Updated:
Get Form Now
A cybersecurity incident report is a written account of a security event. It logs when the event happened, what it affected, who was told and what the team did. This free, fillable PDF template serves IT teams, especially when management needs a report.
Below you will find what the form covers, who usually receives a cyber incident report, a step-by-step guide to each part of the template, and a filled-in example.
A cybersecurity incident report is a structured document that describes one security event, its impact on IT systems, networks or data, and the actions taken after it was found. It gives the response team, managers and auditors the same account of what happened.
A cybersecurity incident is any event that threatens the confidentiality, integrity or availability of information. Common examples include:
The report is different from a periodic cyber security report on threats and weak points across the company. This form covers one incident, from detection to the first response.
Cyber incident reporting starts inside the company: the person who finds the problem tells the IT or security lead, and that lead completes the incident report for management. The template gives that first report a fixed shape, so nothing is left out when the news moves up.
The finished report usually goes to these readers:
Some incidents also need to be reported outside the company, for example to a regulator, a government agency or the people whose data was exposed. Whether that applies depends on your sector, the kind of data involved and where you operate. Ask your legal counsel or compliance lead as soon as an incident is detected or suspected, not only once it is confirmed, because some outside reporting clocks start when an incident is identified.
When you ask, bring three questions: who has to be told (a regulator, an agency, customers or the people affected), through which channel, and by when. The answers differ by sector and by place, so no single rule covers everyone.
Two federal rules show what the answers can look like. Each one applies only to the organizations it names:
The facts this template collects are a starting point for an outside notice. Such a notice may also ask for details the form does not cover, such as the kinds of personal data exposed and how many people were affected.
For many private organizations, telling the FBI or CISA about an attack is a choice, but not for every organization: federal agencies and some regulated businesses have their own reporting rules, so let your counsel confirm which case is yours. The FBI takes reports of cyber crime through its Internet Crime Complaint Center (IC3). A report shared early helps agencies connect cases and warn other targets.
The cyber incident report template collects the core facts of one security event on a single PDF form: the report date, the main contact, the incident details, who was told, the first response, affected systems, the source of the attack, data integrity, notes and an official use part.
A template gives every incident report in your company the same shape. When each report asks the same questions, it is easier to document an event accurately and to spot trends or repeat weak points. That consistency also helps your team respond and recover faster, because the key steps are already laid out.
Most of the form works as Yes or No questions with space for details. A reader can scan the answers in seconds and then read the details only where the answer is Yes.
If your team follows an incident response plan, such as one built on NIST guidance, map each part of the form to a phase of that plan before the first incident. The form then fits the way your team already works.
Gather your facts before you open the security incident report PDF. Having them in front of you makes the template faster to complete and the answers more accurate. Pull together the items below, and add to them as the investigation moves forward.
To fill out the cybersecurity incident report form, work through its parts in order, keep each answer short and factual, and mark any detail you do not know yet as unknown. Update the form once the facts are clear.
Enter the date you are filling out the report. This date helps track how long the response took and keeps the incident timeline in order.
Add the main contact for the incident. This person is the first point of communication for any questions about it. Fill in the following:
Enter the date and time of the incident. Then select the category that fits best:
Use the space provided to describe in detail how the incident was detected. Name the alert, the person or the tool that spotted it.
Check “Yes” or “No” to show whether the relevant parties have been told about the incident. If yes, list the contacts who have been notified.
Check “Yes” or “No” to show whether immediate action was taken after the incident was detected. If it was, describe what was done, such as a device taken off the network or an account locked.
Check “Yes” or “No” to show whether any systems were permanently affected. If so, describe the damage.
Check “Yes” or “No” to show whether the source of the attack is known. If it is, describe the source.
Check “Yes” or “No” to show whether any data was compromised during the incident. If it was, describe the affected data.
Add any other comments about the incident. Check “Yes” or “No” and provide details if there is more information to share.
This part is for the person who receives the report. They add their name, the date the report was received, and any actions taken after receipt.
A cyber security incident report example shows how short, factual answers read on the finished form. The sample below is made up for illustration; replace every detail with the facts of your own incident.
Example: a phishing incident at a small company
Each answer says what is known, what was done and when, and what is still open. That is the level of detail the form needs.
A clear cybersecurity incident report sticks to facts that can be checked, uses plain words and keeps every time in one time zone, so anyone who reads it later can follow what happened without a call to the author.
Once the template is filled in, share it with the people handling the response and keep a signed copy with your security records. A finished security incident report is also useful for a later review, because it shows what worked and what to change next time.
If the containment and recovery work runs long, track it in a cybersecurity incident response report and link the two documents.
Usually the person leading the response fills it out, with input from IT staff and any manager involved. That person’s details go in Step 2.
They overlap, but they are not the same. This template records the event and its impact in a short, structured way. If you also need to track the containment and recovery work in detail, the cybersecurity incident response report may fit better.
Yes. Use one copy of the PDF template for each security incident, so every event has its own record and timeline.
Yes. A suspected event can be recorded too. Mark clearly what is confirmed and what is still being checked, and update the entry as the facts become clear.
This template is for IT and data security events. For an injury, a safety event, or another problem at work, the workplace incident report template is a better fit.
Start as early as you can, even if some fields are blank. You can complete the rest as the facts come in.
Mention them in Step 9, and say where each file is stored. Keep the files themselves with the report so they are easy to find later.
General information, not legal or tax advice.
