It Security Incident Report Template

SOP: IT Security Incident Report Template

Document ID: SEC-OPS-001
Classification: Internal/Restricted
Owner: Office of the CISO

---

1. Document Control & Revision History

---

2. Executive Summary & Scope

Purpose: This procedure establishes the standardized format and mandatory data points for documenting IT security incidents. The objective is to ensure institutional consistency, legal defensibility, and compliance with NIST SP 800-61, GDPR, and HIPAA reporting requirements.

Scope: This protocol applies to all internal IT personnel, managed service providers, and third-party contractors. It covers all unauthorized access, data exfiltration, malware infections, and denial-of-service events impacting enterprise information assets.

---

3. Prerequisites & Tool Requirements

• Access Requirements: Active Directory Administrative Privileges; Read/Write access to the Secure Incident Management System (SIMS).
• Software: Enterprise SIEM (e.g., Splunk, Sentinel), Endpoint Detection and Response (EDR) dashboard, encrypted incident ticketing portal.
• Safety/Security: MFA-secured workstation; physical access credentials for Server Room/DR site (if on-premise forensic investigation is required).
• Certifications: Personnel conducting the intake must hold Security+ or equivalent (GCIH preferred).

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase I: Initial Intake & Classification

• Record Timestamp of Discovery (UTC).
• Define Incident Severity (Low, Medium, High, Critical).
• Log source of notification (User report, SIEM alert, Threat Intel feed).

Phase II: Investigation & Data Collection

• Identify and isolate affected host(s).
• Capture volatile memory and system logs.
• Document all observed Indicators of Compromise (IoCs).

Phase III: Remediation & Eradication

• Execute containment protocol (Network isolation/Account lockout).
• Remove malicious binaries/persistence mechanisms.
• Restore services from immutable backups (if required).

Phase IV: Post-Incident Reporting

• Complete the "Security Incident Report" (SIR) template via SIMS.
• Attach all forensic evidence files (hashed).
• Submit report for CISO signature.

---

6. Quality Assurance & Verification Criteria

Failure to meet these thresholds results in immediate rejection of the incident report and mandatory re-auditing by the Incident Responder.

---

7. Practical Troubleshooting Scenarios

Scenario A: Evidence chain-of-custody breach.

• Observation: Forensic images lack verifiable hash documentation.
• Action: Immediately isolate the corrupted evidence, flag as "Inadmissible" in the report, and document a "Process Deviation Memo." Re-pull logs from centralized SIEM to reconstruct the timeline.

Scenario B: System fails to isolate from production.

• Observation: Command-line instruction via EDR fails to isolate host.
• Action: Manually trigger "Switch Port Disable" on the managed network core. Contact Infrastructure Lead to confirm physical port shutdown if remote software failure persists.

Scenario C: Incident exceeds internal containment bandwidth.

• Observation: Incident scope expands beyond 5% of enterprise endpoints.
• Action: Trigger "Emergency Response Protocol" (Incident Command System/ICS). Escalate to the Executive Incident Response Team (EIRT) for external forensic vendor engagement.