# Incident Report Form

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/incident-report-form/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| Report ID | Date and time received | Received through | Incident record ID | Status |
| --- | --- | --- | --- | --- |
| [Fill in: unique report ID] | [Fill in: date and time] | [Fill in: phone, email, portal, alert, or outside party] | [Fill in: incident record ID, or none] | [Fill in: received, triaged, declared, not an incident, or closed] |

## 1. How to use this form

- Anyone who suspects an incident or a breach completes Parts A to C, or calls the service desk, which completes them during the call. Report within [Fill in: time period for personnel to report suspected incidents to the organizational incident response capability. Typical: 1 hour of discovery] (IR-6a). Do not wait to confirm it, and do not investigate first.
- Report what you know. A blank answer is better than a guess, and the team will follow up.
- Describe information that was exposed without copying it into the form: write "a spreadsheet of customer names and account numbers", not the names and numbers.
- Submitting the form through [Fill in: automated mechanisms used for reporting incidents. Typical: the incident report form and case management system, which notify the incident response team automatically] alerts the [Incident response team] (IR-6(1)).
- The [Incident response team] completes Parts D to F and enters the report in the register.

## Part A. Who is reporting

| Field | Entry |
| --- | --- |
| Name of the person reporting | [Fill in: name] |
| Contact phone and email | [Fill in: phone and email] |
| Organizational unit, or company for an outside reporter | [Fill in: unit or company] |
| Person who discovered it, if different | [Fill in: name and contact] |
| Best time and way to reach you | [Fill in: time and method] |

## Part B. What happened

| Field | Entry |
| --- | --- |
| Date and time it was discovered | [Fill in: date and time] |
| What you saw or what happened | [Fill in: description in your own words] |
| How it was noticed | [Fill in: for example a suspicious email, a security alert, a missing device, a customer's call] |
| Systems, devices or services involved | [Fill in: names, addresses or asset tags, and any connection to other systems] |
| Where it happened | [Fill in: office, remote, a supplier, a cloud service] |
| Is it still happening? | [Fill in: yes, no, or not sure] |
| What you have done so far | [Fill in: for example disconnected the laptop, forwarded the email to the service desk, nothing] |

## Part C. Information involved

| Question | Answer |
| --- | --- |
| What information was, or may have been, lost, exposed, changed or deleted? | [Fill in: a description, not the information itself] |
| Does it include personal information about people, such as names with identification numbers, financial, health or contact details? | [Fill in: yes, no, or not sure] |
| If yes: about how many people? | [Fill in: number or estimate] |
| What medium was it on? | [Fill in: for example laptop, phone, removable media, paper, a cloud service, email, a conversation] |
| Was it protected, for example encrypted or password protected? | [Fill in: yes, no, or not sure, and how] |
| Has anyone outside the organization been told, such as law enforcement or the recipient? | [Fill in: no; or yes, who and when] |

## Part D. Triage

Completed by the [Incident response team].

| Field | Entry |
| --- | --- |
| Received by, and date and time | [Fill in: name, date and time] |
| Outcome | [Fill in: incident declared; not an incident, with the reason; or referred elsewhere, such as a routine service request] |
| Date and time declared | [Fill in: date and time] |
| Incident type | [Fill in: from section 6 of the incident handling playbook, for example ransomware, account takeover, lost device] |
| Severity | [Fill in: from section 4 of the Incident Response Plan] |
| Functional impact | [Fill in: what the organization cannot do, or can do only with difficulty] |
| Information impact | [Fill in: none known, suspected, or the type of information compromised] |
| Recoverability | [Fill in: recoverable with existing resources, with added resources, or not recoverable] |
| Personally identifiable information involved | [Fill in: no; or yes or possibly, and the time the privacy official was told] |
| Major incident | [Fill in: no; or yes, declared by and time] |
| Incident lead | [Fill in: name] |

## Part E. Notifications

The [Incident response team] reports incident information to [Fill in: authorities to whom incident information is to be reported. Typical: senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified] (IR-6b). Record every notification, inside and outside the organization.

| Party | Required by | Deadline | Decided by | Sent by | Date and time sent | Reference |
| --- | --- | --- | --- | --- | --- | --- |
| [Chief Information Security Officer] | Incident Response Plan | [Fill in: for example at declaration for High and Critical] | | [Fill in: name] | [Fill in: date and time] | |
| [Senior privacy official] | Incident Response Plan breach section | At identification, when personally identifiable information is or may be involved | | [Fill in: name] | [Fill in: date and time] | |
| Senior leadership | Incident Response Plan | [Fill in: deadline] | [Fill in: name] | [Fill in: name] | [Fill in: date and time] | |
| [Fill in: regulator, customer, partner, supplier or law enforcement] | [Fill in: law, regulation or contract] | [Fill in: deadline] | [Fill in: name] | [Fill in: name] | [Fill in: date and time] | [Fill in: their reference] |
| Affected individuals | [Fill in: requirement, or the privacy official's decision] | [Fill in: deadline] | [Fill in: name] | [Fill in: name] | [Fill in: date range] | [Fill in: notice version] |

### Federal systems

Federal agencies notify the Cybersecurity and Infrastructure Security Agency (CISA) of incidents under FISMA (44 U.S.C. §§ 3553 and 3554). As of October 2026, the [CISA Federal Incident Notification Guidelines](https://www.cisa.gov/federal-incident-notification-guidelines) (effective April 1, 2017) require a report within one hour of identification by the agency's top-level incident response team, security operations center or IT department, with seven required elements. Part D's impact fields follow the guidelines' functional impact, information impact and recoverability categories, so the report can be filed from this form. CISA asks agencies not to include sensitive personally identifiable information in submissions.

[OMB Memorandum M-25-04](https://www.whitehouse.gov/wp-content/uploads/2025/01/M-25-04-Fiscal-Year-2025-Guidance-on-Federal-Information-Security-and-Privacy-Management-Requirements.pdf) (January 15, 2025), the most recent FISMA guidance memorandum as of October 2026, section X, sets the major incident fields below. Events still unresolved after 72 hours of investigation are reported to CISA. A major incident determination is required for a breach affecting the personally identifiable information of 100,000 or more people. A major incident is reported to CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, to the appropriate congressional committees and the Office of Inspector General within 7 days of the reasonable-basis determination, and, for a breach, in a supplemental report to Congress within 30 days of discovering it. [OMB Memorandum M-17-12](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf), section VIII, requires the principal security operations center to track each breach, including the number of individuals, the types of information, whether individuals were notified or offered services, and whether it was reported to CISA or Congress.

| CISA element | Entry |
| --- | --- |
| Time of identification by the top-level team, which starts the one-hour clock | [Fill in: date and time] |
| Functional impact (CISA category) | [Fill in: category] |
| Information impact (CISA category, for example privacy data breach) | [Fill in: one or more categories] |
| Recoverability (CISA category) | [Fill in: category] |
| When the activity was first detected | [Fill in: date and time] |
| Number of systems, records and users affected | [Fill in: numbers or estimates] |
| Network location of the observed activity | [Fill in: location] |
| Point of contact | [Fill in: name and contact] |
| Attack vector, indicators of compromise and mitigation, if known | [Fill in: details] |
| Reported to CISA by, date and time | [Fill in: name, date and time] |
| CISA tracking number | [Fill in: number] |
| Unresolved after 72 hours of investigation; reported to CISA | [Fill in: not applicable; or date and time reported] |
| Major incident determination (M-25-04 section X) | [Fill in: not major; or major, under criterion A or B, and whether the 100,000-person rule applies] |
| Determination made by, with date and time; who took part | [Fill in: name, date and time; for example the CIO, CISO, system owner and, for a breach, the senior agency official for privacy] |
| Reported to CISA and the OMB Office of the Federal Chief Information Officer | [Fill in: by whom, date and time, within 1 hour of the determination] |
| Congressional committees and Office of Inspector General notified | [Fill in: by whom and date, within 7 days of the reasonable-basis determination] |
| Breach supplemental report to Congress | [Fill in: not applicable; or date sent, within 30 days of discovering the breach] |
| Breach tracked jointly by the principal security operations center and the senior agency official for privacy, for a breach that is a major incident (M-25-04 section X; M-17-12 section VIII) | [Fill in: tracking reference] |

## Part F. Closure

| Field | Entry |
| --- | --- |
| Root cause | [Fill in: summary, or a reference to the incident record] |
| Records or individuals affected, final count | [Fill in: number, or not applicable] |
| Lessons-learned review held | [Fill in: date, or not required at this severity] |
| After-action report and action list | [Fill in: reference] |
| Closed by, and date | [Fill in: name and date] |

## Register

| Report ID | Received (date and time) | Reported by | Discovered (date and time) | Outcome | Declared (date and time) | Incident type | Severity | Personally identifiable information involved | Major incident | Outside notifications (party and date) | Closed |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: date and time] | [Fill in: name or source] | [Fill in: date and time] | [Fill in: declared, not an incident, or referred] | [Fill in: date and time] | [Fill in: type] | [Fill in: severity] | [Fill in: no, yes or possibly] | [Fill in: no or yes] | [Fill in: parties and dates, or none] | [Fill in: date] |