completed (if marked)
- [ ] Classification level marked
- [ ] Can be understood by non-technical executive
- [ ] Printed version fits on one page (if applicable)

---

## Alternative Formats

### Email-Compatible Version (Plain Text)
```
EXECUTIVE BRIEF: [CASE NAME]
Date: [YYYY-MM-DD] | Classification: [LEVEL]

SITUATION:
[50 words max]

KEY FINDINGS:
1. [Finding] | Impact: [Impact] | Confidence: [Level]
2. [Finding] | Impact: [Impact] | Confidence: [Level]
3. [Finding] | Impact: [Impact] | Confidence: [Level]

RISK: [LEVEL] (Score: XX/100)
- Financial: [Level] | Reputational: [Level] | Legal: [Level]

ACTIONS REQUIRED:
24 hours: [Action] | Owner: [Name]
72 hours: [Action] | Owner: [Name]
1 week: [Action] | Owner: [Name]

BOTTOM LINE: [One sentence]

Contact: [Name] | [Email] | Full report: [Link]
```

### Mobile-Optimized Version (SMS/Slack)
```
[CASE] Risk: [LEVEL] | Score: XX/100

Top Finding: [One sentence]

Action Needed: [Primary action] by [Timeframe]

Details: [Link to full brief]
Contact: [Name] [Phone]
```

---

## Example Completed Brief

```
╔═══════════════════════════════════════════════════════════════════════════════╗
║                           EXECUTIVE BRIEF                                     ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  TO:           CEO, Chief Legal Officer                                       ║
║  FROM:         Senior Intelligence Analyst                                  ║
║  DATE:         2024-01-27                                                   ║
║  RE:           Project Phoenix - Investigation Summary                        ║
║  CLASSIFICATION: CONFIDENTIAL                                                 ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  1. SITUATION IN 50 WORDS OR LESS                                             ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  We investigated former employee John Doe following reports of unauthorized  ║
║  database access. Review covered 30 days of public records, social media,    ║
║  and professional networks to assess data security impact.                   ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  2. KEY FINDINGS (MAXIMUM 3)                                                  ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  ■ FINDING 1: Doe downloaded 15,000 customer records 2 days before resigning. ║
║    Impact: Complete customer PII potentially compromised.                     ║
║    Confidence: HIGH (verified through system logs, 3 sources)                ║
║                                                                               ║
║  ■ FINDING 2: Doe now employed by primary competitor, announced 1 week later.   ║
║    Impact: Trade secret theft, competitive disadvantage.                      ║
║    Confidence: HIGH (LinkedIn, public announcement)                          ║
║                                                                               ║
║  ■ FINDING 3: Doe contacted 3 current employees via LinkedIn last week.     ║
║    Impact: Possible recruitment or solicitation of additional data theft.       ║
║    Confidence: MEDIUM (indirect evidence only)                               ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  3. RISK SUMMARY                                                              ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  OVERALL RISK: HIGH                                                           ║
║                                                                               ║
║  ████████████████░░ Risk Score: 78/100                                        ║
║                                                                               ║
║  Risk Breakdown:                                                              ║
║  ┌─────────────────┬─────────┬─────────────────────────────────────────────┐  ║
║  │ Type            │ Level   │ Brief Description                           │  ║
║  ├─────────────────┼─────────┼─────────────────────────────────────────────┤  ║
║  │ Financial       │ ████████│ $2M+ liability exposure, regulatory fines  │  ║
║  │ Reputational    │ ██████░░│ Customer trust erosion likely              │  ║
║  │ Legal           │ ████████│ GDPR violation, notification required       │  ║
║  │ Operational     │ ████████│ Customer database rebuild required          │  ║
║  │ Physical Safety │ ░░░░░░░░│ No threat identified                        │  ║
║  └─────────────────┴─────────┴─────────────────────────────────────────────┘  ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  4. IMMEDIATE ACTIONS REQUIRED                                                ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  □ 24 hours   Preserve all system logs and access records    IT Legal      ║
║  □ 24 hours   Engage external forensics firm                 Legal/Procurement║
║  □ 72 hours   Determine scope of accessed data                Forensics      ║
║  □ 72 hours   Prepare customer notification strategy        Comms/Legal    ║
║  □ 1 week     Complete forensic analysis and report         Forensics      ║
║  □ 1 week     Engage regulatory counsel if breach confirmed Legal          ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  5. WHAT WE RECOMMEND                                                         ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  DO:                                                                          ║
║  • Treat as confirmed data breach pending forensics                           ║
║  • Notify cyber insurance carrier immediately                                 ║
║                                                                               ║
║  DO NOT:                                                                      ║
║  • Contact Doe directly before legal strategy finalized                       ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  6. WHAT WE DON'T KNOW                                                        ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  Critical Gap: Whether Doe has already shared data with new employer.        ║
║  Impact: Cannot assess competitive damage or need for injunction.            ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  7. BOTTOM LINE                                                               ║
║  ───────────────────────────────────────────────────────────────────────────  ║
║                                                                               ║
║  We have verified serious data exfiltration requiring immediate forensics   ║
║  engagement, potential law enforcement notification, and customer breach       ║
║  notification preparation within 72 hours.                                    ║
║                                                                               ║
╠═══════════════════════════════════════════════════════════════════════════════╣
║                                                                               ║
║  CONTACT: Jane Smith | jsmith@company.com | +1-555-0100 | Full report:     ║
║  [Internal Link] | Confidence: 89% | Sources: Public records only | Legal: ✓  ║
║                                                                               ║
╚═══════════════════════════════════════════════════════════════════════════════╝
```

---

*Version: 1.0 | Format: One-page maximum | Last Updated: 2026-02-27*
