UnixTime

Research Note

Incident Response Record

  • Updated Jun 17, 2026
  • Read 01 min read
  • Status reviewed

Use this to record incident response decisions, actions, approvals, communications, evidence decisions, containment, recovery, and closure.

On this page

When to use this

Practical use

Use this as a working artifact. Fill it with real owners, dates, decisions, evidence locations, and review status.

Use this to record incident response decisions, actions, approvals, communications, evidence decisions, containment, recovery, and closure.

Incident details

Field Value
Incident ID
Linked event ID
Incident category
Incident manager
Business owner
Legal/privacy contact
Evidence required? TBD
Severity
Status

Action log

Time Owner Action or decision Approval needed? Evidence link Status
  • Template
  • Iso27001
  • Incident management

Note Metadata

Aliases: Incident Action Log

Source: 90 Templates/Incident Response Record.md

Graph-sourced resources

Templates and evidence

Implementer templates

Working artifacts for control owners and operators.