All field guidesIncident recovery · Recover

What to tell the client in 30 minutes—and what belongs in the final report

The client needs an update before the cause is confirmed, while operations is still preserving evidence and narrowing the source.

Updated 2026-08-16 · 7 min read
Written for
WordPress agency owner
Article format
Stakeholder explanation
Take-away
reusable explanation note

State the concern plainly

The client needs an update before the cause is confirmed, while operations is still preserving evidence and narrowing the source.

State the concern plainly for “What to tell the client in 30 minutes—and what belongs in the final report”: The client needs an update before the cause is confirmed, while operations is still preserving evidence and narrowing the source. You manage 10–50 client sites, changing contracts, and a team that cannot rely on one spreadsheet.

Separate fact from assumption for “What to tell the client in 30 minutes—and what belongs in the final report”: Protection must be repeatable, explainable to clients, and profitable as a maintenance service.

Separate fact from assumption

Explain the control for this case: Report confirmed facts, impact, containment, and next update time first; reserve cause, responsibility, and prevention for verified findings.

Set expectations for “What to tell the client in 30 minutes—and what belongs in the final report”: identify the evidence that would make this proposed action unsafe—Report confirmed facts, impact, containment, and next update time first; reserve cause, responsibility, and prevention for verified findings.

  • Evidence 4 for “What to tell the client in 30 minutes—and what belongs in the final report”: cost stopped growing
  • Evidence 1 for “What to tell the client in 30 minutes—and what belongs in the final report”: clean 15-minute test
  • Evidence 2 for “What to tell the client in 30 minutes—and what belongs in the final report”: one-hour stability
  • Evidence 3 for “What to tell the client in 30 minutes—and what belongs in the final report”: next-day customer impact

Explain the control

Ask for one decision for this exact problem: the acceptable end state must resolve the original condition—The client needs an update before the cause is confirmed, while operations is still preserving evidence and narrowing the source.

reusable explanation note decision for “What to tell the client in 30 minutes—and what belongs in the final report”: Report confirmed facts, impact, containment, and next update time first; reserve cause, responsibility, and prevention for verified findings.

Set expectations

Build the reusable explanation note for “What to tell the client in 30 minutes—and what belongs in the final report.” Lead with confirmed facts and business impact. Separate assumptions, explain what is controlled and what remains open, and ask the reader for one named decision.

Ask for one decision

Do not let the recovery record from “What to tell the client in 30 minutes—and what belongs in the final report” become a document nobody reopens. Download AI Cost Circuit Breaker and turn the boundary in your reusable explanation note into a free guardrail before the same failure returns.

Next field guideAfter credential exposure, recovery means revocation—not just hiding the screenshot