[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-253706-105":53,"doc-detail-253706-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","cybersecurity-and-privacy-incident-report-template-public","Cybersecurity and Privacy Incident Report Template - Public","","A structured incident report template for documenting cybersecurity or data privacy events from intake through closure. It guides incident responders to record what happened and when, affected IT resources and business processes, incident severity, third-party involvement, data destruction or unauthorized disclosure, and potential risks. It also captures root cause details, ongoing containment/eradication/recovery activities, lessons learned, and a prioritized action-items table plus a changelog section for versioning and ownership.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/cybersecurity-and-privacy-incident-report-template-public/253706/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/cybersecurity-and-privacy-incident-report-template-public/253706.png","ImageObject",442,249,{"name":88,"@type":89},"Margaret","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-23","2026-09-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",8,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What details are required in the “What Happened and When” section?","Question",{"text":109,"@type":110},"Record the response coordinator, the incident nature, occurrence date and time with time zone, at-risk IT resources, affected business processes, incident severity, involved third parties, and whether destruction, unauthorized access, or disclosure of personal data/PII occurred.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How does the template help document root cause and confidence?",{"text":114,"@type":110},"It prompts users to state what caused the incident, explain how that conclusion was reached, describe how confident the assessment is, and note any connections to past incidents when applicable.",{"name":116,"@type":107,"acceptedAnswer":117},"What information is captured in the “What Was and Remains to Be Done” section?",{"text":118,"@type":110},"It asks how the problem was detected, how containment limited scope and adverse effects, what steps were taken for eradication, and how recovery restored normal operations or data processing, including the extent of restoration.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},253706,1790250780,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":79,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":73},137451207643,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Cybersecurity and Privacy Incident Report Template  \n[This template aims to help incident responders capture key details about a cybersecurity or data privacy incident. You should customize it to meet your needs. The text in square brackets is meant to guide you; remove it before finalizing the report. The title above is generic; change it to be specific to the incident, possibly by summarizing the nature of the incident.]  \nWhat Happened and When?  \n\n| Who is the response coordinator for this incident? | [The incident response coordinator is typically the person incharge of the response effort and the primary author of this report.] |\n| --- | --- |\n| What was the nature of the incident? |  |\n| When did the incident occur? | [Specify the date, start, and end time, and time zone.] |\n| Which specific IT resources were at risk? | [Examples include an application, employee laptop, server, network device, etc.] |\n| What business processes were affected? |  |\n| What is the severity or significance of the incident? |  |\n| Which third parties, such as vendors or customers (if any), were involved in or affected by the incident? |  |\n| Did the incident result in the destruction or unauthorized disclosure or access of what might be considered | [If yes, describe the type of data that was affected (e.g., employee information, customer contact details, customer electronic data, etc. ) and how it was affected (e.g., unexpected destruction, access, etc. ) .] |\n\n\n| personal data or personally identifiable information (PII)? |  |\n| --- | --- |\n| What might be the cybersecurity or privacy risks to the parties affected by the incident? | [Examples of the risks include identity theft, increased chances of a follow-up attack, damage to reputation, disclosure of sensitive data, etc.] |\n| In which geographic regions was the affected data located? |  |\n| Who are the business owners and key stakeholders of the affected resources or data? |  |\n\nWhat Was the Root Cause?  \n\n| What caused the incident? |  |\n| --- | --- |\n| How do we know? |  |\n| How confident are we in the assessment? |  |\n| What connections exist to past incidents, if any? |  |\n\nWhat Was and Remains to Be Done?  \n\n| Identification: How was the problem detected? | [Also specify the names of the teams and individuals involved.] |\n| --- | --- |\n| Containment: How were we able to limit the incident’s scope, including adverse |  |\n\n\n| effects on the affected data and systems? |  |\n| --- | --- |\n| Eradication: What steps were taken to eliminate adversarial presence from the affected environment, protect the affected data, or minimize the risks to the affected parties? | [Such steps might include deleting malware, restoring from trusted backup, deleting a sensitive file from an unauthorized location, etc.] |\n| Recovery: How and to what extent did we restore normal business operations or normal data processing activities? |  |\n\nWhat Lessons Can Be Learned?  \n\n| How could the involvement of people help mitigate our future risks? |  |\n| --- | --- |\n| How might we adjust processes to prevent the problem or allow us to respond better? |  |\n| How might we use technology to enable us to improve? |  |\n\nWhat Are the Remaining Action Items?  \n\n| Action | Responsible Party | Expected Start Date |\n| --- | --- | --- |\n|  |  |  |\n\nReport Changelog  \n\n| Date | Author | Change Description |\n| --- | --- | --- |\n|  |  |  |\n\nAbout this Document  \nThis cybersecurity and privacy incident report is based on the template originally developed at Axonius [Inc.](Inc. by)[ by](Inc. by)  Lenny Zeltser and Elisabetta Tiani with input from  Daniel Trauner. It’s distributed according to the Creative Commons v4 “Attribution” License.","cbCaioWERTFPaFPg","https://ap.wps.com/l/cbCaioWERTFPaFPg","pdf",55889,"English","# What Happened and When?\n# What Was the Root Cause?\n# What Was and Remains to Be Done?\n# What Lessons Can Be Learned?\n# What Are the Remaining Action Items?\n# Report Changelog\n# About this Document","[{\"question\":\"What details are required in the “What Happened and When” section?\",\"answer\":\"Record the response coordinator, the incident nature, occurrence date and time with time zone, at-risk IT resources, affected business processes, incident severity, involved third parties, and whether destruction, unauthorized access, or disclosure of personal data/PII occurred.\"},{\"question\":\"How does the template help document root cause and confidence?\",\"answer\":\"It prompts users to state what caused the incident, explain how that conclusion was reached, describe how confident the assessment is, and note any connections to past incidents when applicable.\"},{\"question\":\"What information is captured in the “What Was and Remains to Be Done” section?\",\"answer\":\"It asks how the problem was detected, how containment limited scope and adverse effects, what steps were taken for eradication, and how recovery restored normal operations or data processing, including the extent of restoration.\"}]","Cybersecurity and Privacy Incident Report Template - Public | PDF",1789269193]