Bring delayed approvals to owners, flag policy exceptions. Every one is ready to run, and you can adjust it in plain language.
Prepare a reviewable incident report linked to the ticket.
Get an editable security incident report that separates known facts from provisional findings and links back to your incident ticket.
Build a reviewable timeline and provisional cause on the incident ticket.
Your incident lead gets a report draft on the ticket, with a clear timeline and stated customer impact.