An incident report that tries to satisfy every audience on page one usually satisfies none. Lead with confirmed facts: detection time, containment status, and systems known to be involved. Speculation belongs in a clearly labelled appendix.
Operations need timelines and actions taken. Risk committees need impact language and residual exposure. Insurers often want evidence of controls that were already in place. Structure the document so each group can find its section without re-reading the whole narrative.
Visuals help when they show sequence and scope — not when they decorate. A simple phase diagram of detect, contain, eradicate, recover is enough for most first drafts.
Leave room to update. The first report after a material incident is rarely the last. Version the document and note what changed between versions so stakeholders trust the revision history.