Security Company Incident Report Template

Standard Operating Procedure: Security Company Incident Report Template

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Purpose

This Standard Operating Procedure (SOP) establishes the mandatory, rigorous framework for documenting, processing, auditing, and archiving security incidents across all corporate and client-managed infrastructure. It ensures legal defensibility, regulatory compliance, and analytical fidelity across all operational tiers.

2.2 Scope

This protocol applies universally to all deployed security personnel, Shift Supervisors, Operations Managers, and Incident Response Team (IRT) members. It governs all physical breaches, cybersecurity anomalies, safety hazards, property damage, and interpersonal disturbances occurring within designated operational perimeters.

2.3 Regulatory Compliance & Standards

All reports generated via this template must comply with:

• ISO/IEC 27001: Information security incident management controls.
• OSHA 29 CFR 1904: Recording and reporting occupational injuries and illnesses.
• NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide.
• GDPR / CCPA: PII minimization and privacy protocols regarding witness and suspect data logging.

---

3. Prerequisites & Tool Requirements

Prior to initiating an incident report, the reporting officer or supervisor must ensure the availability and operational readiness of the following assets:

• Software Access: Enterprise Security Information and Event Management (SIEM) dashboard, Computer-Aided Dispatch (CAD) system, and the proprietary eGRC (Governance, Risk, and Compliance) reporting portal.
• Hardware: Encrypted tactical mobile terminal or ruggedized field laptop with multi-factor authentication (MFA) token.
• Data Capture Tools: Calibrated digital body-worn camera (BWC), chain-of-custody evidence bags, tamper-evident seals, and high-definition optical camera with timestamp functionality.
• Safety & PPE: High-visibility ANSI Class 3 vest, steel-toed footwear, puncture-resistant search gloves, and Level 2 situational awareness gear as dictated by site threat matrix.
• Certifications: Active POST (Peace Officer Standards and Training) equivalent, FEMA ICS-100/200/700 certifications, and internal company-certified Master Security Officer (MSO) status.

---

4. Roles & Responsibilities (RACI Matrix Table)

• Responsible (R): The role that executes the task and drafts the incident report.
• Accountable (A): The role with final approval authority and validation accountability.
• Consulted (C): The role providing subject matter input, legal parameters, or technical data.
• Informed (I): The role kept updated on report status and operational impact.

---

5. Step-by-Step Operational Procedure

Execution of this procedure requires strict adherence to sequential phases. Do not bypass steps.

Phase 1: Immediate Triage and Containment

• Secure the immediate incident perimeter utilizing physical barriers, caution tape, or access control locks to prevent contamination of evidence.
• Administer emergency first aid or coordinate immediate emergency medical services (EMS) if casualties or injuries are present.
• Notify the Shift Supervisor (SS) via secure radio channel within three (3) minutes of initial scene stabilization.
• Log exact arrival time, initial observations, and environmental conditions (weather, lighting, crowd density) in the field notebook.

Phase 2: Data Capture and Evidence Preservation

• Capture panoramic and macro photographic evidence of the scene, structural damage, or physical threats using the authorized digital device.
• Collect and secure transient physical evidence (e.g., shell casings, discarded items, digital storage media) using strict chain-of-custody protocols.
• Identify all primary witnesses, victims, and potential suspects; separate witnesses immediately to prevent narrative contamination.
• Download and timestamp all relevant Closed-Circuit Television (CCTV) footage and Access Control System (ACS) logs surrounding the event window (-30 minutes to +15 minutes).

Phase 3: Drafting the Incident Report Template

• Access the enterprise eGRC reporting portal and initiate a new document using the standard security company incident report template.
• Populate Section A: Administrative Metadata with Incident ID (auto-generated), Date/Time of Occurrence, Date/Time of Discovery, Exact Location, and Reporting Officer Badge Number.
• Populate Section B: Incident Classification by selecting the primary category (e.g., Physical Trespass, Property Damage, Workplace Violence, InfoSec Breach, Hazmat Spill).
• Populate Section C: Narrative Statement (Chronological) utilizing the strict "Who, What, Where, When, Why, and How" methodology without speculative or emotional language.
• Populate Section D: Personnel & Witness Inventory detailing full legal names, contact numbers, corporate affiliations, and statement summaries.
• Populate Section E: Evidence Log with item numbers, descriptions, serial numbers, storage locations, and transferring officer signatures.

Phase 4: Review, Verification, and Submission

• Conduct a self-audit of the draft report against the Quality Assurance benchmarks outlined in Section 6.
• Submit the draft through the portal routing queue to the Shift Supervisor for initial operational review.
• Incorporate required corrections mandated by the Shift Supervisor within a two-hour turnaround window.
• Confirm final electronic sign-off and secure locking of the report record.

---

6. Quality Assurance & Verification Criteria

Reports must clear automated and manual quality gates before institutional archival.

6.1 Audit Checklist

• Temporal Precision: Timestamps must be recorded in 24-hour UTC format and match system log data within a zero-tolerance $\pm0$-minute window.
• Factual Neutrality: Elimination of subjective terminology (e.g., "aggressive," "suspicious," "uncooperative") replaced with objective behavioral descriptors (e.g., "raised voice exceeding 80dB," "withheld identification upon third request").
• Completeness: 100% field population across all mandatory form fields; no blank or unverified N/A entries permitted without supervisor override code.
• PII Minimization: Masking of unessential personal data in compliance with data privacy mandates, retaining only information strictly pertinent to the security investigation.

6.2 Tolerance Thresholds & Acceptance Benchmarks

• Initial Submission SLA: Must be finalized and submitted in the portal within four (4) hours of shift conclusion.
• Correction Cycle Limit: Maximum of two (2) review-and-correction iterations before mandatory escalation to the Operations Manager.
• Data Integrity Verification: 100% correlation between physical evidence logs and digital CCTV capture timestamps.

---

7. Practical Troubleshooting Scenarios

Scenario A: Key Witness Refuses to Provide Identification or Statement

• Symptom: During Phase 2 data capture, an involved party or eyewitness declines to state their identity or cooperate with security personnel, attempting to exit the premises.
• Immediate Corrective Action Protocol:
  1. Do not utilize physical restraint unless the individual is actively suspected of a felony-level crime or posing an imminent threat to life safety.
  2. Request identification calmly while recording the interaction via body-worn camera.
  3. Document physical description (height, build, clothing, distinguishing marks), direction of travel, and any vehicle make, model, and license plate number.
  4. Immediately notify local law enforcement dispatch if the individual's cooperation is critical to active threat mitigation, and log the CAD dispatch number in Section C of the report.

Scenario B: System Outage of the Enterprise eGRC Reporting Portal

• Symptom: The cloud-based reporting portal experiences a server outage or network failure during active data input, preventing digital submission.
• Immediate Corrective Action Protocol:
  1. Immediately pivot to the encrypted local offline fallback template stored on the secure ruggedized field laptop.
  2. Complete all required fields in the standardized offline Word/PDF template.
  3. Export the completed file to a hardware-encrypted USB drive and notify the IT Security Operations Center (SOC) via secondary communication channels (satellite phone or encrypted landline).
  4. Once network connectivity is restored, upload the offline file as an attachment to the newly generated portal record, and document the system outage ticket number in the administrative remarks.

Scenario C: Conflicting Witness Statements Invalidate Chronological Clarity

• Symptom: Witness A and Witness B provide mutually exclusive timelines or accounts of how an unauthorized perimeter breach occurred.
• Immediate Corrective Action Protocol:
  1. Do not alter or arbitrate the truth value of either statement within the body of the report.
  2. Create separate, dedicated sub-appendices for Witness A and Witness B within Section D.
  3. Utilize objective digital system data (CCTV frame pulls, electronic badge swipe logs, motion sensor trigger logs) as the definitive baseline timeline anchor.
  4. Explicitly state within the narrative: "Perimeter timeline established via ACS telemetry; eyewitness accounts exhibit variance regarding sequence of secondary events (see Appendix D-1 and D-2)."