When should I file the report?

File an initial report immediately after detection and document facts within 24 hours. Prompt reporting preserves timelines and supports rapid containment.

Can this report be signed electronically?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in adopted states, provided intent, consent, attribution, and retention requirements are met.

Is notarization required?

Not usually required for internal incident reports; consult counsel if the report will be used as evidence in litigation or if state rules or third parties demand notarization.

How do I preserve chain-of-custody?

Record who collected each artifact, exact times, storage location, and any hashes or checksums. Use tamper-evident storage and retain the collector's contact details.

What if personal health data was exposed?

If protected health information is involved, coordinate with the privacy officer and follow HIPAA requirements, including breach assessment and potential notification under HIPAA rules.

Who should receive a final signed report?

Distribute to the incident response owner, security leadership, legal, compliance, and any business owners impacted; retain a copy in a secure evidence repository.

Electronic Signature
Templates
Miscellaneous
Incident Infiltration Report

Incident Infiltration Report

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

INCIDENT INFILTRATION REPORT AND INVESTIGATION AGREEMENT

Parties and Contact Information

Client Name: Client Contact (address, phone, email): Investigation Provider Name: Provider Contact (address, phone, email):

Recitals

WHEREAS, Client has experienced an alleged infiltration, unauthorized access, or related security incident affecting Client's premises, systems, or data (the "Incident"); and

WHEREAS, Client desires to retain and Investigator is willing to perform incident investigation, evidence preservation, and remediation recommendations in accordance with the terms set forth in this Agreement and the accompanying report; and

WHEREAS, the parties intend by this Agreement to document both the factual Incident Infiltration Report and the scope, payment, confidentiality, and governing terms under which investigative services will be performed.

Scope of Work (Investigation Services)

The Investigator shall perform the following investigative tasks, data preservation, and reporting actions. Describe the specific investigative activities, deliverables, and milestones below.

Incident Report — Factual Record

Incident Report Number:

Incident Date: Incident Time:

Location / System Affected: Reported By (name, role): Immediate Indicators Observed: Evidence Collected / Chain of Custody Summary: Affected Systems / Asset Inventory:

Severity Classification: Low Medium High Critical

Immediate Containment Actions Taken: Recommended Remediation and Next Steps: Estimated Impact / Loss (if known): Witness Statements / Additional Notes:

Attachments Included: System logs Screenshots CCTV/Video Access records Other

Payment Terms

Investigation Fee (Base):

Payment Schedule:

Late Fee:

Billing Contact:

Term and Termination

Term Commencement Date: Term Expiration Date:

Either party may terminate this Agreement for convenience upon providing written notice to the other party not less than days prior to the effective date of termination. Termination for material breach may be immediate if breach is not cured within a commercially reasonable cure period specified in the notice.

Confidentiality

The parties acknowledge that investigative activities will disclose confidential, proprietary, or sensitive information. Each party shall maintain the confidentiality of the other's Confidential Information and shall not disclose such information except as required by law or with written consent. Confidential Information includes, without limitation, technical data, logs, evidence, remediation plans, and personally identifiable information discovered during the investigation. The receiving party shall implement commercially reasonable safeguards to protect Confidential Information and shall limit internal access to personnel with a demonstrable need to know.

Governing Law; Indemnification; Entire Agreement

Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the state of without regard to conflict of laws principles.

Indemnification: Each party agrees to indemnify, defend, and hold harmless the other party from and against any third-party claims, liabilities, losses, or damages arising from the indemnifying party's gross negligence, willful misconduct, or material breach of this Agreement, subject to any limitations of liability expressly set forth herein.

Entire Agreement: This Agreement, together with the attached Incident Report and any Schedules executed by the parties, constitutes the entire agreement between the parties concerning the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, or communications, whether oral or written.

Certifications and Miscellaneous Provisions

The Investigator certifies that investigative activities will be conducted in a manner consistent with industry-accepted forensic practices to preserve evidentiary integrity. Nothing in this Agreement obligates the Investigator to perform services that would require violation of applicable law or professional ethical rules.

The parties acknowledge that timelines for investigation may be affected by availability of data, cooperation of third parties, or legal process; delays will be communicated in writing and reasonable extensions shall be permitted.

Client Printed Name:

By:

Date:

Investigator Printed Name:

By:

Date:

What an Incident Infiltration Report Records

An Incident Infiltration Report documents an unauthorized physical or digital entry into a facility, system, or network. It captures how the infiltration was detected, scope of access or data exposure, immediate containment actions taken, and evidence preserved for investigation. The report is used by security, legal, and compliance teams to assess impact, support incident response, and meet internal and external reporting obligations.

Why a Clear Infiltration Report Matters

A well-prepared Incident Infiltration Report establishes a factual timeline, preserves chain-of-custody for evidence, and documents decisions made during response. That record reduces liability, speeds remediation, and supports regulatory notifications when required under federal or state law.

Who Prepares and Reviews the Report

Final distribution typically includes incident response leads, the CISO or security director, and designated compliance or legal contacts to determine next steps.

Security Operations — documents technical indicators, containment steps, and logs for forensic analysis.
Facility/Physical Security — records entry points, access control logs, and witness statements for on-site infiltrations.
Legal & Compliance — evaluates reporting obligations and preserves evidence for regulators or law enforcement.

Step-by-Step: Completing an Incident Infiltration Report

Follow these sequential steps to ensure a consistent, actionable report that supports investigation and any required notifications.

01

1. Secure Scene: Isolate affected systems or area to prevent further access.
02

2. Record Detection: Document when, how, and by whom the infiltration was discovered.
03

3. Preserve Evidence: Collect logs, images, and physical items with chain-of-custody.
04

4. Summarize Actions: List containment, eradication, and recovery steps taken.

Essential Sections Every Professional Report Includes

A complete Incident Infiltration Report groups factual elements into standard sections so reviewers and investigators can find critical information quickly.

Executive Summary

One-paragraph overview describing the incident, impact, and current status for leadership review.

Timeline

Chronological entries with timestamps for detection, containment, and subsequent actions.

Scope and Impact

Systems, devices, data types, and number of affected accounts or physical areas.

Technical Findings

Indicators of compromise, malware details, access vectors, and forensic observations.

Containment & Remediation

Immediate steps taken, configuration changes, and follow-up tasks assigned.

Evidence Log

Inventory of collected artifacts, collection methods, and chain-of-custody entries.

Required Data Elements for Secure Handling

Encryption: AES-256 at rest

Transport: TLS 1.2/1.3 in transit

Access Control: Role-based permissions

Audit Trail: Timestamped activity log

Chain of Custody: Collector and timestamp recorded

Retention Flag: Preserve evidence hold

Supporting Documents to Attach with the Report

Attach standard supporting material to give investigators immediate access to primary evidence and corroborating information.

System Logs

Relevant server, firewall, and application logs exported in original format with collection timestamps and checksum verification.

Access Control Records

Badge swipes, door logs, VPN session records, and ID images that corroborate physical or remote access times.

Forensic Images

Disk or memory images captured by approved tools; include hash values and capture method notes to maintain integrity.

Witness Statements

Signed or timestamped statements from staff or third parties describing observations and actions taken at the time of the incident.

How to Configure an Online Infiltration Report Workflow

Configure fields, recipient routing, and authentication to match your incident response procedures and evidence handling requirements.

Field	Configuration
Report ID	Auto-generate sequential ID
Attachments	Allow PDF, ZIP, EML; max 250MB
Signer Authentication	Email + optional SMS code
Routing	Auto-notify SOC, legal, and manager

Digital Signing and eSubmission Considerations

Ensure the chosen platform provides AES-256 storage, TLS in transit, and an exportable certificate of completion for each signed report.

File Formats: PDF, DOCX, ZIP permitted
Integrations: SIEM, ticketing, cloud storage
Authentication: Email, SMS code, SSO

Typical Distribution and Escalation Flow

A predictable distribution flow speeds investigation and ensures the right stakeholders receive evidence and status updates without delay.

Submit Report: Reporter uploads report and attachments into the tracking system.
SOC Triage: Security team reviews technical data and classifies severity.
Containment Assignment: Tasks assigned to IT, facilities, or vendors as appropriate.
Legal Review: Compliance and legal determine regulatory notification needs.

Timelines and Common Deadlines to Track

Track internal and external time windows; some regulatory notifications and preservation obligations impose short deadlines.

Immediate Reporting:

Notify SOC and incident lead upon detection; document within 24 hours.

Containment Action:

Complete initial containment within 72 hours when feasible.

Evidence Preservation:

Place legal hold and preserve artifacts until counsel reviews.

Regulatory Notice:

Notification timelines vary by law and industry; consult legal for requirements.

Post-Incident Review:

Conduct root-cause analysis and lessons-learned within 30 days.

Key Milestones in Incident Processing

Track milestones from discovery through closure to maintain accountability and meet reporting obligations.

01

Discovery

Initial detection and first facts logged.

02

Triage

Assess severity and scope of infiltration.

03

Containment

Take steps to stop ongoing access or spread.

04

Remediation

Restore systems and apply corrective controls.

Common Preparation Errors to Avoid

Failing to timestamp actions precisely, which undermines the timeline and forensic value of the report.
Collecting evidence without documenting chain-of-custody, making artifacts less defensible in legal proceedings.
Mixing confirmed facts and speculation in the same section, which confuses reviewers and slows investigation.
Omitting contact information for witnesses or data custodians, causing delays in follow-up and verification.

Consequences of Incomplete or Incorrect Reporting

Regulatory Exposure: State breach laws vary

HIPAA Risk: Potential fines, if PHI exposed

Legal Liability: Civil claims for negligence

Evidence Loss: Forensic value diminished

Operational Impact: Longer remediation timelines

Reputational Harm: Customer trust erosion

How This Report Differs from Related Report Types

Compare the Incident Infiltration Report with related documents to choose the correct record for each situation.

Criteria	Incident Infiltration Report	Security Breach Report
Primary Purpose	forensics & containment	regulatory notification
Legal Use	internal investigation	external reporting
Typical Recipient	soc, legal, facilities	regulators, affected parties
E-sign Eligible

eSignature Pricing Comparison for Incident Report Workflows

Compare common pricing and capability criteria across eSignature providers. signNow is listed first per vendor comparison guidelines.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	Varied
Audit Trail	Yes	Yes	Yes	Yes	Yes
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

FAQs and Troubleshooting for Incident Infiltration Reports

Answers to common questions about creating, submitting, and preserving Incident Infiltration Reports to avoid delays and preserve evidence.

Need help? Contact support

When should I file the report?
File an initial report immediately after detection and document facts within 24 hours. Prompt reporting preserves timelines and supports rapid containment.
Can this report be signed electronically?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in adopted states, provided intent, consent, attribution, and retention requirements are met.
Is notarization required?
Not usually required for internal incident reports; consult counsel if the report will be used as evidence in litigation or if state rules or third parties demand notarization.
How do I preserve chain-of-custody?
Record who collected each artifact, exact times, storage location, and any hashes or checksums. Use tamper-evident storage and retain the collector's contact details.
What if personal health data was exposed?
If protected health information is involved, coordinate with the privacy officer and follow HIPAA requirements, including breach assessment and potential notification under HIPAA rules.
Who should receive a final signed report?
Distribute to the incident response owner, security leadership, legal, compliance, and any business owners impacted; retain a copy in a secure evidence repository.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now