Sorry not to have a good link, but my thought is you want to cover:
What happened?
- When did it happen, and for how long did it continue?
- Who did it and how?
- What was affected - what sites, what servers, how many servers, what part of the business? What customers?
- Root Cause Analysis
What was the impact?
- Damage to servers
- Damage/exposure of information
- Damage to corporate reputation
- Damage to human life (crossing fingers that this is a definite no!!!)
- Cost of Recovery (Time, Equipment, etc.)
Halting/Preventing
- What has been done so far? Break it down into immediate response vs. ongoing updates
- What else should be done?
- What is the projection for this happening again?
- What about something like this, but not exactly the same?
- Are there any changes we could make to future process to prevent/mitigate this type of risk?
Break into past/present/future - what did we do immediate, what are we doing now, what are the big things we should do in the future that will require high level funding?
Future Prognosis
- If we do everything in the report what is the likely state of the system to future attacks. Probably not "bulletproof", so give some assessment of likelihood.
- How about if we just leave the system in it's current (partially fixed?) state?