Security incident report

Template: Report suspected incidents promptly using approved escalation channels. Keep credentials, exploit details, personal data and forensic evidence in restricted systems—not in public documentation.

Field	Value
Incident ID	[Identifier]
Reported at	[Date, time and time zone]
Reporter / incident owner	[Role or name]
Affected service	[Service]
Classification / severity	[Category and level]
Status	[Investigating / Contained / Resolved]

1. Initial observations

What was observed: [High-level factual summary]

First detected: [Date, time, source]

Potentially affected assets or users: [High-level scope; mark unverified claims]

Evidence location: [Restricted case ID or approved evidence repository]

2. Response timeline

Time (with zone)	Action or observation	Responsible role	Evidence reference
[Time]	[Event]	[Role]	[Restricted ID]

3. Containment and recovery

• [ ] Appropriate response owner and escalation team notified
• [ ] Incident scope and known facts distinguished from hypotheses
• [ ] Evidence preserved under applicable policy
• [ ] Containment actions approved and logged
• [ ] Recovery steps tested and service monitored
• [ ] Internal/external notification obligations assessed by authorized personnel

4. Review

Confirmed impact: [Facts and remaining uncertainty]

Root cause: [Confirmed / Under investigation]

Remediation: [Action, owner, due date]

Lessons learned / prevention: [Controls and follow-up]

Closure authorized by: [Name, role, date]