The document is read in order and mostly not to the end. What appears first is what gets done, which makes the ordering a decision about outcomes rather than about presentation.
The order
1 What someone can do today
Three sentences. Concrete, about this company.
2 What we are fixing this week, free
Already started, ideally already finished by the
time this is read.
3 The two live incidents
The expired signature, and the operational
lookalike. What was done and when.
4 The estate table
One row per domain, four surfaces, a tier.
5 The plan: 30 / 90 / 365, with owners and criteria
6 What we are not doing, and why, with triggers
7 Evidence appendix
Queries, answers, timestamps, manifests.Why this order
| Choice | Reason |
|---|---|
| Capability before configuration | A reader who does not run DNS needs the consequence before the detail. "Anyone can send invoices as us" lands; "p=none" does not. |
| Free work second, already done | It establishes that this produces action rather than documents, before any ask is made. |
| Live incidents third | They are urgent and they are also the strongest evidence that the rest matters. |
| The table before the plan | The plan has to be traceable to findings, or it reads as a wish list. |
| Not-doing before the appendix | It is part of the recommendation, not a disclaimer. Burying it looks like hiding it. |
| Evidence last | Nobody reads it, and it must exist. Its presence is what makes the rest credible. |
Length
Sections 1 to 3 should fit on one page and be readable by anyone. Sections 4 to 6 are for whoever will do the work. Section 7 is for whoever disputes a finding. Writing all three audiences into one voice produces a document none of them finish.
Write section 1 last, and make it three sentences
It is the only part guaranteed to be read, and it is the hardest to write because it has to be specific without being technical. “Anyone in the world can send an email that arrives looking exactly like it came from our finance team. Five domains resembling ours were registered in the last ninety days; one is serving a copy of our customer login page. Our marketing domain has not resolved for a significant share of the internet for an unknown period.”