Write a plain language incident postmortem for any outage or breach

After any incident affecting customer data or uptime, publish a postmortem within five business days covering what happened, the timeline, the root cause, and the specific changes made to prevent recurrence. Send it directly to affected accounts by email before posting it publicly.

Why it works: How a vendor communicates after an incident matters more to security buyers than the incident itself, since it shows how they will handle the next one.