Incident Case & Action Log

Records each incident's timeline, decisions, actions, owners and evidence references from declaration to closure.

Available soon

Format: Excel
Size: 113 KB
Length: 12 sheets
Version: 1.0
Updated: 28 Sep 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.029 Sep 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the As-at date on the Summary sheet. The EXAMPLE uses 2026-09-30, the example quarter end; use today's date, or type =TODAY(). Set your working hours and the date the plan was last exercised there too.
2	Open a row on the Cases sheet for every declared incident (IM-03): a case number that never changes, the title, the category and the severity at declaration from the Incident Classification, Severity & Escalation Matrix (keep it; the Severity column holds the current one, and any change is recorded with its time and reason, IM-04), the reporter, and the times it was detected, reported and triage started. Whether triage was on time calculates: 30 minutes in working hours and 60 outside them (IM-02). Record events closed at triage in your service desk; this log holds incidents.
3	Record the declaration time: it is the time of awareness, when every reporting clock starts. Within 4 hours, record the outcome of the reporting screen for NIS2, GDPR and DORA, with the reasons, whether or not a report is made (IM-06), and say whether it was reported as a NIS2 significant or DORA major incident.
4	Add each report on the Reports sheet with its duty ID from the Incident Classification, Severity & Escalation Matrix. The deadline calculates from the declaration time, or from the earlier report its clock runs from; enter the time each report is made, and the result shows On time or Late. Add contract, insurer and police notices too: they have no legal clock and are not counted in IMM-02.
5	Keep the timeline on the Timeline sheet as the incident runs: what happened or was decided, when, who, and where the evidence is (IM-07). Decisions to isolate, stop a service or report go here with who took them (IM-08).
6	Record containment, restoration and closure. Close a Severity 1 or 2 incident only after the 7-day monitoring period without recurrence. The review is due within 10 working days of closure (IM-11); severity 3 and 4 incidents are reviewed together once a quarter. Enter the review date and each review action on the Actions sheet with an owner and a due date.
7	Link each case to the risks it touches in the P05 Information Security Risk Register (they must be reassessed) and to the suppliers involved in the P06 Supplier Security Risk Register.
8	Take the Summary figures to executive management every quarter (IM-12). Delete the EXAMPLE rows on every sheet before the log is approved. Do not type over the white calculated columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. Its five incidents of Q3 2026, as at 2026-09-30: the ransomware incident at Warehouse 2 (INC-2026-014), reported to the authority as significant and contained 6 hours after detection; a request to change a supplier's bank details, stopped by the call-back check; an order spreadsheet sent to the wrong customer and notified under GDPR; a staff mailbox taken over, declared Severity 2 and lowered to 3 once the audit log showed no personal data had gone; and blocked attempts on the ordering platform, still open. One review action (PIA-04) is overdue.

Working hours are 08:00 to 18:00, Monday to Friday, in the EXAMPLE; change them on the Summary sheet. Review due dates count Monday to Friday and do not know your public holidays: add them to the WORKDAY formula if you need them.

Tailoring — small organisation: the Cases and Actions sheets are the minimum. If you have few incidents, keep the timeline in the case's notes and use the Reports sheet only when a report is made; keep the review for Severity 1 and 2.

Tailoring — regulated financial entity: DORA replaces NIS2's reporting for financial entities. Answer the DORA screen, record when the incident was classified as major on the Reports row for RD-10, and log RD-10 to RD-13 instead of RD-01 to RD-05. DORA Article 17(2) expects every ICT-related incident and significant cyber threat recorded, with its root cause: keep this log for all of them, not only the major ones.

Tailoring — IT run by a managed service provider: the provider's tickets are evidence, not the case log. Copy its detection, triage and containment times into the case row, name its ticket in the timeline's evidence column, and keep the log yourself: the reporting duties and the review are yours.

Cases

One row per declared incident (IM-03). Yellow columns are inputs; white columns calculate. Times are local, as the case log records them.

Example	Case ID	Title	Category ID	Category	Severity at declaration	Severity	Severity changed: when and why (IM-04)	Reporter	Detected	Reported	Triage started	Reported in working hours?	Triage limit (minutes)	Minutes to triage	Triage on time? (IM-02)	Declared (awareness)	Contained	Restored	Closed	Incident manager	Executive incident lead	NIS2 screen outcome	GDPR screen outcome	DORA screen outcome	Reported as NIS2 significant?	Reported as DORA major?	Root cause	Linked P05 risk	Linked P06 suppliers	Review held	Hours from detection to containment	Days open	Status	Review due (IM-11)	Review on time?	IMM-01: hours to contain, if significant or major this quarter	Notes
EXAMPLE	INC-2026-014	Ransomware on 14 office PCs at Warehouse 2	IC-01	Ransomware or destructive malware	Severity 1	Severity 1		Security monitoring provider (SUP-006)	12 Aug 2026	12 Aug 2026	12 Aug 2026	No	60	15	On time	12 Aug 2026	12 Aug 2026	13 Aug 2026	21 Aug 2026	Information Security Manager	Chief Operating Officer	Significant: capable of severe operational disruption; early warning, notification and final report made	Personal data breach (availability of shipping records on the PCs); restored from backup, no sign of data taken; unlikely to result in a risk, so recorded and not notified	Not applicable: not a financial entity	Yes	No	A phishing attachment opened by a warehouse office user whose account had local administrator rights. That site's office network was not yet separated, so it spread to 14 PCs.	R-04	SUP-001, SUP-005, SUP-006, SUP-011	27 Aug 2026	6.00	9	Closed	4 Sep 2026	On time	6.00	The security monitoring provider alerted on encryption activity on one office PC at Warehouse 2. It had spread to 14 office PCs on that site's office network before the site was cut off. Ordering and dispatch were not affected.
EXAMPLE	INC-2026-015	Request to change a supplier's bank details from its compromised mailbox	IC-03	Business email compromise and payment fraud	Severity 3	Severity 3		Accounts Payable clerk	2 Sep 2026	2 Sep 2026	2 Sep 2026	Yes	30	15	On time	2 Sep 2026	2 Sep 2026		4 Sep 2026	Information Security Manager		Not significant: no disruption or loss	No personal data breach of ours	Not applicable	No	No	The supplier's mailbox was taken over; our call-back check worked as designed.				0.83	2	Closed	Quarterly review			An email from a real packaging supplier's mailbox asked Accounts Payable to change its bank details before a €84,000 payment run. The call-back to the number on file found the supplier had not sent it. No payment was made; the supplier was told its mailbox was compromised.
EXAMPLE	INC-2026-016	Customer order spreadsheet sent to the wrong business customer	IC-05	Personal data breach	Severity 2	Severity 2		Customer service agent (self-reported)	9 Sep 2026	9 Sep 2026	9 Sep 2026	Yes	30	5	On time	9 Sep 2026	9 Sep 2026		16 Sep 2026	Information Security Manager	Chief Operating Officer	Not significant	Personal data breach (confidentiality): a risk to individuals, so notified to the supervisory authority; not a high risk once the recipient confirmed deletion, so individuals were not told	Not applicable	No	No	The email client suggested a similar address and there was no warning for external recipients.			24 Sep 2026	5.42	7	Closed	30 Sep 2026	On time		A customer service agent emailed a spreadsheet of 212 customers' names, delivery addresses and order histories to the wrong business customer. The recipient confirmed in writing the same day that it had deleted the file. No payment data was included.
EXAMPLE	INC-2026-017	Staff mailbox taken over after a phishing email	IC-04	Account compromise	Severity 2	Severity 3	Lowered to Severity 3 at 2026-09-22 15:20: The mailbox audit log showed no mail had been forwarded or read by the attacker, so no personal data had gone.	Security monitoring provider (SUP-006)	22 Sep 2026	22 Sep 2026	22 Sep 2026	Yes	30	8	On time	22 Sep 2026	22 Sep 2026	22 Sep 2026	24 Sep 2026	Information Security Manager		Not significant	No personal data disclosed (audit log checked); recorded as assessed, not a breach	Not applicable	No	No	A convincing phishing page captured the password; the account's second factor was a text message that the attacker also phished.		SUP-006		0.67	2	Closed	Quarterly review			The security monitoring provider alerted on a sign-in to a sales administrator's mailbox from another country and a new rule forwarding mail outside. Sessions were revoked and the password reset within 40 minutes. The audit log showed no mail had yet been forwarded.
EXAMPLE	INC-2026-018	Blocked attempts to exploit a published weakness on the ordering platform	IC-06	Exploited vulnerability	Severity 4	Severity 4		Hosting provider (SUP-002)	29 Sep 2026	29 Sep 2026	29 Sep 2026	Yes	30	15	On time	29 Sep 2026	29 Sep 2026			IT service desk		Not significant	No personal data affected	Not applicable	No	No	None on our side: an internet-wide campaign against a published weakness.		SUP-002		0.50	1	Open	Quarterly review			The web application firewall blocked repeated attempts to exploit a weakness published the day before. The patch had been applied two days earlier; the attempts are being watched until the campaign stops.

Reports

One row per report or notice made, or due, for a case (IM-06). Duties and clocks are those of the Incident Classification, Severity & Escalation Matrix, on the Lists sheet.

Example	Case ID	Duty	Report	Aware at (declared)	Clock starts at	Deadline	Made	Hours after awareness	Result	Due this quarter? (IMM-02)	Reference and notes
EXAMPLE	INC-2026-014	RD-15	Insurance notice to the cyber insurer	12 Aug 2026	12 Aug 2026	No fixed clock	12 Aug 2026	3.3	Made		Insurer's incident line; its panel firm was not needed
EXAMPLE	INC-2026-014	RD-01	NIS2 early warning	12 Aug 2026	12 Aug 2026	13 Aug 2026	12 Aug 2026	7.3	On time	Yes
EXAMPLE	INC-2026-014	RD-16	Law enforcement crime report	12 Aug 2026	12 Aug 2026	No fixed clock	12 Aug 2026	8.8	Made		Reported to [[the national cybercrime reporting service]]
EXAMPLE	INC-2026-014	RD-02	NIS2 incident notification	12 Aug 2026	12 Aug 2026	15 Aug 2026	14 Aug 2026	53.6	On time	Yes
EXAMPLE	INC-2026-014	RD-04	NIS2 final report	12 Aug 2026	14 Aug 2026	14 Sep 2026	11 Sep 2026	723.6	On time	Yes
EXAMPLE	INC-2026-015	RD-16	Law enforcement crime report	2 Sep 2026	2 Sep 2026	No fixed clock	2 Sep 2026	3.8	Made		Attempted payment fraud reported to [[the national fraud reporting service]]; the insurer was not told, as nothing was lost and the policy does not ask for attempts
EXAMPLE	INC-2026-016	RD-06	GDPR notification to the supervisory authority	9 Sep 2026	9 Sep 2026	12 Sep 2026	11 Sep 2026	46.7	On time	Yes

Timeline

What happened or was decided, when and by whom, for each case, in time order (IM-07, IM-08). Name where the evidence is kept.

Example	Case ID	Time	What happened or was decided	Who
EXAMPLE	INC-2026-014	12 Aug 2026	Monitoring alert: encryption activity on one office PC at Warehouse 2	Security monitoring provider (SUP-006)
EXAMPLE	INC-2026-014	12 Aug 2026	Triage starts (out of hours: within 60 minutes)	IT service desk
EXAMPLE	INC-2026-014	12 Aug 2026	Declared Severity 1, category IC-01; reporting clocks start	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Executive incident lead told	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Decision: cut Warehouse 2's office network off from all other networks (the incident manager's decision; the executive incident lead agreed, as it stopped office work at the site)	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Warehouse 2 office network isolated	Managed IT provider (SUP-001)
EXAMPLE	INC-2026-014	12 Aug 2026	Crisis team convened	Executive incident lead
EXAMPLE	INC-2026-014	12 Aug 2026	Reporting screen complete: NIS2 significant; GDPR breach to assess; DORA not applicable	Incident manager, Data Protection Officer
EXAMPLE	INC-2026-014	12 Aug 2026	Cyber insurer told	Executive incident lead
EXAMPLE	INC-2026-014	12 Aug 2026	Board chair told	Executive incident lead
EXAMPLE	INC-2026-014	12 Aug 2026	Contained: 14 PCs isolated, no activity on any other site	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	NIS2 early warning submitted	Incident manager
EXAMPLE	INC-2026-014	12 Aug 2026	Crime reported	Legal
EXAMPLE	INC-2026-014	12 Aug 2026	Eradicated: the phishing email removed from every mailbox, its sender and attachment blocked, and the affected user's and Warehouse 2 administrator passwords reset	Managed IT provider (SUP-001), email provider (SUP-005)
EXAMPLE	INC-2026-014	13 Aug 2026	Office work resumes on rebuilt PCs; backups checked before restoring	Managed IT provider (SUP-001), backup provider (SUP-011)
EXAMPLE	INC-2026-014	14 Aug 2026	GDPR assessment: unlikely to result in a risk; recorded, not notified	Data Protection Officer
EXAMPLE	INC-2026-014	14 Aug 2026	NIS2 incident notification submitted	Incident manager
EXAMPLE	INC-2026-014	21 Aug 2026	Closed after 7 days' monitoring without recurrence	Incident manager
EXAMPLE	INC-2026-014	27 Aug 2026	Post-incident review held	Head of Information Security
EXAMPLE	INC-2026-014	11 Sep 2026	NIS2 final report submitted	Incident manager

Actions

Every action from a post-incident review, with an owner and a due date (IM-11). Overdue is measured at the As-at date on the Summary sheet.

Example	Action ID	Case ID	Action	Owner	Due	Status	Done on	Linked P05 item	Days overdue	Flag (IMM-03)
EXAMPLE	PIA-01	INC-2026-014	Remove local administrator rights from all office PCs	Head of IT	31 Oct 2026	In progress				Not yet due
EXAMPLE	PIA-02	INC-2026-014	Finish separating the warehouse networks from the office network at all three sites (P05 TA-04; two were still joined on 12 Aug)	Head of IT	11 Sep 2026	Done	11 Sep 2026	TA-04		Done on time
EXAMPLE	PIA-03	INC-2026-014	Reassess the risk of ransomware spreading to warehouse systems (P05 R-04)	Head of Logistics	26 Aug 2026	Done	20 Aug 2026	R-04		Done on time
EXAMPLE	PIA-04	INC-2026-014	Add site isolation steps for each warehouse to the Ransomware Response Playbook	Information Security Manager	25 Sep 2026	Open			5	Overdue
EXAMPLE	PIA-05	INC-2026-014	Give the monitoring provider's out-of-hours analysts a direct line to the incident manager	Head of Information Security	15 Sep 2026	Done	10 Sep 2026			Done on time
EXAMPLE	PIA-06	INC-2026-016	Turn on the warning for external recipients in email, and stop address autocomplete for customer service	Head of IT	15 Oct 2026	In progress				Not yet due

Summary

Quarterly summary

Every figure is calculated from the Cases, Reports and Actions sheets at the As-at date. Take them to executive management each quarter (IM-12).

As-at date	30 Sep 2026	EXAMPLE: the example quarter end. Use today's date, or type =TODAY().
Quarter start	1 Jul 2026	Calculated: the first day of the calendar quarter of the As-at date.
Plan last exercised (not a live incident)	18 Mar 2026	EXAMPLE date. Enter the date of your last exercise of the Incident Response Plan.
Working hours start	30 Dec 1899	Monday to Friday. From the triage rule (IM-02).
Working hours end	30 Dec 1899
Triage limit in working hours (minutes)	30	IM-02.
Triage limit outside working hours (minutes)	60	IM-02.
Post-incident review within (working days of closure)	10	IM-11, for Severity 1 and 2.
IMM-01 target: contained within (hours)	24	From the target "Each contained within [[24]] hours". Use your own.

Headline measures

Measure	Result	Detail	Target	Status	What it means
IMM-01 Significant incidents and time to contain	1	6.00 hours	Each contained within [[24]] hours	On target	Incidents reported to an authority as significant (NIS2) or major (DORA) in the quarter, and for each the hours from detection to containment. Detail: the longest, in hours. The board measure BM-04 in the P03 pack.
IMM-02 Reports made on time	4	of 4	All	On target	Reports to authorities and individuals made by their deadline, out of all that fell due in the quarter. Result on time, detail due. Notices without a legal clock are not counted.
IMM-03 Review actions overdue	1	0 days"	None more than 30 days overdue	On target	Open post-incident review actions past their due date. Detail: how many are more than 30 days overdue.
IMM-04 Months since the plan was last exercised	6	18 Mar 2026	12 or fewer	On target	Whole months from the last exercise of the plan (not a live incident) to the end of the quarter. Detail: the date of the last exercise.

EXAMPLE results: 1 significant incident; contained in 6 hours; 4 of 4; 1 (PIA-04, 5 days); 6 months (last exercise 18 Mar 2026).

Cases by severity

Severity	Declared this quarter	Open at the As-at date	Closed this quarter
Severity 1 (Critical)	1	0	1
Severity 2 (High)	1	0	1
Severity 3 (Medium)	2	0	2
Severity 4 (Low)	1	1	0
All	5	1	4

Quarterly report record

Item	Entry
Reported to executive management by (name, role) and date	[[Name, role, YYYY-MM-DD]]
Significant incidents and what was done about them	[[e.g. INC-2026-014: contained in 6 hours; review actions PIA-01 to PIA-06]]
Decisions needed from executive management	[[e.g. approve the budget for separating the last warehouse network]]

Lists

CategoryID	CategoryName	SeverityName	YesNo	ActionStatus	DutyID	DutyReport	DutyFrom	DutyHours	DutyMonths	DutyClassifyHours	DutyStartDuty
IC-01	Ransomware or destructive malware	Severity 1	Yes	Open	RD-01	NIS2 early warning	awareness	24	—	—	—
IC-02	Other malware	Severity 2	No	In progress	RD-02	NIS2 incident notification	awareness	72	—	—	—
IC-03	Business email compromise and payment fraud	Severity 3		Done	RD-03	NIS2 intermediate report	—	—	—	—	—
IC-04	Account compromise	Severity 4			RD-04	NIS2 final report	notification	—	1	—	RD-02
IC-05	Personal data breach				RD-05	NIS2 notice to recipients of our services	awareness	—	—	—	—
IC-06	Exploited vulnerability				RD-06	GDPR notification to the supervisory authority	awareness	72	—	—	—
IC-07	Denial of service				RD-07	GDPR communication to the individuals affected	awareness	—	—	—	—
IC-08	Insider misuse				RD-08	GDPR breach record	—	—	—	—	—
IC-09	Lost or stolen device				RD-09	GDPR notice to the controller	awareness	—	—	—	—
IC-10	Supplier incident				RD-10	DORA initial notification	awareness	24	—	4	—
					RD-11	DORA intermediate report	initial notification	72	—	—	RD-10
					RD-12	DORA final report	latest intermediate report	—	1	—	RD-11
					RD-13	DORA notice to clients	awareness	—	—	—	—
					RD-14	Contract notice to customers under contract	awareness	—	—	—	—
					RD-15	Insurance notice to the cyber insurer	awareness	—	—	—	—
					RD-16	Law enforcement crime report	awareness	—	—	—	—

Definitions

Definitions

Term	Meaning in this workbook
Event	Something observed or reported that might affect the security of our information or services. Most events are not incidents.
Incident	An event, declared by the incident manager, that has compromised, or threatens to compromise, the availability, authenticity, integrity or confidentiality of our data or services, and needs a managed response.
Near miss	An event that could have compromised our data or services but was prevented or did not happen, and needs nothing beyond logging. Logged, never declared. An attack that was stopped but still needs response work, such as warning a supplier, confirming a patch or watching for a repeat, is declared, usually at Severity 4.
Significant incident (NIS2)	NIS2's term: an incident that has caused or could cause severe operational disruption or financial loss to us, or considerable damage to others. Reported to the authority on NIS2's clock.
Major ICT-related incident (DORA)	DORA's term, for financial entities only: an ICT-related incident with a high adverse impact on systems that support critical or important functions, as tested by Delegated Regulation (EU) 2024/1772.
Personal data breach (GDPR)	GDPR's term: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Awareness	The moment the reporting clocks start: the time the incident is declared, as recorded in the case log, unless the record shows we had reasonable certainty earlier, in which case the earlier time.
Containment	The incident can no longer spread or cause new harm, even though systems may not yet be restored.
Closure	Recovery criteria met, the monitoring period passed without recurrence, and the case log complete.
Case ID	The incident's number, given at declaration and never changed (IM-03). The EXAMPLE uses INC-year-number.
Severity at declaration	The severity set when the incident was declared. The Severity column holds the current one; a change, and its time and reason, is recorded beside it (IM-04).
Detected	When the first sign was seen, by a person or a tool. IMM-01 measures from here to containment.
Reported in working hours	Reported between the working hours set on the Summary sheet, Monday to Friday. Sets the triage limit (IM-02): Triage of every reported event must start within 30 minutes of the report in working hours and 60 minutes outside them, and must end within [[30]] minutes of starting with the event closed with a recorded reason or declared an incident.
Screen outcome	Every incident must be screened against every reporting duty (NIS2, GDPR, DORA where it applies, contracts and insurance) within 4 hours of declaration, and the decision and its reasons recorded whether or not a report is made.
Review due	10 working days (Monday to Friday) after closure, for Severity 1 and 2 (IM-11). Severity 3 and 4 incidents are reviewed together once a quarter.
Deadline	From the duty's clock in the Incident Classification, Severity & Escalation Matrix: hours after awareness, or after the earlier report the clock runs from; a one-month clock is due by the end of that day a month later. For DORA's initial notification, the earlier of 4 hours after classification as major and 24 hours after awareness.
Overdue (action)	An action not done whose due date is before the As-at date (IMM-03).
NIS2	Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, as transposed in your Member State. Applies to essential and important entities.
GDPR	The General Data Protection Regulation, Regulation (EU) 2016/679. Applies whenever personal data is affected.
DORA	The Digital Operational Resilience Act, Regulation (EU) 2022/2554, with its Delegated Regulations (EU) 2024/1772 and 2025/301. Applies to financial entities only; for them its reporting replaces NIS2's.
CSIRT	Computer security incident response team: the national team (or the competent authority) that receives NIS2 reports.
P05, P06	The Risk Management pack (the Information Security Risk Register) and the Third-Party Security Risk Management pack (the Supplier Security Risk Register) that this log links to.
IM-nn, IC-nn, RD-nn, IMM-nn	Rule, category, reporting duty and measure numbers used across the pack; the rules and measures are in the Security Incident Management Policy.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, Q3 2026, as at 2026-09-30. Delete the EXAMPLE rows before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.24 — Information security incident management planning and preparation	The log as the record the incident management process keeps, and the quarterly summary
ISO/IEC 27001:2022	Annex A 5.26 — Response to information security incidents	Cases and Timeline: the response recorded from declaration to closure
ISO/IEC 27001:2022	Annex A 5.27 — Learning from information security incidents	Review due, review held and the Actions sheet: learning from each incident
ISO/IEC 27001:2022	Annex A 5.28 — Collection of evidence	Timeline evidence reference: where each piece of evidence is kept and who handled it
ISO/IEC 27001:2022	Clause 10.2 — Nonconformity and corrective action	Root cause and review actions with owners, due dates and overdue flags
NIST CSF 2.0	RS.AN-06 — “Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved”	Timeline: actions performed during the investigation recorded
NIST CSF 2.0	RS.MA-02 — “Incident reports are triaged and validated”	Reported, triage started and triage on time: incident reports triaged and validated
NIST CSF 2.0	RC.RP-06 — “The end of incident recovery is declared based on criteria, and incident-related documentation is completed”	Restored and closed, after the monitoring period, with the case record complete
NIS2 — Directive (EU) 2022/2555	Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing)	Reports: early warning, notification and final report deadlines and on-time result
GDPR — Regulation (EU) 2016/679	Article 33(5) — the controller documents every personal data breach: the facts, its effects and the remedial action taken	GDPR screen outcome: every personal data breach documented, notified or not
DORA — Regulation (EU) 2022/2554	Article 17(2) — record all ICT-related incidents and significant cyber threats, and ensure root causes are identified, documented and addressed	Cases and root cause: incidents recorded with their root causes identified and addressed

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA), Delegated Regulations (EU) 2024/1772 and 2025/301, Implementing Regulation (EU) 2025/302