San Francisco State University - Information Technology Services (ITS) - Incident Response Report Form - 2.8.0

Sep 12, 2026

Upload by Rizky

Incident Response Report form version 2.8.0 for San Francisco State University Information Technology Services (ITS), used to document and triage information security events that could threaten confidentiality, integrity, or availability of university IT assets. The form distinguishes reportable incidents from isolated low-impact events, guides users to submit a Service Desk ticket with specific urgency and description conventions, and collects detailed evidence and containment-related observations. It includes mandatory in-depth synopsis questions covering principals, detection and occurrence timing, malware involvement, transmission vectors, unauthorized access indicators, and related artifacts.

LanguageEnglish

CategoryForms

FormatPDF

Pages10

Reading Time4 min

AccessFree to download

Incident Response Report Form version 2.8.0

Principals

Usage

Initial Assessment (Triage)

In-Depth Synopsis

San Francisco State University Information Technology Services (ITS) | Incident Response Report
Form version 2.8.0 | Date Report Submitted (PST) 20yy / mm / dd | | --- | --- | | | Date of Incident (PST) 20yy / mm / dd | | |
Service Now Ticket \#
________________________ | Principals User/System Admin Identification Device Identification | User’s Name Email Address Phone Number SFSU Employee ID Office Location Department Job Title
User’s Availability Supervisor’s Name Supervisor’s Email Supervisor’s Phone | | Vendor Make Model
OS/Firmware SFSU Property Tag Computer Name IP Address
MAC Address
Device Encryption | | | --- | --- | --- | --- | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ ] Yes [ ] No | | | | Encryption Key | Convey to ITS in person | | | | | Upon request | Usage An Information Security Incident is an event that violates SF State information security policy in such away that it has the potential to seriously compromise the confidentiality, integrity or availability of SF State information technology assets. Not all incidents need to be reported. Isolated low impact events that do not put protected (Level 1 or Level 2) data at risk generally can be handled without using this form. Such incidents can be addressed internally. Though for the sake of maintaining university-wide statistics it’s worthwhile to submit an incident ticket to the Service Desk along with the relevant details and mark the entry as “resolved.” Initial Assessment (Triage) This section is used to assist in evaluating the potential severity of an incident and should be completed as soon as possible after it occurs. Please convey this preliminary information by opening a Service Desk ticket (e.g. [https://sfsu.service](https://sfsu.service)[now.edu/](now.edu/)) . When submitting a ticket for a suspected incident the “Urgency” field should be set to“Security/Health/Safety.” The “Assignment Group” field should be set to “ITS Security L2 .” The “Short Description” field should begin with the phrase “INFOSEC Incident” followed by the name of the caller and a brief synopsis of the incident. For example: INFOSEC Incident -Jonas Salk Malicious Email Attachment A more detailed synopsis should be placed in the “Description” field. Place responses to both the “Principals” section and the following series of questions in the ticket’s initial description. Someone from ITS will either respond via the help desk system, or contact you directly by phone. Please resist the urge to provide curt, obstructive, response like “Don’t know.” Once you’ve processed the initial assessment questions and contacted ITS please complete the “InDepth Synopsis” section of this form and attach the completed Incident Response form to the Service Desk ticket. Finally, this is a Microsoft Word document and it’s intended to be edited. 􀂃 Please delete sections that you don’t complete 􀂃 Also use text highlighting to help signify your entries. Who observed the incident? Is this user the same person who initiated the event? At this point you may need to interview the user to elicit additional details. What was the user doing at the time of the incident? What indicators of compromise have been observed? Depending on the nature of the incident, are there indicators or artifacts which provide additional context about the incident? Emphasize quality and relevance of data over sheer quantity while maintaining completeness. For example: screen shots, log files on the breached endpoint, browser history, URLs, timestamps, email messages, DNS cache entries, executable file paths, server-side audit trails, etc. Attach related artifacts (with the exception of executable files and potentially malicious documents) to the ticket for this incident. Screen shots in particular should attempt to capture as much useful information as possible. Can the indicators o

FAQs

When must an information security incident be reported using this form?

Report incidents that violate SF State information security policy and could seriously compromise confidentiality, integrity, or availability of university IT assets. Isolated low-impact events that do not put Level 1 or Level 2 protected data at risk can generally be handled without this form.

How should the Service Desk ticket be submitted during initial assessment?

Open a Service Desk ticket and set “Urgency” to “Security/Health/Safety,” “Assignment Group” to “ITS Security L2,” and start “Short Description” with “INFOSEC Incident” followed by the caller’s name and a brief incident synopsis. Place principals responses and the series of questions in the ticket’s initial description.

Which details are required in the in-depth synopsis section?

The in-depth synopsis questions are mandatory and cover network connection, detection timing (including uncertainty ranges), whether detection and occurrence coincide, malware involvement, likely malware transmission mechanism, and indications of unauthorized access. The form also prompts additional context and emphasizes attachment of relevant evidence and artifacts.

Sep 12, 2026

Upload by Rizky