The Incident Notification Drafter

Help me draft an incident notification.

Incident type: [DESCRIBE — e.g. data breach, reportable
event, control failure]
What is known so far: [FACTS ESTABLISHED]
What is still being investigated: [OPEN QUESTIONS]
Who may need to be notified: [REGULATOR / AFFECTED PARTIES /
INSURER / INTERNAL]
Any stated notification window: [TIMEFRAME IF KNOWN]

Produce:
1. A factual notification stating what is known, precisely,
   separated from what is still under investigation
2. Versions tailored to each audience, since a regulator, an
   affected individual, and an insurer need different things
3. What NOT to state yet because it is unconfirmed, and how
   to say an investigation is ongoing without appearing
   evasive
4. Remediation and containment steps taken, factually
5. A holding line for information not yet available
6. A list of what must be confirmed before this goes out
7. Points that carry legal or privilege implications, flagged
   for review

Constraints:
- Use ONLY confirmed facts I supply; do NOT speculate about
  cause or scope
- Do NOT state notification deadlines or thresholds — mark
  them [CONFIRM APPLICABLE REGIME AND TIMING]
- Do NOT assert what any regulation requires
- Flag clearly where external counsel must review before
  sending