SECURITY INCIDENT POSTMORTEM

ORGANIZATION NAME
INCIDENT NAME
SECURITY PLAYBOOK USED

INCIDENT OWNER	DATE COMPLETED	INCIDENT ID

INCIDENT SEVERITY

X	LEVEL	ADDITIONAL COMMENTS REGARDING INCIDENT SEVERTIY
HIGH
MEDIUM
LOW
OTHER

INCIDENT PRIORITY

X	LEVEL	ADDITIONAL COMMENTS REGARDING INCIDENT PRIORITY
HIGH
MEDIUM
LOW
OTHER

INCIDENT TYPE

System has been compromised	Malware
Denial-of-service	Issue at physical location
Sweeps, scans, or other reconnaissance	Theft
Phishing	Other (please describe)
ADDITIONAL COMMENTS / “OTHER” DESCRIPTION

INCIDENT TIMELINE

DATE AND TIME OF INCIDENT	DATE AND TIME OF DISCOVERY
CLOSURE DATE	EXPLANATION FOR CLOSURE resolved, false positive, other

INVESTIGATION AND RESPONSE TIMELINE

ACTION	DATE / TIME	OWNER	NOTES

IMPACT OF INCIDENT

SYSTEMS AFFECTED
USERS AFFECTED
IMPACT ON OTHER INVOLVED PARTIES
ADDITIONAL DETAILS

INCIDENT REPORTING

How was the security incident reported? Identify whether the incident was reported by a system or an individual, and include the system location or the contact details of the individual.

LEARNINGS FOR FUTURE INCIDENTS

DISCLAIMER Any articles, templates, or information provided by Smartsheet on the website are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website. Any reliance you place on such information is therefore strictly at your own risk.