How to Write a Security Incident Report

Standard Operating Procedure: Security Incident Reporting (SIR)

1. Document Control & Revision History

---

2. Executive Summary & Scope

This procedure mandates the uniform documentation of security incidents to ensure compliance with NIST SP 800-61 Rev. 2, GDPR Article 33, and HIPAA Security Rule §164.308. The scope covers all physical, digital, and operational security breaches involving enterprise assets. This SOP is mandatory for all personnel, contractors, and third-party vendors operating within the organization's information ecosystem.

---

3. Prerequisites & Tool Requirements

• Access Requirements: Active credentials for the Enterprise SIEM (Security Information and Event Management) and the Incident Management System (IMS).
• Certifications: Security Awareness Training (SAT) completion (Annual).
• Documentation Tools: Access to GRC (Governance, Risk, and Compliance) platform.
• Safety/PPE: If physical site breach: Hard hat, high-visibility vest, and site-specific badge access.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase I: Immediate Identification & Containment

• Verify the nature of the incident (Digital/Physical).
• Initiate isolation protocols to prevent lateral movement of threats.
• Capture raw system logs or physical timestamps immediately.

Phase II: Documentation & Drafting

• Open a new ticket in the IMS using the incident-specific template.
• Draft the "Executive Overview": State Who, What, When, Where, and How in under 150 words.
• Document all observed artifacts (IP addresses, physical timestamps, asset tags).

Phase III: Review & Dissemination

• Verify the report against the "Severity Matrix" (Critical/High/Medium/Low).
• Attach forensic evidence/screenshots to the IMS ticket.
• Submit for peer review by an Information Security Officer.

---

6. Quality Assurance & Verification Criteria

• Completeness: 100% of mandatory fields in the IMS must be populated.
• Accuracy: Timeline must be chronological with a margin of error < 5 minutes.
• Clarity: Use of non-ambiguous, non-speculative language; passive voice prohibited for factual statements.
• Submission Threshold: Reports must be drafted and submitted to the Incident Lead within 2 hours of discovery for Critical incidents.

---

7. Practical Troubleshooting Scenarios

Scenario A: Incident Evidence Overwritten/Lost

• Failure: Log files rotated or physical site camera footage overwritten before extraction.
• Corrective Action: Immediately flag the incident as "Forensic Impairment." Contact IT Infrastructure to perform a snapshot of the volume or request a cloud-storage audit trail. Document the gap in the report to avoid legal liability.

Scenario B: Ambiguous Incident Severity

• Failure: Reporter cannot determine if the breach is "Low" or "High" severity.
• Corrective Action: Utilize the "Worst-Case Scenario" heuristic. Default to the higher severity classification until the Security Operations Center (SOC) performs a formal assessment. Escalation is preferred over suppression.

Scenario C: Unauthorized Access to Report Drafting

• Failure: Non-authorized personnel view draft report contents.
• Corrective Action: Initiate an internal data leak alert. Revoke draft access permissions immediately. Initiate an audit of the access logs to identify the unauthorized observer and notify the Compliance Officer within 15 minutes.