What Is a Cybersecurity Incident Report?
A cybersecurity incident report is a formal document that records the detection, investigation, containment, eradication, and recovery activities associated with a security event that compromises the confidentiality, integrity, or availability of information systems or data. Unlike physical incident reports that focus on a single moment in time, cybersecurity incidents unfold over hours, days, or weeks and may involve multiple attack vectors, lateral movement across network segments, and data exfiltration that is not discovered until long after the initial compromise. The incident report must capture this extended timeline with forensic precision.
The cybersecurity incident report serves as the central record for a rapidly expanding web of legal and regulatory obligations. All 50 states have data breach notification laws with varying definitions of personal information, notification timelines, and safe-harbor provisions for encrypted data. Federal regulations add sector-specific requirements: HIPAA for healthcare, GLBA for financial services, FERPA for education, and the SEC's 2023 cybersecurity disclosure rules for public companies. The incident report provides the factual foundation for determining which notification obligations are triggered, crafting legally compliant notification letters, and defending the organization's response if challenged by regulators, class-action plaintiffs, or shareholders.
Beyond legal compliance, the cybersecurity incident report drives the technical response. It documents the attack vector, indicators of compromise (IOCs), affected systems, compromised accounts, data at risk, containment measures, eradication steps, and recovery procedures. This information enables the incident response team to coordinate effectively, ensures that forensic evidence is preserved for potential law enforcement referral, and provides the lessons-learned foundation for improving detection and prevention capabilities. Organizations that maintain rigorous incident documentation consistently achieve faster containment times and lower breach costs.
Breach Notification Compliance
Determine which state and federal notification laws apply and meet their deadlines
Forensic Evidence Chain
Preserve digital evidence with proper chain of custody for legal and regulatory proceedings
NIST-Aligned Response
Structure incident documentation following the NIST CSF Respond and Recover functions
Cybersecurity Incident Report Form Preview
Below is a condensed preview of the key sections in a cybersecurity incident report. Your completed document will be customized based on the incident type, affected data categories, applicable regulations, and your organization's incident response plan.
CYBERSECURITY INCIDENT REPORT
Case ID: [IR-YYYY-NNN] Severity: [Critical / High / Medium / Low]
1. INCIDENT IDENTIFICATION
Detection date: [Date/Time UTC] Detection method: [SIEM / IDS / User Report / Third Party]
Type: [Ransomware / Data Breach / Unauthorized Access / DDoS / Other]
2. AFFECTED SYSTEMS & DATA
Systems: [Servers, endpoints, cloud services]
Data categories: [PII / PHI / Financial / IP / Credentials]
3. CONTAINMENT & ERADICATION
Actions: [Network isolation, account disabling, malware removal]
4. NOTIFICATION OBLIGATIONS
State laws: [Applicable states] Federal: [HIPAA / SEC / GLBA / N/A]
Key Components of a Cybersecurity Incident Report
A thorough cybersecurity incident report must capture both the technical forensic details and the legal and business impact information needed for regulatory compliance and executive decision-making.
Incident Classification and Severity
Incident type (ransomware, data breach, unauthorized access, DDoS, insider threat, phishing compromise), severity level based on the organization's incident classification matrix, and the initial assessment of business impact. Severity determines the escalation path, response team composition, and executive notification requirements.
Attack Vector and Indicators of Compromise
How the attacker gained initial access (phishing, exploited CVE, stolen credentials, supply chain compromise), the specific IOCs identified (malicious IP addresses, domains, file hashes, registry keys, command-and-control URLs), and the tools, techniques, and procedures (TTPs) observed, mapped to the MITRE ATT&CK framework where possible.
Affected Systems and Data Inventory
Complete inventory of compromised systems (hostnames, IP addresses, operating systems, roles), compromised user accounts, and data categories at risk. For data breaches, document the specific data elements exposed (names, SSNs, dates of birth, financial account numbers, PHI, credentials) and the estimated number of affected individuals, because these determine which notification laws apply.
Containment, Eradication, and Recovery
Chronological log of all response actions: network segmentation, account disablement, malware quarantine, patch deployment, credential rotation, system rebuilds, and data restoration from backups. Document who authorized each action, when it was executed, and its effectiveness. This timeline demonstrates the organization's diligence to regulators and insurers.
Legal and Regulatory Analysis
Identification of all applicable breach notification laws (by state of residence of affected individuals), federal regulatory requirements (HIPAA, GLBA, SEC), contractual notification obligations (to customers, vendors, payment processors), and the deadlines for each. Document whether encryption or other safe-harbor provisions apply that may exempt the organization from notification.
Forensic Evidence and Chain of Custody
Inventory of all evidence collected — disk images, memory dumps, log exports, network captures, malware samples — with SHA-256 hashes, collection timestamps, the analyst who collected each item, and the secure storage location. Chain of custody documentation is essential if the evidence may be used in criminal prosecution or civil litigation.
How to Write a Cybersecurity Incident Report
Cybersecurity incident documentation must begin at the moment of detection and continue through containment, eradication, recovery, and lessons learned. Follow these steps to produce a report that satisfies forensic, legal, regulatory, and business requirements.
Activate the incident response plan and assign roles
Declare the incident, classify its severity, and assemble the incident response team. Assign the incident commander, forensic analyst, legal counsel, communications lead, and executive sponsor. Begin the incident log — a running chronological record of every action, decision, and communication from this point forward.
Preserve evidence before containment
Before taking any action that could alter forensic artifacts, capture memory dumps from running systems, export relevant logs, and initiate full disk images of compromised endpoints. Document hash values, timestamps, and the chain of custody for all evidence. This step is critical — containment actions like network isolation and account disablement will change the state of the systems.
Contain and eradicate the threat
Isolate compromised systems from the network, disable compromised accounts, block malicious IP addresses and domains, and remove malware. Document every containment and eradication action with the time it was taken, who authorized it, and its observed effect. Verify eradication by scanning for residual IOCs.
Assess data exposure and notification obligations
Determine what data was accessed or exfiltrated, how many individuals are affected, and in which states they reside. Cross-reference with state breach notification statutes and federal requirements (HIPAA, SEC, GLBA) to identify all notification obligations and their deadlines. Engage breach counsel to advise on privilege, safe harbors, and notification content.
Compile the formal incident report
Synthesize the incident log, forensic findings, data exposure analysis, and notification assessment into the formal report. Include the attack timeline, root cause analysis, business impact, remediation actions, and recommendations for preventing recurrence. The report should be reviewed by legal counsel before distribution to preserve attorney-client privilege where appropriate.
Conduct lessons learned and update controls
Within two weeks of incident closure, convene a lessons-learned session with all stakeholders. Document what worked, what failed, and what should change. Update detection rules, incident response procedures, access controls, and employee training based on the findings. Attach the lessons-learned summary as an appendix to the incident report.
Frequently Asked Questions
Common questions about cybersecurity incident reporting, data breach notification, forensic evidence, regulatory compliance, and insurance considerations.
Official Resources
Federal cybersecurity agencies, frameworks, and reporting portals for incident response and breach notification compliance.
CISA - Cybersecurity Incident Response
Federal resources for incident reporting and response coordination
NIST - Cybersecurity Framework
The CSF framework for organizing detection, response, and recovery
FBI IC3 - Internet Crime Complaint Center
Report cybercrime to the FBI and access annual threat reports
SEC - Cybersecurity Disclosure Guidance
Rules for public company cybersecurity incident disclosure on Form 8-K
NIST SP 800-61 - Incident Handling Guide
Detailed guidance on detecting, analyzing, and responding to security incidents
HHS - HIPAA Breach Notification Rule
Requirements for notifying individuals and HHS of health data breaches
Create your Cybersecurity Incident Report in under 10 minutes.
Answer a few questions and download a compliant, attorney-drafted document ready for your state.