What it is
Every incident needs a record from detection to close, including the decision on notifying people and agencies. A log makes the response measurable and shows what the firm learned.
The workbook logs 40 incidents with type, severity, systems and data involved, detection and containment times, notification decision, counsel consulted, client and agency notices, insurer notice and lessons learned. Flags show notices outstanding, open decisions and critical incidents still open.
When to use it
- During and after any security event.
- Quarterly review of incidents by the security owner.
- Evidence for insurers and clients.
What’s inside
- 40-row incident log with date-time and severity
- Hours to contain and days open formulas
- Notification decision and notice tracking columns
- Summary by severity with average containment time
Standard cited
This template follows 16 CFR 314.4(h). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Who decides whether notice is required?
Counsel, based on state breach laws, the FTC Safeguards Rule for covered firms, contracts and insurance terms. The log records the decision and the dates.
What should not go in the log?
Personal data. Use IDs and counts.
What is hours to contain?
Time from detection to containment, in hours.
Related templates
- Incident Response Plan for CPA Firms
- Written Information Security Plan (WISP) for CPA Firms
- Backup, Disaster Recovery and Incident Response Checklist
- WISP Risk Assessment Worksheet (Excel)
Last updated 11/05/2026. All free templates.