Post-Incident Report
Definition
The formal written account produced after an incident is closed. It synthesises the timeline log into a structured narrative covering the incident summary, impact assessment, root-cause analysis, response actions taken, and recommendations. Audience: management, auditors, legal counsel, and regulators.
- Produced
- After the incident is formally closed
- Source material
- Synthesised from the incident timeline log
- Sections
- Summary, impact, root cause, response actions, recommendations
- Audience
- Management, auditors, legal counsel, regulators
Common questions
How does it differ from the raw incident timeline log it draws on?+
The timeline log is a chronological, technical record of every action taken during response; the report reorganises that material into a narrative aimed at non-technical readers, adding business impact, root-cause conclusions and forward-looking recommendations that the log itself does not contain.
Why might a regulator specifically request this document?+
Many breach-notification regimes require an organisation to show what happened, what was affected, and what is being done to prevent recurrence, and a structured post-incident report is the standard way to demonstrate that analysis was actually performed rather than merely claimed.
Related terms
- Breach Notification
- The legal obligation to inform regulators and affected individuals when personal data is compromised in a security incident. Timelines and thresholds differ...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Incident Ticket
- The structured record opened in an IT service management or case management system when an alert is escalated to an incident. It...
- Lessons-Learned Report
- A post-incident review document identifying what succeeded, what failed, the root cause, and specific recommended changes to policy, tooling, or training. Produced...
- Timeline Log
- A chronological, append-only record capturing every analyst action and finding during the response, time-stamped at the moment of entry in UTC. It...