Who should sign the report

Signatures typically come from the incident owner, SOC lead, and privacy officer. Each sign-off documents verification of technical findings, legal assessment, and notification decisions for audit and compliance purposes.

Can this report be electronically signed

Yes. Under the ESIGN Act and UETA, electronic signatures are legally valid when intent, consent, attribution, and retention are demonstrable; for consumer-facing notices follow ESIGN disclosure requirements.

Do I need notarization or witnesses

Notarization or witness requirements are uncommon for incident reports. Check specific state or contractual obligations; certain legal filings or affidavits may require notarization or witnesses.

How long should I retain reports

Retain reports for the active investigation and at least the statutory minimums that apply to related records; HIPAA requires six years and IRS records typically three years.

What if I discover new evidence after signing

Record an amendment with clear rationale, attach new evidence, obtain required approvals, and preserve the original signed version to maintain auditability.

Which formats should I export

Export the signed report and attachments as a PDF/A with the audit trail included. Preserve original log files and timestamps in native formats for forensic use.

Electronic Signature
Templates
Miscellaneous
Incident Security Report

Incident Security Report

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

INCIDENT SECURITY REPORT

Client Name: Security Provider:

Date of Report: Report Reference No.:

WHEREAS / RECITALS

WHEREAS, Client and Security Provider have entered into an agreement for protective services and incident response, pursuant to which Security Provider performs monitoring, investigation, and remedial actions at Client locations and involving Client assets; and

WHEREAS, an incident occurred as described in this Report, and the parties require a contemporaneous written record documenting facts, actions taken, recommended remediation, and any resulting agreement concerning additional response work, costs, and confidentiality; and

WHEREAS, this Incident Security Report shall constitute both a factual record and, to the extent the parties execute below, a binding agreement memorializing the scope of any additional response services, payment terms, confidentiality obligations, and governing law for the matters set forth herein.

INCIDENT DETAILS

Incident Identifier

Date of Incident: Time of Incident: Location:

Reported By Reporter Contact Incident Type (check all that apply)

Unauthorized access Theft Vandalism Data breach Other:

Severity / Impact Immediate Actions Taken (by Security Provider) Evidence Collected Witnesses (names and contact information) Assets Affected

Estimated Loss / Damage: $ Law Enforcement Notified: Yes Report Number (if any):

SCOPE OF WORK (If Additional Response Services Are Required)

The parties agree that, if additional response services are authorized by Client in writing following this incident, the Security Provider shall perform work as described below. Descriptions should specify tasks, deliverables, timelines, and point of contact.

Scope of Additional Work

PAYMENT TERMS

Client agrees to compensate Security Provider for any authorized additional response services in accordance with the following payment terms. All amounts are in U.S. dollars unless otherwise specified.

Agreed Fee for Additional Services Payment Schedule Late Payment Fee

TERM AND TERMINATION

This Report and any resulting authorization for additional services shall become effective on the Start Date below and shall continue through the End Date unless earlier terminated in accordance with this section. Either party may terminate any authorized scope of work for cause upon written notice specifying the basis for termination.

Start Date: End Date: Notice Period for Termination:

CONFIDENTIALITY

All information contained in this Incident Security Report, together with any investigation materials, evidence, photographs, logs, and forensic data (collectively, "Confidential Information"), is the confidential property of Client and/or Security Provider as applicable. Recipient shall not disclose Confidential Information to any third party except (a) as required by law or court order; (b) to employees, contractors, or advisors who have a need to know to effectuate response services and who are bound by confidentiality obligations at least as protective as those herein; or (c) with prior written consent of the disclosing party. Any unauthorized disclosure shall entitle the non-breaching party to injunctive relief and recovery of reasonable attorneys' fees and costs.

GOVERNING LAW

This Report and any agreement arising from authorization of additional response services shall be governed by and construed in accordance with the laws of the state specified below. The parties submit to the exclusive jurisdiction of the courts located in that state for any dispute arising under this Report.

Governing Jurisdiction (State)

ENTIRE AGREEMENT

This Incident Security Report, together with any written authorizations and attachments executed by the parties, constitutes the entire agreement between Client and Security Provider regarding the subject matter herein and supersedes all prior or contemporaneous understandings, whether written or oral. No amendment shall be effective unless executed in writing by authorized representatives of both parties.

RECOMMENDATIONS & FOLLOW-UP

Recommended Remediation and Follow-Up Actions Additional Comments

Client Printed Name:

By:

Date:

Security Provider Printed Name:

By:

Date:

What an Incident Security Report Is and When it’s Used

An Incident Security Report is a structured record used to capture the facts, timeline, impact, and containment steps for a cybersecurity or data incident. It centralizes reporter details, affected systems, evidence collected, and remediation actions so legal, compliance, and technical teams can investigate, preserve proof, and meet regulatory notification obligations efficiently.

Why a formal Incident Security Report matters

A complete Incident Security Report preserves evidence, supports timely regulatory notifications, documents decision-making, and reduces legal and operational risk while enabling consistent post-incident review and remediation planning.

Typical roles that complete or rely on this report

The Incident Security Report is completed and used by cross-functional teams to manage response, meet compliance, and brief leadership quickly.

Security operations teams and incident responders who collect technical evidence and run initial containment actions.
IT and systems administrators who confirm affected assets, restore services, and document configuration changes.
Privacy officers and legal counsel who assess regulatory obligations and coordinate external notifications.

Maintain a single, auditable report version to reduce conflicting accounts and speed coordination among stakeholders.

Who signs or authorizes the report

Security Manager

Typically the operational owner who verifies technical findings, certifies containment steps, and signs to confirm the incident chronology. Their signature confirms the technical accuracy of the report for internal audits and external review.

Privacy Officer

Responsible for evaluating data exposure, determining regulatory notification obligations, and approving external communications. Their approval documents that privacy impact assessments and required notices were considered.

Essential sections to include for completeness

A professional Incident Security Report groups evidence, timeline, impact, and actions into clear sections so teams and regulators can assess consequences and follow prescribed next steps.

Executive Summary

A concise incident overview describing the nature of the event, high-level impact, and current status to brief leadership and external reviewers quickly and without technical detail overload.

Incident Timeline

Chronological timestamps from discovery to containment that support forensic review and legal analysis; include discovery time, escalation, containment, and remediation milestones.

Systems Affected

List of impacted servers, applications, and services plus asset identifiers to scope investigation and prioritize recovery activities across teams.

Data Impact Assessment

Types and categories of data accessed or exfiltrated, approximate record counts, and whether protected classes of data (PHI, PCI, education records) were involved.

Evidence Collected

Inventory of logs, memory images, packet captures, and chain-of-custody notes that preserve forensic integrity and support potential legal or regulatory proceedings.

Remediation and Follow-up

Containment measures taken, patches applied, user notifications, and planned preventive actions with owners and target completion dates.

Required information fields at a glance

Incident Date: MM/DD/YYYY

Incident Time: HH:MM (24-hour) UTC or local

Reporter Contact: Name, role, phone, email

Affected Systems: Hostname or asset ID

Data Types Exposed: PHI, PII, PCI, etc.

Incident Classification: Breach, compromise, outage

Step-by-step: completing the report quickly and accurately

Follow these steps to capture core facts, preserve evidence, and notify appropriate teams in a consistent order that supports investigation and compliance.

01

Record basic facts: Enter date, time, reporter, and affected assets.
02

Preserve evidence: Collect logs, snapshots, and chain-of-custody notes immediately.
03

Assess impact: Identify data types and approximate scope of exposure.
04

Document remediation: Note containment steps, owners, and planned follow-up.

Configuring an online Incident Security Report workflow

Set up routing, authentication, and retention rules so the online form enforces required approvals and preserves an audit trail for compliance.

Field	Configuration
Primary signer authentication and verification method	Email link plus SMS OTP
Routing order and approval escalation policy	Sequential: reporter → SOC lead → privacy officer
Conditional fields and required attachments	Require logs if data exposure flagged
Retention settings and export options	Retain signed PDF, audit trail, A/V logs

Where this report should be filed or sent

Route completed reports to designated internal systems and external recipients according to policy so investigators, legal counsel, and compliance teams have immediate access.

Internal Case Repository: Store signed report and artifacts in secure incident management system.
Security Operations Team: Notify SOC for forensic analysis and containment follow-up.
Legal and Privacy Teams: Send copy to privacy officer for notification assessment.
External Regulators: Submit only when required by law or regulatory instruction.

Digital delivery and platform considerations

Choose a platform that preserves an immutable audit trail, access controls, and strong encryption during transit and at rest.

Authentication: Support for email, SMS OTP, and SSO
Security and encryption: TLS 1.2/1.3 in transit; AES-256 at rest
Integrations: Connectors for SIEM, ticketing, cloud storage

Typical reporting timelines and response expectations

Adopt internal deadlines for reporting and investigation while aligning external notifications to applicable statutes and industry rules to avoid regulatory penalties.

Initial internal report deadline:

Report to SOC within 24 hours of discovery.

Investigation and triage window:

Begin forensic triage within 72 hours and document findings.

HIPAA notification timeframe:

Notify individuals and HHS no later than 60 days if a breach is reportable (45 CFR §164.404).

Data protection authority timelines:

Follow state-specific breach notification deadlines where applicable.

Retention for evidence:

Keep investigative artifacts until legal clearance or minimum retention period.

Common mistakes that delay response

Incomplete timestamps or mismatched timezone entries hinder forensic timeline reconstruction and increase investigation time.
Failing to preserve volatile evidence such as memory dumps or live logs can destroy actionable data needed for attribution.
Using informal notes instead of the official report creates multiple competing records and complicates legal or regulatory review.
Overly technical jargon without clear impact statements prevents leadership and legal teams from assessing urgency correctly.

Consequences of an incomplete or late report

Regulatory fines: HIPAA civil penalties possible

State enforcement actions: Breach notification violations risk penalties

Civil litigation: Class action exposure for affected individuals

Operational disruption: Extended downtime and remediation costs

Reputational harm: Loss of customer trust

Data integrity loss: Evidence gaps impede liability defense

Sample eSignature vendor comparison for signing and preserving reports

Compare vendor starting prices and basic capabilities relevant to signing and securing Incident Security Reports; signNow is listed first per platform data.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day trial	No	No	No	No
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Real-world examples of report use in organizations

These examples illustrate how organizations used an Incident Security Report to document events, preserve evidence, and complete notifications efficiently.

Tim Martin — Martin Properties

A property management firm discovered unauthorized access to tenant records and recorded discovery, containment, and remediation steps in a single report.

The report included asset IDs and log exports for forensic review.
That consolidated record enabled timely tenant notifications, simplified regulator queries, and reduced executive time spent coordinating disparate notes across teams.

John Butler — Fertility Centers of Illinois

A healthcare provider used the report to document a suspected PHI exposure and attach relevant audit logs and chain-of-custody notes.

The privacy officer reviewed record counts and data categories.
The detailed report supported the provider’s internal assessment, informed required patient notifications, and provided documentation for an eventual regulator inquiry while preserving HIPAA compliance posture.

Practical best practices for accurate and efficient reporting

Adopt templates, standardized timestamps, and a single point of record to speed collection and reduce inconsistencies when incidents occur.

Collect Complete Incident Details Immediately

Capture initial observations, exact timestamps, and the identity of the reporter at first contact to preserve facts and reduce recall errors during later investigations.

Preserve Volatile and Forensic Evidence First

Prioritize memory captures, live logs, and network data before restarting or rebuilding systems to avoid loss of critical investigative artifacts.

Use Clear Impact Categorization and Data Labels

Classify exposed data by type and sensitivity (PHI, PII, PCI) and estimate affected record counts to accelerate notification and legal assessment.

Maintain an Unbroken Chain of Custody

Log who accessed each artifact, when, and for what purpose to preserve admissibility and support internal or external reviews.

How to update or revise a submitted Incident Security Report

Follow a controlled amendment workflow so changes are traceable, authorized, and do not overwrite original signed records.

01

Initiate amendment:

Create a revision entry noting reason.

02

Attach new evidence:

Include additional logs or findings.

03

Obtain approvals:

Require SOC and privacy sign-off.

04

Preserve previous versions:

Keep original signed report archived.

05

Record change history:

Log who edited and why.

06

Notify stakeholders:

Alert affected parties of updates.

Frequently asked questions about Incident Security Reports

Answers to common questions about completion, signatures, storage, and legal implications to reduce confusion and speed appropriate handling.

Need help? Contact support

Who should sign the report
Signatures typically come from the incident owner, SOC lead, and privacy officer. Each sign-off documents verification of technical findings, legal assessment, and notification decisions for audit and compliance purposes.
Can this report be electronically signed
Yes. Under the ESIGN Act and UETA, electronic signatures are legally valid when intent, consent, attribution, and retention are demonstrable; for consumer-facing notices follow ESIGN disclosure requirements.
Do I need notarization or witnesses
Notarization or witness requirements are uncommon for incident reports. Check specific state or contractual obligations; certain legal filings or affidavits may require notarization or witnesses.
How long should I retain reports
Retain reports for the active investigation and at least the statutory minimums that apply to related records; HIPAA requires six years and IRS records typically three years.
What if I discover new evidence after signing
Record an amendment with clear rationale, attach new evidence, obtain required approvals, and preserve the original signed version to maintain auditability.
Which formats should I export
Export the signed report and attachments as a PDF/A with the audit trail included. Preserve original log files and timestamps in native formats for forensic use.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now