## Purpose

Use this log throughout an incident to record what happened, what was discovered, decisions made, and actions taken.

Maintain one authoritative timeline wherever practical.

## Incident Information

Incident ID: ____________________

Incident Lead: ____________________

Start date: ____________________

## Timeline

|Date / Time|Event or Finding|Action Taken|Person|Result / Evidence|
|---|---|---|---|---|
||||||
||||||
||||||

## Record Events Such As

- Initial detection
- Employee reports
- Security alerts
- Account changes
- Device isolation
- Session revocation
- Password resets
- Evidence collection
- Vendor contact
- Insurance notification
- Leadership decisions
- System shutdowns
- Recovery actions
- Customer communications
- Return to service

## Important Decisions

Decision: ____________________

Time: ____________________

Decision maker: ____________________

Reason: ____________________

Information available at the time: ____________________

## Outstanding Actions

Action: ____________________

Owner: ____________________

Due: ____________________

Status: ____________________

## Practical Rule

Write down important events and decisions as they happen.

Reconstructing an incident from memory later is unreliable.