Security Incident Report

SECURITY INCIDENT REPORT
Directions: The reporting employee or witness needs to complete Section 1 and Section 2. If needed, the employee or witness can consult with the security officer to complete Section 2.

Please Note: All persons who contribute information to the report should be recorded in the “Report Augmented By” field. The completed form should be submitted within 24 to 48 hours of discovery of the incident or event.
Section 1: Incident Reporter
Name*
Organization Name*
Phone Number
Job Title
Email Address*
Section 2: Incident Details

Details of the incident
Estimated Time of Incident*

MonthDayYear
DateHourMinutesAM/PM Option
Estimated Time of Incident Started*

MonthDayYear
DateHourMinutesAM/PM Option
Sensitive Data Compromise Suspected?*

YesNoNot Sure
Anti-Virus Software installed, enabled and updated?*

YesNoNot SureNot Applicable
Description of Incident*
Location of Incident*
Current Status of Incident*
Source or Cause of Incident (if known)*
Employees, Contractors or Other with Incident Knowledge - List all known potential witnesses*
Operating System, version and patch level
Description of Affected Resources
Mitigating Factors
Estimated Technical Impact of Incident
Response Action Performed
Other Organizations Contacted
Additional Comments, if any
I understand that by submitting this Incident Report in good faith, I cannot be subject to retaliation. I attest that the information contained in this Incident Report is true and accurate to the best of my knowledge. If I obtain any additional information regarding this incident, I agree to provide said supplementary information to the designated Incident Handler. I agree to cooperate fully with all investigators of this incident until the incident is closed.
Incident Reporter's Signature*

Clear
This Report is based on the guidelines found in Appendix 3 of NIST SP 800-61 Rev. 1: Computer Security Incident Handling Guide. A list of all NIST 800 publications can be found at http://csrc.nist.gov/publications/PubsSPs.html.
Should be Empty:

SECURITY INCIDENT REPORT

Section 1: Incident Reporter

Section 2: Incident Details