What should be included in an incident report after a security breach?

• A. Marketing impact and press strategy
• B. Date/time, parties involved, nature of incident, actions taken, and corrective measures
• C. Names of customers present
• D. Only the date of discovery

Answer: (B)

When documenting a security breach, you want a clear, factual record of what happened and how you responded. The most complete incident report includes the timeline and the actions taken to contain and remediate the issue.

Key elements to include are the date and time of the incident (and when it was discovered) to establish the sequence of events; who or what was involved (the systems, personnel, or third parties); the nature of the incident (what happened and how it occurred); the immediate actions taken (containment, mitigation, escalation, and any notifications); and the corrective measures to prevent recurrence (root cause findings, changes to controls, policy updates, and training).

These pieces matter because they provide accountability, support any required regulatory notifications, guide the investigation, and help improve security going forward.

Other options aren’t appropriate for an incident report. Marketing impact and press strategy belong to communications planning, not the technical and operational record of the breach. Names of customers present raise privacy concerns and are not typically included in an internal incident log; the report should focus on the incident specifics and the response. Simply noting the date of discovery leaves out critical context needed to understand the incident and its impact.