When must I notify regulators?

Notification obligations depend on the data types and jurisdictions affected. For HIPAA-covered entities, notify HHS OCR within 60 days for breaches affecting 500 or more individuals (45 CFR §164.404); state laws may impose other timing and threshold requirements.

Should I sign the report electronically?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure the platform preserves an audit trail showing intent, attribution, and retention.

What evidence should I attach?

Attach logs, screenshots, packet captures, and preserved images. Label sources, collection times, and chain-of-custody steps to maintain admissibility and support forensic analysis.

Who approves external notifications?

Legal and compliance typically review and approve regulator and customer notices to ensure accuracy and to manage disclosure risk and privilege concerns.

How long should I keep reports?

Follow retention policies tied to legal requirements: HIPAA records 6 years (45 CFR §164.530(j)), IRS-related items 3 years (IRC §6501(a)), and longer where industry rules or litigation holds require it.

Can I redact sensitive info before sharing?

Yes, redact where legally permissible, but preserve an unredacted version in a secure evidence archive for investigators and counsel under controlled access.

Electronic Signature
Templates
Miscellaneous
Security Incident Report

Security Incident Report

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SECURITY INCIDENT REPORT

WHEREAS

WHEREAS the Organization maintains information systems, networks, and data assets that are critical to business operations and the protection of sensitive information; and

WHEREAS an event occurring on the date and time identified below has been classified as a security incident requiring formal reporting, containment, investigation and remediation; and

WHEREAS this Security Incident Report documents the facts, actions taken, impact assessment, evidence chain-of-custody, cost recovery terms, and recommended corrective measures as required by corporate security policy and contractual obligations.

Report Identification

Incident ID: Report Date:

Reporter Information

Organization Name Reporter Name Job Title / Department Contact Phone Contact Email

Incident Details

Date of Incident: Time of Incident:

Physical / Logical Location Systems / Assets Affected Severity (select one)

Low Moderate High Critical

Summary Description of Incident Immediate Actions Taken

Evidence & Chain of Custody

Evidence Collected: Logs Disk Images Configuration Files Other

Evidence Details and Chain-of-Custody Actions

Impact Assessment

Business Impact Data / Privacy Impact (if applicable)

Containment, Remediation & Recommendations

Containment & Remediation Actions Completed Recommended Corrective Measures and Preventative Steps

Notifications

Notified Internal Security Team: Yes Date Notified:

Notified Legal / Compliance: Yes Date Notified:

Notified Data Protection Officer: Yes Date Notified:

Notified Law Enforcement: Yes Date Notified:

Scope of Investigation

Scope of Work

Remediation Cost & Payment Terms

Estimated Remediation Cost: $

Payment Schedule / Cost Recovery Terms

Late Payment Fee (annualized percentage):

Parties acknowledge that costs properly attributable to investigation and remediation may be recovered as set forth above, provided such costs are reasonable, documented, and consistent with applicable contracts and policy.

Term and Termination of Investigation Engagement

Investigation Start Date: Investigation End Date (anticipated):

Notice Period for Termination of External Remediation Engagements (days)

Confidentiality

All information disclosed in this Security Incident Report and any attachments shall be treated as Confidential Information. Recipients shall use such information solely for the purpose of incident response, remediation, regulatory reporting and legal compliance, and shall not disclose it to third parties except as required by law, regulation, or explicit written consent. Parties shall implement reasonable measures to protect confidentiality consistent with the sensitivity of the information.

Governing Law

This Report, and any dispute arising from the actions described herein, shall be governed by and construed in accordance with the laws of: , without regard to conflict of law principles.

Entire Agreement & Certifications

This Security Incident Report, together with any attachments, statements of work, invoices and documented chain-of-custody records referenced herein, constitutes the entire record of the incident and supersedes all prior written or oral communications regarding the matters described. No amendment to this Report shall be effective unless in writing and signed by authorized representatives of the parties.

The undersigned certify that the information set forth in this Report is true and accurate to the best of their knowledge, that evidence collection procedures followed were documented and preserved, and that any costs submitted for recovery are reasonable and supported by documentation.

Witnesses (if any)

Witness Name(s) and Contact Information

Reporter (Printed Name):

By:

Date:

Security Manager / Authorized Approver (Printed Name):

By:

Date:

What a Security Incident Report Is and when it's used

A Security Incident Report documents the facts, scope, impact, and remediation steps for a confirmed or suspected security event affecting information systems, data, or services. It captures who discovered the incident, affected assets and data categories, timelines of detection and containment, technical indicators, and immediate mitigation actions. Organizations use the report for internal response coordination, regulatory notification, insurance claims, post-incident review, and to support legal or disciplinary actions. A clear report enables consistent handoffs between security, legal, HR, and external responders while preserving evidence for forensic analysis.

Why a formal Security Incident Report matters

A structured incident report reduces response time, preserves critical evidence, and creates a reliable record for regulatory or contractual obligations. It supports consistent decision-making across technical, legal, and business stakeholders while documenting remediation and follow-up tasks.

Who typically completes and reviews the Security Incident Report

Final circulation often includes senior leadership, privacy officers, and external counsel where required to support regulatory filings or public disclosures.

Security Operations — Prepares technical timeline and containment details for forensic analysis.
IT / Infrastructure — Documents affected systems, configuration changes, and patch status.
Legal & Compliance — Reviews regulator, contractual, and disclosure obligations and approves external notifications.

Step-by-step: completing a Security Incident Report

Follow a consistent sequence to ensure accuracy and speed: identify, contain, document, escalate, notify, remediate, and review. Record timestamps, evidence sources, and actions taken at each stage.

01

Identify: Describe detection method, time discovered, and initial indicators.
02

Contain: List containment actions taken and systems isolated.
03

Assess: Note data types involved, number of records, and potential impact.
04

Notify: Record internal escalations and required regulator or customer notices.

Essential data elements to capture

Incident ID: Unique tracker

Discovery Timestamp: MM/DD/YYYY HH:MM

Reporter: Name and contact

Systems Affected: Hostnames/IPs

Data Categories: PII, PHI, financial

Containment Steps: Actions taken

Core sections every professional report should include

Organize the report into standardized sections so reviewers can quickly locate technical facts, business impact, and remediation status.

Executive Summary

A concise incident overview stating scope, business impact, and current status so nontechnical stakeholders can understand operational consequences and next steps.

Technical Timeline

A chronological log of detection, escalation, containment, and remediation actions with precise timestamps and actor names to support forensics and legal review.

Impact Assessment

Quantify affected user counts, data records, systems, and potential downstream effects on operations, contracts, or regulated data subject to notice obligations.

Root Cause Analysis

A factual description of cause, exploited vulnerabilities, misconfigurations, or user actions identified during investigation and evidence supporting the determination.

Remediation Plan

Detailed immediate fixes, medium-term remediation, responsible owners, and deadlines for closure to demonstrate corrective action and risk reduction.

Notifications and Compliance

List regulatory, contractual, and customer notification requirements, status of disclosures, and any law enforcement or external vendor engagements.

Downloading, saving, and supporting documents

Maintain a secure archive of the completed report and supporting evidence in formats that preserve timestamps and audit trails for legal and compliance needs.

Export Formats

Save the final report as PDF/A for long-term preservation; retain original logs in native format and export copies as CSV or JSON where appropriate.

Evidence Package

Include system logs, memory images, packet captures, and timestamps. Clearly label file provenance and chain-of-custody notes for admissibility.

Versioning

Record report revisions with author, date, and reason for change. Preserve original drafts to show how the investigation evolved.

Secure Storage

Store signed reports and evidence in encrypted, access-controlled repositories with retention policies aligned to legal requirements.

Configuring an online incident-reporting workflow

Design fields, access controls, and routing so reports automatically reach the right teams and maintain audit records for every action.

Field	Configuration
Incident ID	Auto-generate unique IDs
Timestamp	Require MM/DD/YYYY HH:MM TZ
Attachments	Allow log, pcap, and image uploads
Routing	Auto-notify SOC, legal, and ops

Where to send the completed Security Incident Report

Route the report according to internal escalation policies and any contractual or regulatory notice requirements; include copies for recordkeeping.

SOC / Security Team: Primary recipient for containment and forensics
Legal / Compliance: Review for regulatory and disclosure obligations
Business Owner: Assess operational impact and customer communication
Records Archive: Store final signed report and evidence

Digital submission and platform considerations

Ensure the chosen platform can export signed PDFs, record who viewed or edited the report, and retain logs to meet legal hold and audit requirements.

Integrations: Salesforce, ServiceNow, SIEM
File formats: PDF, DOCX, CSV
Authentication: SSO and MFA

Typical timelines and regulatory notification expectations

Timely reporting varies by jurisdiction and the nature of affected data; follow internal SLAs and applicable statutory notification windows when preparing external notices.

Internal Reporting:

Report to SOC and leadership within 24 hours of discovery.

Regulator Notification (HIPAA):

HIPAA breach notification to HHS OCR within 60 days for breaches affecting 500+ individuals (45 CFR §164.404).

State Breach Notices:

States require notice without unreasonable delay; timing and thresholds vary by state.

Customer Notification:

Issue customer notices per contracts and state law timing; often within 30–60 days.

Law Enforcement:

Coordinate immediate law enforcement contact when required or advised.

Key milestones in incident processing

Track major stages from discovery through post-incident review so stakeholders can monitor progress and closure.

01

Discovery

Initial detection and reporting to SOC with evidence capture and timestamps.

02

Containment

Isolate systems, stop ongoing harm, and document containment measures taken.

03

Investigation

Collect logs, perform root cause analysis, and estimate data exposure.

04

Notification

Prepare and send regulator, customer, and law enforcement notices as required.

Common mistakes to avoid when preparing the report

Incomplete timestamps or missing time zones that break the forensic timeline and hinder investigation.
Vague descriptions of affected data that make it hard to determine notification obligations.
Altering logs or failing to preserve original evidence, which can compromise legal admissibility.
Delaying internal escalation while attempting ad hoc containment without documenting actions.

Principal penalties and legal risks from poor reporting

Regulatory Fines: Civil penalties and enforcement actions

Civil Litigation: Class actions and breach-related claims

Contractual Exposure: Breach of vendor/customer agreements

Operational Loss: Extended downtime and revenue impact

Reputational Harm: Customer trust erosion

Insurance Issues: Denial or reduced coverage

eSignature provider comparison for signing and distributing incident reports

Compare core cost and capability criteria when selecting an eSignature provider for signing, routing, and long-term storage of incident reports and supporting records.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
Envelope Cap	No limit	100 envelopes/user/year	Varies	Varies	Varies

Frequently asked questions about Security Incident Reports

Answers to common questions about completing, signing, storing, and sharing incident reports to help avoid delays and compliance issues.

Need help? Contact support

When must I notify regulators?
Notification obligations depend on the data types and jurisdictions affected. For HIPAA-covered entities, notify HHS OCR within 60 days for breaches affecting 500 or more individuals (45 CFR §164.404); state laws may impose other timing and threshold requirements.
Should I sign the report electronically?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure the platform preserves an audit trail showing intent, attribution, and retention.
What evidence should I attach?
Attach logs, screenshots, packet captures, and preserved images. Label sources, collection times, and chain-of-custody steps to maintain admissibility and support forensic analysis.
Who approves external notifications?
Legal and compliance typically review and approve regulator and customer notices to ensure accuracy and to manage disclosure risk and privilege concerns.
How long should I keep reports?
Follow retention policies tied to legal requirements: HIPAA records 6 years (45 CFR §164.530(j)), IRS-related items 3 years (IRC §6501(a)), and longer where industry rules or litigation holds require it.
Can I redact sensitive info before sharing?
Yes, redact where legally permissible, but preserve an unredacted version in a secure evidence archive for investigators and counsel under controlled access.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now