Written reports

How the written report is structured is often dictated by several factors. There are many aspects of an incident response, such as the personnel involved, the type and depth of the investigation conducted, the amount of resources involved, and how many individuals from the organization were involved not only in investigating the incident, but who also have a stake in the outcome. As a result, some organizations may combine the core elements of the incident report, executive summary, and the forensic report into a single document. Others may find that separating out the documentation may better serve those with differing involvement and stakes in the incident investigation. The following are some of the key pieces of information that should be captured and reported during an investigation.

Executive summary

As was previously discussed, the executive summary captures the macro-level view of the incident. This includes a summary of the events, a description of the root cause,...