ChecklistGuro logo ChecklistGuro Solutions Industries Resources Pricing

Cybersecurity Incident Case Management Checklist Template

Respond swiftly and confidently to cybersecurity threats with our Cybersecurity Incident Case Management Checklist Template. Streamline your response process, ensure compliance, and minimize damage - all in one easy-to-use checklist. Download now and fortify your defenses!

This Template was installed 0 times.

Detection & Reporting

1 of 8

Initial steps after a potential incident is identified.

Date of Detection

Time of Detection

0:00
0:15
0:30
0:45
1:00
1:15
1:30
1:45
2:00
2:15
2:30
2:45
3:00
3:15
3:30
3:45
4:00
4:15
4:30
4:45
5:00
5:15
5:30
5:45
6:00
6:15
6:30
6:45
7:00
7:15
7:30
7:45
8:00
8:15
8:30
8:45
9:00
9:15
9:30
9:45
10:00
10:15
10:30
10:45
11:00
11:15
11:30
11:45
12:00
12:15
12:30
12:45
13:00
13:15
13:30
13:45
14:00
14:15
14:30
14:45
15:00
15:15
15:30
15:45
16:00
16:15
16:30
16:45
17:00
17:15
17:30
17:45
18:00
18:15
18:30
18:45
19:00
19:15
19:30
19:45
20:00
20:15
20:30
20:45
21:00
21:15
21:30
21:45
22:00
22:15
22:30
22:45
23:00
23:15
23:30
23:45

Detection Method

Initial Description of Incident

Severity Score (if applicable)

Reported By

Containment

2 of 8

Actions to limit the scope and impact of the incident.

Affected System(s) Tier

Systems Isolated

Number of Systems Isolated

Isolation Start Date

Isolation Start Time

0:00
0:15
0:30
0:45
1:00
1:15
1:30
1:45
2:00
2:15
2:30
2:45
3:00
3:15
3:30
3:45
4:00
4:15
4:30
4:45
5:00
5:15
5:30
5:45
6:00
6:15
6:30
6:45
7:00
7:15
7:30
7:45
8:00
8:15
8:30
8:45
9:00
9:15
9:30
9:45
10:00
10:15
10:30
10:45
11:00
11:15
11:30
11:45
12:00
12:15
12:30
12:45
13:00
13:15
13:30
13:45
14:00
14:15
14:30
14:45
15:00
15:15
15:30
15:45
16:00
16:15
16:30
16:45
17:00
17:15
17:30
17:45
18:00
18:15
18:30
18:45
19:00
19:15
19:30
19:45
20:00
20:15
20:30
20:45
21:00
21:15
21:30
21:45
22:00
22:15
22:30
22:45
23:00
23:15
23:30
23:45

Containment Actions Description

Isolation Zone Location

Eradication

3 of 8

Removing the root cause of the incident.

Root Cause Analysis Summary

Vulnerability Exploited (if applicable)

Number of Affected Systems

Malware Sample (if applicable)

Remediation Steps Taken

Patch Status (for Affected Systems)

Recovery

4 of 8

Restoring affected systems and data.

System Restoration Start Date

System Restoration Start Time

0:00
0:15
0:30
0:45
1:00
1:15
1:30
1:45
2:00
2:15
2:30
2:45
3:00
3:15
3:30
3:45
4:00
4:15
4:30
4:45
5:00
5:15
5:30
5:45
6:00
6:15
6:30
6:45
7:00
7:15
7:30
7:45
8:00
8:15
8:30
8:45
9:00
9:15
9:30
9:45
10:00
10:15
10:30
10:45
11:00
11:15
11:30
11:45
12:00
12:15
12:30
12:45
13:00
13:15
13:30
13:45
14:00
14:15
14:30
14:45
15:00
15:15
15:30
15:45
16:00
16:15
16:30
16:45
17:00
17:15
17:30
17:45
18:00
18:15
18:30
18:45
19:00
19:15
19:30
19:45
20:00
20:15
20:30
20:45
21:00
21:15
21:30
21:45
22:00
22:15
22:30
22:45
23:00
23:15
23:30
23:45

Percentage of Systems Recovered

Detailed Description of Recovery Actions Taken

Data Integrity Verification Method

Data Verification Completion Date

Description of any Data Loss or Corruption

Post-Incident Activity

5 of 8

Reviewing the incident, documenting lessons learned, and improving security posture.

Summary of Incident Root Cause

Detailed Timeline of Events

Affected Systems/Assets

Estimated Financial Impact ($)

Date of Post-Incident Review

Recommendations for Improvement

Incident Severity Level (Reassessed)

Legal & Compliance

6 of 8

Tasks related to legal requirements, reporting obligations, and data privacy.

Applicable Data Breach Laws?

Specific Legal/Regulatory Requirements?

Date of Legal Consultation?

Estimated Number of Affected Individuals

Notification Requirements?

Summary of Legal Review and Advice

Legal Consultation Documentation

Communication

7 of 8

Internal and external communications related to the incident.

Communication Method

Initial Communication Draft

Stakeholders to Notify

Date of First Communication

Time of First Communication

0:00
0:15
0:30
0:45
1:00
1:15
1:30
1:45
2:00
2:15
2:30
2:45
3:00
3:15
3:30
3:45
4:00
4:15
4:30
4:45
5:00
5:15
5:30
5:45
6:00
6:15
6:30
6:45
7:00
7:15
7:30
7:45
8:00
8:15
8:30
8:45
9:00
9:15
9:30
9:45
10:00
10:15
10:30
10:45
11:00
11:15
11:30
11:45
12:00
12:15
12:30
12:45
13:00
13:15
13:30
13:45
14:00
14:15
14:30
14:45
15:00
15:15
15:30
15:45
16:00
16:15
16:30
16:45
17:00
17:15
17:30
17:45
18:00
18:15
18:30
18:45
19:00
19:15
19:30
19:45
20:00
20:15
20:30
20:45
21:00
21:15
21:30
21:45
22:00
22:15
22:30
22:45
23:00
23:15
23:30
23:45

Contact Person Details (Recipient)

Evidence Preservation

8 of 8

Steps to preserve forensic evidence for investigation.

Date and Time of Evidence Collection

Exact Time of Evidence Collection

0:00
0:15
0:30
0:45
1:00
1:15
1:30
1:45
2:00
2:15
2:30
2:45
3:00
3:15
3:30
3:45
4:00
4:15
4:30
4:45
5:00
5:15
5:30
5:45
6:00
6:15
6:30
6:45
7:00
7:15
7:30
7:45
8:00
8:15
8:30
8:45
9:00
9:15
9:30
9:45
10:00
10:15
10:30
10:45
11:00
11:15
11:30
11:45
12:00
12:15
12:30
12:45
13:00
13:15
13:30
13:45
14:00
14:15
14:30
14:45
15:00
15:15
15:30
15:45
16:00
16:15
16:30
16:45
17:00
17:15
17:30
17:45
18:00
18:15
18:30
18:45
19:00
19:15
19:30
19:45
20:00
20:15
20:30
20:45
21:00
21:15
21:30
21:45
22:00
22:15
22:30
22:45
23:00
23:15
23:30
23:45

Location of Evidence Found

Detailed Description of Evidence

Photos/Screenshots of Evidence

Signature of Evidence Collector

Chain of Custody Record Number

We can do it Together

Need help with Checklists?

Have a question? We're here to help. Please submit your inquiry, and we'll respond promptly.

Email Address
How can we help?