Client stories
What the pages did after they left the office
These notes name the commission and a constraint. They are not ratings widgets. One of them records a delay we did not beat.
The chronology matched our ticket stamps once we admitted the mail gateway and the laptop inventory were not on the same clock. The coverage-gap page was longer than I wanted, and I still handed it to the board because it was the first document that did not pretend we had packet capture for the branch routers.
We sent a weekend of printer and imaging-box alerts. The memo put most of them in expected noise and asked three questions about a vendor remote-support account we had forgotten was still active. I wish the turnaround had been two days instead of five; the questions were still the right ones.
Two of our participants disagreed about when the VPN pool filled. The narrative left both versions in the limitations section instead of picking a winner. That made the archive usable for people who were not on the overnight bridge.
I keep local tracking files because we are not buying a monitoring seat. The monthly four-pager is blunt about empty days. Once I renamed columns without a changelog and the briefing spent half its length on that; I have not done it again.
Extended: the credit union window
Mara Ellison brought two weeks of tickets and a mail-gateway export that stamped UTC while the laptop inventory stamped Eastern Time. The first draft of the incident visibility report collapsed those clocks into one column and made the overnight look calmer than it was. She sent the conversion table on a Thursday. The second draft restored fourteen hours of apparent quiet as a timezone artifact, not as collector failure.
The coverage-gap page still listed branch routers with no packet capture. That page traveled with the chronology to the board. We did not add a threat-actor label to compensate.
