Sorry not to have a good link, but my thought is you want to cover:

**What happened?**

 - When did it happen, and for how long did it continue?
 - Who did it and how?
 - What was affected - what sites, what servers, how many servers, what part of the business?  What customers?

**What was the impact?**

- Damage to servers
- Damage/exposure of information
- Damage to corporate reputation
- Damage to human life (crossing fingers that this is a definite no!!!)

**Halting/Preventing**

 - What has been done so far?  Break it down into immediate response vs. ongoing updates 
 - What else should be done?
 - What is the projection for this happening again? 
 - What about something like this, but not exactly the same?
 - Are there any changes we could make to future process to prevent/mitigate this type of risk?  

Break into past/present/future - what did we do immediate, what are we doing now, what are the big things we should do in the future that will require high level funding?

**Future Prognosis**

 - If we do everything in the report what is the likely state of the system to future attacks.  Probably not "bulletproof", so give some assessment of likelihood.
 - How about if we just leave the system in it's current (partially fixed?) state?