Incident Review Layout

---

Prepared By: [Your Name]

Company: [Your Company Name]

---

1. Incident Summary

1.1 Overview

Provide a high-level summary of the incident, including what happened, where it occurred, and when.

• Incident Title:

• Date of Incident:

• Time of Incident:

• Location:

• Duration of Impact:

• Reported By:

• Incident Classification Level:

1.2 Key Details

Outline the primary facts and critical information about the incident.

Detail	Description
Affected Systems	List systems impacted
Scope of Incident	Number of users/regions affected
Incident Severity Level	Low/Medium/High
Major Stakeholders	List involved departments
Incident Coordinator	Assigned individual
Primary Communication Method	Email, Phone, etc.

---

2. Root Cause Analysis

2.1 Problem Identification

Define the root cause and contributing factors.

• Root Cause: Describe the main issue that led to the incident.

• Contributing Factors:

  • Network connectivity issues

  • Software errors

  • Configuration changes

2.2 Timeline of Events

A chronological breakdown of significant events.

Time	Event Description	Person Responsible
09:00 AM	Initial Incident Reported	John Doe
09:15 AM	Investigative Team Assembled	Incident Coordinator
09:30 AM	Root Cause Hypothesized	Technical Lead
10:00 AM	Mitigation Strategy Deployed	IT Support
11:30 AM	Incident Declared Resolved	Operations Manager

2.3 Impact Analysis

Analyze the broader consequences of the incident.

• System Downtime: Hours/minutes of downtime

• Data Loss: Amount of data impacted

• Customer Impact: Number of clients affected, service-level breaches

• Financial Impact: Estimated costs, if applicable

---

3. Response and Containment

3.1 Immediate Actions Taken

List the critical steps executed in response to the incident.

• Containment Actions:

  • Isolated affected systems

  • Blocked network access for compromised systems

• Mitigation Efforts:

  • Applied temporary fix

  • Rolled back recent changes

3.2 Long-Term Remediation

Outline any corrective measures taken to prevent recurrence.

Remediation Task	Assigned To	Completion Date
Update Security Protocols	Security Team	mm/dd/yyyy
Conduct Team Training	HR Department	mm/dd/yyyy
Upgrade System Architecture	IT Department	mm/dd/yyyy
Establish Incident Response Playbook	Operations	mm/dd/yyyy

---

4. Communication Review

4.1 Internal Communications

Summarize the internal communications during the incident.

• Notification Channels: Email, Slack, SMS

• Frequency of Updates: Every 15 minutes/Every hour

• Key Stakeholders Notified: Executive team, affected departments

4.2 External Communications

Detail the communication efforts directed at clients or the public.

• Public Statements Released: Website update, press release

• Client Notifications: Email updates, SMS alerts

• Social Media Management: Addressed inquiries, provided reassurance

---

5. Lessons Learned

5.1 Positive Takeaways

Highlight what worked well during the incident response.

• Successful Early Detection: Early warnings enabled swift action

• Effective Team Collaboration: Cross-functional teams communicated efficiently

• Timely Resolution: Issue resolved within the expected timeframe

5.2 Areas for Improvement

Identify opportunities for future improvement.

Issue Encountered	Suggested Improvement	Responsible Team
Slow initial response time	Implement automatic alerts	IT Operations
Inadequate documentation	Update incident response guidelines	Documentation Team
Communication delays	Designate backup communication leads	Communications Team

---

6. Action Plan

6.1 Preventative Measures

Outline the actions to avoid similar incidents in the future.

• Regular Training Sessions: Monthly cybersecurity awareness training

• Infrastructure Improvements: Invest in redundancy systems

• System Audits: Conduct quarterly vulnerability assessments

6.2 Follow-up Schedule

Plan for ongoing monitoring and review of the implemented changes.

Follow-up Action	Due Date	Assigned Team
Conduct Post-Mortem Review	mm/dd/yyyy	Incident Response
Implement Security Upgrades	mm/dd/yyyy	IT Security
Review & Update Policies	mm/dd/yyyy	Compliance Team

---

Report Templates @ Template.net