Incident Timeline and Action Log
Purpose
Use this log throughout an incident to record what happened, what was discovered, decisions made, and actions taken.
Maintain one authoritative timeline wherever practical.
Incident Information
Incident ID: ____________________
Incident Lead: ____________________
Start date: ____________________
Timeline
Record Events Such As
- Initial detection
- Employee reports
- Security alerts
- Account changes
- Device isolation
- Session revocation
- Password resets
- Evidence collection
- Vendor contact
- Insurance notification
- Leadership decisions
- System shutdowns
- Recovery actions
- Customer communications
- Return to service
Important Decisions
Decision: ____________________
Time: ____________________
Decision maker: ____________________
Reason: ____________________
Information available at the time: ____________________
Outstanding Actions
Action: ____________________
Owner: ____________________
Due: ____________________
Status: ____________________
Practical Rule
Write down important events and decisions as they happen.
Reconstructing an incident from memory later is unreliable.