Incident Report Form template: The record of one report of a suspected incident or breach, from the first report through triage, notifications and closure, with a register of every report, as SP 800-53 IR-6 and IR-5 require.
The record of one report of a suspected incident or breach, from the first report through triage, notifications and closure, with a register of every report, as SP 800-53 IR-6 and IR-5 require.
Anyone who suspects an incident or a breach completes Parts A to C, or calls the service desk, which completes them during the call. Report within Fill in: time period for personnel to report suspected incidents to the organizational incident response capability Typical: 1 hour of discovery (IR-6a). Do not wait to confirm it, and do not investigate first.
Report what you know. A blank answer is better than a guess, and the team will follow up.
Describe information that was exposed without copying it into the form: write “a spreadsheet of customer names and account numbers”, not the names and numbers.
Submitting the form through Fill in: automated mechanisms used for reporting incidents Typical: the incident report form and case management system, which notify the incident response team automatically alerts the Incident response team (IR-6(1)).
The Incident response team completes Parts D to F and enters the report in the register.
The Incident response team reports incident information to Fill in: authorities to whom incident information is to be reported Typical: senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified (IR-6b). Record every notification, inside and outside the organization.
Party
Required by
Deadline
Decided by
Sent by
Date and time sent
Reference
Chief Information Security Officer
Incident Response Plan
Fill in: for example at declaration for High and Critical
Fill in: name
Fill in: date and time
Senior privacy official
Incident Response Plan breach section
At identification, when personally identifiable information is or may be involved
Fill in: name
Fill in: date and time
Senior leadership
Incident Response Plan
Fill in: deadline
Fill in: name
Fill in: name
Fill in: date and time
Fill in: regulator, customer, partner, supplier or law enforcement
Fill in: law, regulation or contract
Fill in: deadline
Fill in: name
Fill in: name
Fill in: date and time
Fill in: their reference
Affected individuals
Fill in: requirement, or the privacy official’s decision
Federal agencies notify the Cybersecurity and Infrastructure Security Agency (CISA) of incidents under FISMA (44 U.S.C. §§ 3553 and 3554). As of October 2026, the CISA Federal Incident Notification Guidelines (effective April 1, 2017) require a report within one hour of identification by the agency’s top-level incident response team, security operations center or IT department, with seven required elements. Part D’s impact fields follow the guidelines’ functional impact, information impact and recoverability categories, so the report can be filed from this form. CISA asks agencies not to include sensitive personally identifiable information in submissions.
OMB Memorandum M-25-04 (January 15, 2025), the most recent FISMA guidance memorandum as of October 2026, section X, sets the major incident fields below. Events still unresolved after 72 hours of investigation are reported to CISA. A major incident determination is required for a breach affecting the personally identifiable information of 100,000 or more people. A major incident is reported to CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, to the appropriate congressional committees and the Office of Inspector General within 7 days of the reasonable-basis determination, and, for a breach, in a supplemental report to Congress within 30 days of discovering it. OMB Memorandum M-17-12, section VIII, requires the principal security operations center to track each breach, including the number of individuals, the types of information, whether individuals were notified or offered services, and whether it was reported to CISA or Congress.
CISA element
Entry
Time of identification by the top-level team, which starts the one-hour clock
Fill in: date and time
Functional impact (CISA category)
Fill in: category
Information impact (CISA category, for example privacy data breach)
Fill in: one or more categories
Recoverability (CISA category)
Fill in: category
When the activity was first detected
Fill in: date and time
Number of systems, records and users affected
Fill in: numbers or estimates
Network location of the observed activity
Fill in: location
Point of contact
Fill in: name and contact
Attack vector, indicators of compromise and mitigation, if known
Fill in: details
Reported to CISA by, date and time
Fill in: name, date and time
CISA tracking number
Fill in: number
Unresolved after 72 hours of investigation; reported to CISA
Fill in: not applicable; or date and time reported
Major incident determination (M-25-04 section X)
Fill in: not major; or major, under criterion A or B, and whether the 100,000-person rule applies
Determination made by, with date and time; who took part
Fill in: name, date and time; for example the CIO, CISO, system owner and, for a breach, the senior agency official for privacy
Reported to CISA and the OMB Office of the Federal Chief Information Officer
Fill in: by whom, date and time, within 1 hour of the determination
Congressional committees and Office of Inspector General notified
Fill in: by whom and date, within 7 days of the reasonable-basis determination
Breach supplemental report to Congress
Fill in: not applicable; or date sent, within 30 days of discovering the breach
Breach tracked jointly by the principal security operations center and the senior agency official for privacy, for a breach that is a major incident (M-25-04 section X; M-17-12 section VIII)
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.