Incident Case & Action Log

Records each incident's timeline, decisions, actions, owners and evidence references from declaration to closure.

Available soon

Format: Excel
Size: 124 KB
Length: 13 sheets
Version: 1.2
Updated: 28 Sep 2026

Follow this documentFree account. We can email you when it changes.

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the As-at date on the Summary sheet. The EXAMPLE uses 2026-09-30, the example quarter end; use today's date, or type =TODAY(). Set your working hours and the date the plan was last exercised there too.
2	Open a row on the Cases sheet for every declared incident (IM-03): a case number that never changes, the title, the category and the severity at declaration from the Incident Classification, Severity & Escalation Matrix (keep it; the Severity column holds the current one, and any change is recorded with its time and reason, IM-04), the reporter, and the times it was detected, reported and triage started. Whether triage was on time calculates: 30 minutes in working hours and 60 outside them (IM-02). Record events closed at triage in your service desk; this log holds incidents.
3	Record the declaration time: it is the time of awareness, when every reporting clock starts. Within 4 hours, record the outcome of the reporting screen for NIS2, GDPR and DORA, with the reasons, whether or not a report is made (IM-06), and say whether it was reported as a NIS2 significant or DORA major incident.
4	Add each report on the Reports sheet with its duty ID from the Incident Classification, Severity & Escalation Matrix. The deadline calculates from the declaration time, or from the earlier report its clock runs from; enter the time each report is made, and the result shows On time or Late. Add contract, insurer and police notices too: they have no legal clock and are not counted in IMM-02.
5	Keep the timeline on the Timeline sheet as the incident runs: what happened or was decided, when, who, and where the evidence is (IM-07). Decisions to isolate, stop a service or report go here with who took them (IM-08).
6	Record containment, restoration and closure. Close a Severity 1 or 2 incident only after the 7-day monitoring period without recurrence. The review is due within 10 working days of closure (IM-11); severity 3 and 4 incidents are reviewed together once a quarter. Enter the review date and each review action on the Actions sheet with an owner and a due date.
7	Link each case to the risks it touches in the P05 Information Security Risk Register (they must be reassessed) and to the suppliers involved in the P06 Supplier Security Risk Register.
8	US duties: The US duties are for organisations that are subject to them: HIPAA covered entities and business associates, companies that file reports with the SEC, entities licensed by the New York Department of Financial Services, and organisations that hold personal information of State residents. State laws are shown as placeholders with California and New York as examples; every State has its own. This is not legal advice; ask counsel which duties apply. The US clocks for HIPAA, the FTC's rules and State breach laws run from discovery, not from the declaration time that starts awareness. Record both times (IM-13). The SEC's clock runs from the materiality determination, New York's from the determination that a cybersecurity incident has occurred, and the extortion notices from the payment. The Form 8-K deadline is 17:30 Eastern time on the last business day (a filing whose transmission begins after 5:30 p.m. Eastern time is deemed filed the next business day). On the Reports sheet, the clocks that run from discovery take the Discovered time of the case unless you enter a different time in the US column; enter in the US column the time the duty's clock starts from; the deadline calculates in days or business days. HIPAA's notice to the Secretary for fewer than 500 individuals is due 60 days after the end of the calendar year, not 60 days after discovery: enter that date in the notes and do not rely on the calculated deadline.
9	Take the Summary figures to executive management every quarter (IM-12). Delete the EXAMPLE rows on every sheet before the log is approved. Do not type over the white calculated columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. Its five incidents of Q3 2026, as at 2026-09-30: the ransomware incident at Warehouse 2 (INC-2026-014), reported to the authority as significant and contained 6 hours after detection; a request to change a supplier's bank details, stopped by the call-back check; an order spreadsheet sent to the wrong customer and notified under GDPR; a staff mailbox taken over, declared Severity 2 and lowered to 3 once the audit log showed no personal data had gone; and blocked attempts on the ordering platform, still open. One review action (PIA-04) is overdue.

Working hours are 08:00 to 18:00, Monday to Friday, in the EXAMPLE; change them on the Summary sheet. Review due dates count Monday to Friday and do not know your public holidays: add them to the WORKDAY formula if you need them.

Tailoring — small organisation: the Cases and Actions sheets are the minimum. If you have few incidents, keep the timeline in the case's notes and use the Reports sheet only when a report is made; keep the review for Severity 1 and 2.

Tailoring — regulated financial entity: DORA replaces NIS2's reporting for financial entities. Answer the DORA screen, record when the incident was classified as major on the Reports row for RD-10, and log RD-10 to RD-13 instead of RD-01 to RD-05. DORA Article 17(2) expects every ICT-related incident and significant cyber threat recorded, with its root cause: keep this log for all of them, not only the major ones.

Tailoring — IT run by a managed service provider: the provider's tickets are evidence, not the case log. Copy its detection, triage and containment times into the case row, name its ticket in the timeline's evidence column, and keep the log yourself: the reporting duties and the review are yours.

Cases

One row per declared incident (IM-03). Yellow columns are inputs; white columns calculate. Times are local, as the case log records them.

Example	Case ID	Title	Category ID	Category	Severity at declaration	Severity	Severity changed: when and why (IM-04)	Reporter	Detected	Discovered (first known, IM-13)	Reported	Triage started	Reported in working hours?	Triage limit (minutes)	Minutes to triage	Triage on time? (IM-02)	Declared (awareness)	Contained	Restored	Closed	Incident manager	Executive incident lead	NIS2 screen outcome	GDPR screen outcome	DORA screen outcome	Reported as NIS2 significant?	Reported as DORA major?	Root cause	Linked P05 risk	Linked P06 suppliers	Review held	Hours from detection to containment	Days open	Status	Review due (IM-11)	Review on time?	IMM-01: hours to contain, if significant or major this quarter	Notes
EXAMPLE	INC-2026-014	Ransomware on 14 office PCs at Warehouse 2	IC-01	Ransomware or destructive malware	Severity 1	Severity 1		Security monitoring provider (SUP-006)	12 Aug 2026	12 Aug 2026	12 Aug 2026	12 Aug 2026	No	60	15	On time	12 Aug 2026	12 Aug 2026	13 Aug 2026	21 Aug 2026	Information Security Manager	Chief Operating Officer	Significant: capable of severe operational disruption; early warning, notification and final report made	Personal data breach (availability of shipping records on the PCs); restored from backup, no sign of data taken; unlikely to result in a risk, so recorded and not notified	Not applicable: not a financial entity	Yes	No	A phishing attachment opened by a warehouse office user whose account had local administrator rights. That site's office network was not yet separated, so it spread to 14 PCs.	R-04	SUP-001, SUP-005, SUP-006, SUP-011	27 Aug 2026	6.00	9	Closed	4 Sep 2026	On time	6.00	The security monitoring provider alerted on encryption activity on one office PC at Warehouse 2. It had spread to 14 office PCs on that site's office network before the site was cut off. Ordering and dispatch were not affected.
EXAMPLE	INC-2026-015	Request to change a supplier's bank details from its compromised mailbox	IC-03	Business email compromise and payment fraud	Severity 3	Severity 3		Accounts Payable clerk	2 Sep 2026	2 Sep 2026	2 Sep 2026	2 Sep 2026	Yes	30	15	On time	2 Sep 2026	2 Sep 2026		4 Sep 2026	Information Security Manager		Not significant: no disruption or loss	No personal data breach of ours	Not applicable	No	No	The supplier's mailbox was taken over; our call-back check worked as designed.				0.83	2	Closed	Quarterly review			An email from a real packaging supplier's mailbox asked Accounts Payable to change its bank details before a €84,000 payment run. The call-back to the number on file found the supplier had not sent it. No payment was made; the supplier was told its mailbox was compromised.
EXAMPLE	INC-2026-016	Customer order spreadsheet sent to the wrong business customer	IC-05	Personal data breach	Severity 2	Severity 2		Customer service agent (self-reported)	9 Sep 2026	9 Sep 2026	9 Sep 2026	9 Sep 2026	Yes	30	5	On time	9 Sep 2026	9 Sep 2026		16 Sep 2026	Information Security Manager	Chief Operating Officer	Not significant	Personal data breach (confidentiality): a risk to individuals, so notified to the supervisory authority; not a high risk once the recipient confirmed deletion, so individuals were not told	Not applicable	No	No	The email client suggested a similar address and there was no warning for external recipients.			24 Sep 2026	5.42	7	Closed	30 Sep 2026	On time		A customer service agent emailed a spreadsheet of 212 customers' names, delivery addresses and order histories to the wrong business customer. The recipient confirmed in writing the same day that it had deleted the file. No payment data was included.
EXAMPLE	INC-2026-017	Staff mailbox taken over after a phishing email	IC-04	Account compromise	Severity 2	Severity 3	Lowered to Severity 3 at 2026-09-22 15:20: The mailbox audit log showed no mail had been forwarded or read by the attacker, so no personal data had gone.	Security monitoring provider (SUP-006)	22 Sep 2026	22 Sep 2026	22 Sep 2026	22 Sep 2026	Yes	30	8	On time	22 Sep 2026	22 Sep 2026	22 Sep 2026	24 Sep 2026	Information Security Manager		Not significant	No personal data disclosed (audit log checked); recorded as assessed, not a breach	Not applicable	No	No	A convincing phishing page captured the password; the account's second factor was a text message that the attacker also phished.		SUP-006		0.67	2	Closed	Quarterly review			The security monitoring provider alerted on a sign-in to a sales administrator's mailbox from another country and a new rule forwarding mail outside. Sessions were revoked and the password reset within 40 minutes. The audit log showed no mail had yet been forwarded.
EXAMPLE	INC-2026-018	Blocked attempts to exploit a published weakness on the ordering platform	IC-06	Exploited vulnerability	Severity 4	Severity 4		Hosting provider (SUP-002)	29 Sep 2026	29 Sep 2026	29 Sep 2026	29 Sep 2026	Yes	30	15	On time	29 Sep 2026	29 Sep 2026			IT service desk		Not significant	No personal data affected	Not applicable	No	No	None on our side: an internet-wide campaign against a published weakness.		SUP-002		0.50	1	Open	Quarterly review			The web application firewall blocked repeated attempts to exploit a weakness published the day before. The patch had been applied two days earlier; the attempts are being watched until the campaign stops.

Reports

One row per report or notice made, or due, for a case (IM-06). Duties and clocks are those of the Incident Classification, Severity & Escalation Matrix, on the Lists sheet.

Example	Case ID	Duty	Report	Aware at (declared)	Clock starts at	Deadline	Made	Hours after awareness	Result	Due this quarter? (IMM-02)	Reference and notes
EXAMPLE	INC-2026-014	RD-15	Insurance notice to the cyber insurer	12 Aug 2026	12 Aug 2026	No fixed clock	12 Aug 2026	3.3	Made		Insurer's incident line; its panel firm was not needed
EXAMPLE	INC-2026-014	RD-01	NIS2 early warning	12 Aug 2026	12 Aug 2026	13 Aug 2026	12 Aug 2026	7.3	On time	Yes
EXAMPLE	INC-2026-014	RD-16	Law enforcement crime report	12 Aug 2026	12 Aug 2026	No fixed clock	12 Aug 2026	8.8	Made		Reported to [[the national cybercrime reporting service]]
EXAMPLE	INC-2026-014	RD-02	NIS2 incident notification	12 Aug 2026	12 Aug 2026	15 Aug 2026	14 Aug 2026	53.6	On time	Yes
EXAMPLE	INC-2026-014	RD-04	NIS2 final report	12 Aug 2026	14 Aug 2026	14 Sep 2026	11 Sep 2026	723.6	On time	Yes
EXAMPLE	INC-2026-015	RD-16	Law enforcement crime report	2 Sep 2026	2 Sep 2026	No fixed clock	2 Sep 2026	3.8	Made		Attempted payment fraud reported to [[the national fraud reporting service]]; the insurer was not told, as nothing was lost and the policy does not ask for attempts
EXAMPLE	INC-2026-016	RD-06	GDPR notification to the supervisory authority	9 Sep 2026	9 Sep 2026	12 Sep 2026	11 Sep 2026	46.7	On time	Yes

Holidays

Days the SEC is closed, besides Saturdays and Sundays. The Form 8-K deadline (RD-21) counts business days and skips these. The EXAMPLE rows are US federal holidays from September 2026 to February 2027: check them against the SEC's calendar and add the later ones. A holiday that falls on a Saturday is observed on the Friday before and one on a Sunday on the Monday after: add the observed day, and any day the Commission closes by order. The calculators flag a determination dated after the last day listed.

Day the SEC is closed	Name
7 Sep 2026	Labor Day
12 Oct 2026	Columbus Day
11 Nov 2026	Veterans Day
26 Nov 2026	Thanksgiving Day
25 Dec 2026	Christmas Day
1 Jan 2027	New Year's Day
18 Jan 2027	Birthday of Martin Luther King, Jr.
15 Feb 2027	Washington's Birthday

Timeline

What happened or was decided, when and by whom, for each case, in time order (IM-07, IM-08). Name where the evidence is kept.

Example	Case ID	Time	What happened or was decided	Who
EXAMPLE	INC-2026-014	12 Aug 2026	Monitoring alert: encryption activity on one office PC at Warehouse 2	Security monitoring provider (SUP-006)
EXAMPLE	INC-2026-014	12 Aug 2026	Triage starts (out of hours: within 60 minutes)	IT service desk
EXAMPLE	INC-2026-014	12 Aug 2026	Declared Severity 1, category IC-01; reporting clocks start	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Executive incident lead told	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Decision: cut Warehouse 2's office network off from all other networks (the incident manager's decision; the executive incident lead agreed, as it stopped office work at the site)	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Warehouse 2 office network isolated	Managed IT provider (SUP-001)
EXAMPLE	INC-2026-014	12 Aug 2026	Crisis team convened	Executive incident lead
EXAMPLE	INC-2026-014	12 Aug 2026	Reporting screen complete: NIS2 significant; GDPR breach to assess; DORA not applicable	Incident manager, Data Protection Officer
EXAMPLE	INC-2026-014	12 Aug 2026	Cyber insurer told	Executive incident lead
EXAMPLE	INC-2026-014	12 Aug 2026	Board chair told	Executive incident lead
EXAMPLE	INC-2026-014	12 Aug 2026	Contained: 14 PCs isolated, no activity on any other site	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	NIS2 early warning submitted	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Crime reported	Legal
EXAMPLE	INC-2026-014	12 Aug 2026	Eradicated: the phishing email removed from every mailbox, its sender and attachment blocked, and the affected user's and Warehouse 2 administrator passwords reset	Managed IT provider (SUP-001), email provider (SUP-005)
EXAMPLE	INC-2026-014	13 Aug 2026	Office work resumes on rebuilt PCs; backups checked before restoring	Managed IT provider (SUP-001), backup provider (SUP-011)
EXAMPLE	INC-2026-014	14 Aug 2026	GDPR assessment: unlikely to result in a risk; recorded, not notified	Data Protection Officer
EXAMPLE	INC-2026-014	14 Aug 2026	NIS2 incident notification submitted	Incident manager
EXAMPLE	INC-2026-014	21 Aug 2026	Closed after 7 days' monitoring without recurrence	Incident manager
EXAMPLE	INC-2026-014	27 Aug 2026	Post-incident review held	Head of Information Security
EXAMPLE	INC-2026-014	11 Sep 2026	NIS2 final report submitted	Incident manager

Actions

Every action from a post-incident review, with an owner and a due date (IM-11). Overdue is measured at the As-at date on the Summary sheet.

Example	Action ID	Case ID	Action	Owner	Due	Status	Done on	Linked P05 item	Days overdue	Flag (IMM-03)
EXAMPLE	PIA-01	INC-2026-014	Remove local administrator rights from all office PCs	Head of IT	31 Oct 2026	In progress				Not yet due
EXAMPLE	PIA-02	INC-2026-014	Finish separating the warehouse networks from the office network at all three sites (P05 TA-04; two were still joined on 12 Aug)	Head of IT	11 Sep 2026	Done	11 Sep 2026	TA-04		Done on time
EXAMPLE	PIA-03	INC-2026-014	Reassess the risk of ransomware spreading to warehouse systems (P05 R-04)	Head of Logistics	26 Aug 2026	Done	20 Aug 2026	R-04		Done on time
EXAMPLE	PIA-04	INC-2026-014	Add site isolation steps for each warehouse to the Ransomware Response Playbook	Information Security Manager	25 Sep 2026	Open			5	Overdue
EXAMPLE	PIA-05	INC-2026-014	Give the monitoring provider's out-of-hours analysts a direct line to the incident manager	Head of Information Security	15 Sep 2026	Done	10 Sep 2026			Done on time
EXAMPLE	PIA-06	INC-2026-016	Turn on the warning for external recipients in email, and stop address autocomplete for customer service	Head of IT	15 Oct 2026	In progress				Not yet due

Summary

Quarterly summary

Every figure is calculated from the Cases, Reports and Actions sheets at the As-at date. Take them to executive management each quarter (IM-12).

As-at date	30 Sep 2026	EXAMPLE: the example quarter end. Use today's date, or type =TODAY().
Quarter start	1 Jul 2026	Calculated: the first day of the calendar quarter of the As-at date.
Plan last exercised (not a live incident)	18 Mar 2026	EXAMPLE date. Enter the date of your last exercise of the Incident Response Plan.
Working hours start	30 Dec 1899	Monday to Friday. From the triage rule (IM-02).
Working hours end	30 Dec 1899
Triage limit in working hours (minutes)	30	IM-02.
Triage limit outside working hours (minutes)	60	IM-02.
Post-incident review within (working days of closure)	10	IM-11, for Severity 1 and 2.
IMM-01 target: contained within (hours)	24	From the target "Each contained within [[24]] hours". Use your own.

Headline measures

Measure	Result	Detail	Target	Status	What it means
IMM-01 Significant incidents and time to contain	1	6.00 hours	Each contained within [[24]] hours	On target	Incidents reported to an authority as significant (NIS2) or major (DORA) in the quarter, and for each the hours from detection to containment. Detail: the longest, in hours. The board measure BM-04 in the P03 pack.
IMM-02 Reports made on time	4	of 4	All	On target	Reports to authorities and individuals made by their deadline, out of all that fell due in the quarter. Result on time, detail due. Notices without a legal clock are not counted.
IMM-03 Review actions overdue	1	0 days"	None more than 30 days overdue	On target	Open post-incident review actions past their due date. Detail: how many are more than 30 days overdue.
IMM-04 Months since the plan was last exercised	6	18 Mar 2026	12 or fewer	On target	Whole months from the last exercise of the plan (not a live incident) to the end of the quarter. Detail: the date of the last exercise.

EXAMPLE results: 1 significant incident; contained in 6 hours; 4 of 4; 1 (PIA-04, 5 days); 6 months (last exercise 18 Mar 2026).

Cases by severity

Severity	Declared this quarter	Open at the As-at date	Closed this quarter
Severity 1 (Critical)	1	0	1
Severity 2 (High)	1	0	1
Severity 3 (Medium)	2	0	2
Severity 4 (Low)	1	1	0
All	5	1	4

Quarterly report record

Item	Entry
Reported to executive management by (name, role) and date	[[Name, role, YYYY-MM-DD]]
Significant incidents and what was done about them	[[e.g. INC-2026-014: contained in 6 hours; review actions PIA-01 to PIA-06]]
Decisions needed from executive management	[[e.g. approve the budget for separating the last warehouse network]]

Lists

CategoryID	CategoryName	SeverityName	YesNo	ActionStatus	DutyID	DutyReport	DutyFrom	DutyHours	DutyMonths	DutyDays	DutyBusinessDays	DutyClassifyHours	DutyStartDuty
IC-01	Ransomware or destructive malware	Severity 1	Yes	Open	RD-01	NIS2 early warning	awareness	24	—	—	—	—	—
IC-02	Other malware	Severity 2	No	In progress	RD-02	NIS2 incident notification	awareness	72	—	—	—	—	—
IC-03	Business email compromise and payment fraud	Severity 3		Done	RD-03	NIS2 intermediate report	—	—	—	—	—	—	—
IC-04	Account compromise	Severity 4			RD-04	NIS2 final report	notification	—	1	—	—	—	RD-02
IC-05	Personal data breach				RD-05	NIS2 notice to recipients of our services	awareness	—	—	—	—	—	—
IC-06	Exploited vulnerability				RD-06	GDPR notification to the supervisory authority	awareness	72	—	—	—	—	—
IC-07	Denial of service				RD-07	GDPR communication to the individuals affected	awareness	—	—	—	—	—	—
IC-08	Insider misuse				RD-08	GDPR breach record	—	—	—	—	—	—	—
IC-09	Lost or stolen device				RD-09	GDPR notice to the controller	awareness	—	—	—	—	—	—
IC-10	Supplier incident				RD-10	DORA initial notification	awareness	24	—	—	—	4	—
					RD-11	DORA intermediate report	initial notification	72	—	—	—	—	RD-10
					RD-12	DORA final report	latest intermediate report	—	1	—	—	—	RD-11
					RD-13	DORA notice to clients	awareness	—	—	—	—	—	—
					RD-14	Contract notice to customers under contract	awareness	—	—	—	—	—	—
					RD-15	Insurance notice to the cyber insurer	awareness	—	—	—	—	—	—
					RD-16	Law enforcement crime report	awareness	—	—	—	—	—	—
					RD-17	HIPAA notification to each individual affected	discovery	—	—	60	—	—	—
					RD-18	HIPAA notice to prominent media outlets	discovery	—	—	60	—	—	—
					RD-19	HIPAA notice to the secretary of health and human services	discovery	—	—	60	—	—	—
					RD-20	HIPAA notice by a business associate to the covered entity	discovery	—	—	60	—	—	—
					RD-21	SEC current report on form 8-k, item 1.05	materiality determination	—	—	—	4	—	—
					RD-22	NYDFS notice of a cybersecurity incident	determination	72	—	—	—	—	—
					RD-23	NYDFS notice of an extortion payment	payment	24	—	—	—	—	—
					RD-24	NYDFS written description of why the payment was necessary	payment	—	—	30	—	—	—
					RD-25	State law notice to residents of the state	discovery	—	—	—	—	—	—
					RD-26	State law notice to the state attorney general or regulator	discovery	—	—	—	—	—	—
					RD-27	State law notice to consumer reporting agencies	discovery	—	—	—	—	—	—
					RD-28	FTC Safeguards notice to the federal trade commission	discovery	—	—	30	—	—	—
					RD-29	FTC Health Breach notices under the health breach notification rule	discovery	—	—	60	—	—	—

Definitions

Definitions

Term	Meaning in this workbook
Event	Something observed or reported that might affect the security of our information or services. Most events are not incidents.
Incident	An event, declared by the incident manager, that has compromised, or threatens to compromise, the availability, authenticity, integrity or confidentiality of our data or services, and needs a managed response.
Near miss	An event that could have compromised our data or services but was prevented or did not happen, and needs nothing beyond logging. Logged, never declared. An attack that was stopped but still needs response work, such as warning a supplier, confirming a patch or watching for a repeat, is declared, usually at Severity 4.
Significant incident (NIS2)	NIS2's term: an incident that has caused or could cause severe operational disruption or financial loss to us, or considerable damage to others. Reported to the authority on NIS2's clock.
Major ICT-related incident (DORA)	DORA's term, for financial entities only: an ICT-related incident with a high adverse impact on systems that support critical or important functions, as tested by Delegated Regulation (EU) 2024/1772.
Personal data breach (GDPR)	GDPR's term: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Awareness	The moment the reporting clocks start: the time the incident is declared, as recorded in the case log, unless the record shows we had reasonable certainty earlier, in which case the earlier time. The pack chooses this deliberately. The legal tests turn on what we knew: the EDPB's Guidelines 9/2022 treat a controller as aware once it has a reasonable degree of certainty that a breach occurred, and NIS2 counts from becoming aware of a significant incident, judged on an initial assessment. A late declaration therefore does not postpone a clock the law starts earlier.
Containment	The incident can no longer spread or cause new harm, even though systems may not yet be restored.
Closure	Recovery criteria met, the monitoring period passed without recurrence, and the case log complete.
Discovery (HIPAA, FTC, State law)	The day a breach is first known to us or, by exercising reasonable diligence, would have been known to us, counting what any member of the workforce or any agent knows, other than the person who committed the breach. HIPAA defines it this way (45 CFR 164.404(a)(2)) and the FTC's Health Breach Notification Rule follows it; the Safeguards Rule counts only what is known to the institution (16 CFR 314.4(j)(2)); State laws use the word too, each with its own test. It can be earlier than awareness, the declaration time, so it is recorded separately (IM-13).
Materiality determination (SEC)	A listed company's decision, made without unreasonable delay after it discovers a cybersecurity incident, that the incident is material. It starts the four business days for the Form 8-K report (RD-21). Until it is made, the reason it has not been made is recorded.
Registrant (SEC)	A company that files reports with the Securities and Exchange Commission under the Securities Exchange Act of 1934; in this pack, a listed company. The SEC's rules call it a registrant.
Unsecured protected health information (HIPAA)	Protected health information that has not been made unusable, unreadable or indecipherable to unauthorised people by a technology or method the Secretary of Health and Human Services specifies in guidance (45 CFR 164.402). Whether a given encryption meets that guidance is a question for your privacy officer and counsel.
Determination of a cybersecurity incident (NYDFS)	The New York Department of Financial Services' clock runs from determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider. 23 NYCRR 500.1 defines a cybersecurity incident as a cybersecurity event that impacts the covered entity and requires it to notify any government body, self-regulatory agency or any other supervisory body, has a reasonable likelihood of materially harming a material part of normal operations, or results in ransomware being deployed within a material part of its information systems.
Business day (SEC)	A day on which the Securities and Exchange Commission is open for business. If the event falls on a Saturday, Sunday or a day the Commission is closed, the four business days begin on, and include, the first business day after (Form 8-K, General Instruction B.1). A Form 8-K whose direct transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day (17 CFR 232.13(a)(2)), so the last safe time is 5:30 p.m. Eastern on the fourth business day.
Case ID	The incident's number, given at declaration and never changed (IM-03). The EXAMPLE uses INC-year-number.
Severity at declaration	The severity set when the incident was declared. The Severity column holds the current one; a change, and its time and reason, is recorded beside it (IM-04).
Detected	When the first sign was seen, by a person or a tool. IMM-01 measures from here to containment.
Discovered (first known, IM-13)	When anyone in the organisation first knew, or with reasonable diligence would have known. It is usually the detection time, or earlier. The US clocks (HIPAA, State law, the FTC) start here, not at declaration.
Reported in working hours	Reported between the working hours set on the Summary sheet, Monday to Friday. Sets the triage limit (IM-02): Triage of every reported event must start within 30 minutes of the report in working hours and 60 minutes outside them, and must end within [[30]] minutes of starting with the event closed with a recorded reason or declared an incident.
Screen outcome	Every incident must be screened against every reporting duty (NIS2, GDPR, DORA where it applies, the US duties where we are subject to them, contracts and insurance) within 4 hours of declaration, and the decision and its reasons recorded whether or not a report is made.
Review due	10 working days (Monday to Friday) after closure, for Severity 1 and 2 (IM-11). Severity 3 and 4 incidents are reviewed together once a quarter.
Deadline	From the duty's clock in the Incident Classification, Severity & Escalation Matrix: hours after awareness, or after the earlier report the clock runs from; a one-month clock is due by the end of that day a month later. For DORA's initial notification, the earlier of 4 hours after classification as major and 24 hours after awareness.
Overdue (action)	An action not done whose due date is before the As-at date (IMM-03).
NIS2	Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, as transposed in your Member State. Applies to essential and important entities.
GDPR	The General Data Protection Regulation, Regulation (EU) 2016/679. Applies whenever personal data is affected.
DORA	The Digital Operational Resilience Act, Regulation (EU) 2022/2554, with its Delegated Regulations (EU) 2024/1772 and 2025/301. Applies to financial entities only; for them its reporting replaces NIS2's.
CSIRT	Computer security incident response team: the national team (or the competent authority) that receives NIS2 reports.
HIPAA	The Health Insurance Portability and Accountability Act of 1996 and its rules. Subpart D of 45 CFR Part 164 is the breach notification rule for covered entities (health plans, health care clearinghouses and most health care providers) and, through them, their business associates.
Business associate	A person or organisation that creates, receives, maintains or transmits protected health information for a covered entity, or provides certain services to it. The business associate tells the covered entity (RD-20); the covered entity tells the individuals.
SEC	The United States Securities and Exchange Commission. Form 8-K is the current report listed companies file; Item 1.05 is the item for a material cybersecurity incident.
NYDFS	The New York State Department of Financial Services. Its cybersecurity regulation is 23 NYCRR Part 500; it applies to entities licensed or authorised under the New York Banking Law, Insurance Law or Financial Services Law.
FTC	The United States Federal Trade Commission. Its Safeguards Rule (16 CFR Part 314) covers non-bank financial institutions; its Health Breach Notification Rule (16 CFR Part 318) covers vendors of personal health records and related entities that HIPAA does not.
State breach notification law	Each State, the District of Columbia and the territories have their own law on telling residents (and often an attorney general) about a breach of personal information. California Civil Code 1798.82 and New York General Business Law 899-aa are the examples in this pack.
P05, P06	The Risk Management pack (the Information Security Risk Register) and the Third-Party Security Risk Management pack (the Supplier Security Risk Register) that this log links to.
IM-nn, IC-nn, RD-nn, IMM-nn	Rule, category, reporting duty and measure numbers used across the pack; the rules and measures are in the Security Incident Management Policy.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, Q3 2026, as at 2026-09-30. Delete the EXAMPLE rows before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.24 — Information security incident management planning and preparation	The log as the record the incident management process keeps, and the quarterly summary
ISO/IEC 27001:2022	Annex A 5.26 — Response to information security incidents	Cases and Timeline: the response recorded from declaration to closure
ISO/IEC 27001:2022	Annex A 5.27 — Learning from information security incidents	Review due, review held and the Actions sheet: learning from each incident
ISO/IEC 27001:2022	Annex A 5.28 — Collection of evidence	Timeline evidence reference: where each piece of evidence is kept and who handled it
ISO/IEC 27001:2022	Clause 10.2 — Nonconformity and corrective action	Root cause and review actions with owners, due dates and overdue flags
NIST CSF 2.0	RS.AN-06 — “Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved”	Timeline: actions performed during the investigation recorded
NIST CSF 2.0	RS.MA-02 — “Incident reports are triaged and validated”	Reported, triage started and triage on time: incident reports triaged and validated
NIST CSF 2.0	RC.RP-06 — “The end of incident recovery is declared based on criteria, and incident-related documentation is completed”	Restored and closed, after the monitoring period, with the case record complete
NIS2 — Directive (EU) 2022/2555	Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing)	Reports: early warning, notification and final report deadlines and on-time result
GDPR — Regulation (EU) 2016/679	Article 33(5) — the controller documents every personal data breach: the facts, its effects and the remedial action taken	GDPR screen outcome: every personal data breach documented, notified or not
DORA — Regulation (EU) 2022/2554	Article 17(2) — record all ICT-related incidents and significant cyber threats, and ensure root causes are identified, documented and addressed	Cases and root cause: incidents recorded with their root causes identified and addressed

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA), Delegated Regulations (EU) 2024/1772 and 2025/301, Implementing Regulation (EU) 2025/302