A holding statement is a short, pre-approved message you can publish within the first hours of an incident, before you know the facts. It confirms that you are aware, that you are investigating, how customers can reach you and when you will update. It avoids cause, scope and blame.
Why prepare one
In the first hour people are tired and the pressure to say something is high. Without a template, teams either say nothing, which fuels rumours, or say too much, which later turns out wrong. A reviewed template removes the argument.
What goes in
- Acknowledgement. "We are aware of an issue affecting [service or area]."
- Action. "Our security and engineering teams are investigating."
- Customer guidance, only if you are certain of a safe step, such as "no action is needed at this time" when that is confirmed, or a link to where to look for updates.
- Contact. A named channel.
- Next update time. A specific time, not "soon".
What stays out
- Root cause, attacker identity or motive.
- Counts of affected people or records you have not verified.
- "No evidence" statements, until you know what evidence you can collect. See why "no evidence of misuse" needs care.
- Promises about outcomes.
Template
We have become aware of a security issue affecting [area]. We are investigating with our security team [and outside specialists, if true]. We will share an update by [time and date, timezone]. If you have questions, contact [channel]. We will post all updates at [URL].
Keep a variant for a service outage with a suspected cause, and one for an issue reported by a third party.
Pre-approval
Have legal, the incident lead and a communications owner approve the text once a year. Record who can publish it without further review, and on which channels: status page, website banner, customer email, social account. Store it where it can be reached when your normal systems are down, and test that.
After the holding statement
Plan the next message within hours, using facts only. Replace the statement with the notice described in what a customer breach notice must say once scope is known.
Quick check
Should we publish if we are not sure there is an incident?
If customers can see effects, post availability facts. If the issue is internal and unconfirmed, usually wait, but decide using your written criteria.
Who approves publication at night?
Name a delegate with authority, so the process does not depend on one person being awake.
Last reviewed: 19 October 2026.
