Security Incident Report Template Nist

Standard Operating Procedure: Security Incident Report Template (NIST SP 800-61 Rev. 2)

1. Document Control & Revision History

---

2. Executive Summary & Scope

This document defines the standardized protocol for documenting security incidents within the enterprise. It adheres strictly to the NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide) framework. The scope encompasses all digital assets, cloud environments, and physical hardware owned or managed by the organization. This SOP is mandatory for all Security Operations Center (SOC) analysts and Incident Response (IR) team members.

---

3. Prerequisites & Tool Requirements

• Access Requirements: Read/Write access to the Enterprise SIEM (e.g., Splunk, Sentinel) and the IR Ticketing System (e.g., Jira Service Management).
• Certifications: Personnel must hold current GCIH, CISSP, or equivalent operational credentialing.
• Tooling:
  • Unified Log Aggregator (SIEM).
  • Secure Evidence Locker (WORM storage).
  • Forensic Imaging Toolkit (e.g., EnCase, FTK Imager).
  • Encrypted communication channels (e.g., Signal, PGP-encrypted mail).

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase 1: Identification & Initial Triage

• Verify incident alert veracity via SIEM correlation.
• Capture initial packet captures or log snippets into the report.
• Determine incident classification (Severity Level 1-4).

Phase 2: Containment & Eradication

• Execute isolation protocols on compromised endpoints.
• Update firewall egress/ingress filters to halt C2 communication.
• Document all forensic images taken before system restoration.

Phase 3: Post-Incident Reporting (The Template)

• Section A: Executive Summary: High-level timeline and impact.
• Section B: Detection Method: Source of alert (IDS/IPS, user report, threat feed).
• Section C: Incident Details: Indicators of Compromise (IOCs), IP addresses, file hashes.
• Section D: Remediation Actions: Steps taken to contain and eradicate.
• Section E: Lessons Learned: Identification of control gaps.

---

6. Quality Assurance & Verification Criteria

• Verification: Monthly audit of 10% of incident tickets by the Compliance Officer.
• Acceptance: Failure to document within 4 hours results in an immediate mandatory retraining cycle.

---

7. Practical Troubleshooting Scenarios

Scenario A: Forensic Data Corruption

• Failure: Original log source becomes unavailable or corrupted during investigation.
• Corrective Action: Immediately pivot to secondary redundant log sources (e.g., CloudTrail/S3 logs). Notify the Incident Lead and document the loss of evidence in the "Incident Limitations" section.

Scenario B: Unauthorized Data Exfiltration During Investigation

• Failure: Active exfiltration detected via egress filtering while internal responders are active.
• Corrective Action: Immediate "Kill Switch" execution: Sever all external network connectivity to the affected VLAN. Initiate mandatory password rotation for all service accounts associated with that segment.

Scenario C: Stakeholder Non-Compliance

• Failure: Executive stakeholders refuse to authorize system downtime required for containment.
• Corrective Action: Invoke the Emergency Authorization protocol. Escalate to the CISO for legal mandate enforcement under the Business Continuity Plan (BCP).