Menu

Security Incident Report Form Template

Speed matters when security incidents occur — every minute of delay increases potential damage. This template gives every employee a clear, structured way to report phishing emails, malware infections, unauthorized access, and data exposure so your security team can respond immediately with all the context they need.

Use this template

Free for non-commercial projects, with unlimited forms and responses.

Last updated

The starting point

About this template

A cybersecurity incident report form is the first link in your incident response chain. When employees know exactly how to report a suspicious email or unauthorized login, your security team receives structured, actionable information instead of a panicked message in Slack at 3 AM. Response time drops, and the quality of information captured improves dramatically.

More about this template

This template covers the full range of common incidents — phishing, malware, unauthorized access, data exposure, and lost devices — and asks the right questions: what happened, when, what systems were affected, and whether the incident is still ongoing. The external notification field is particularly important for regulated industries where breach notification timelines are mandated by law.

formformform makes it easy to publish this form internally without any development work. Link it from your security policy page, pin it in your company Slack, or embed it in your employee handbook. Because it captures a timestamp with every submission, it creates a defensible record that your organization takes security incidents seriously — something regulators and cyber insurers increasingly want to see.

10 fields to make your own8 required in this starting form

Make it fit your workflow.

Use your own copy to change labels, remove questions and add the details you need. Try the preview alongside this guide to see what respondents will be asked.

Use this template
The questions, explained

Fields in this template

Review the starting questions and choices. You can change them in your own copy.

  • Short answerRequired

    Reporter Name

    Chris Martinez

  • Email addressRequired

    Work Email

    chris.martinez@company.com

  • Short answerRequired

    Department

    Finance

  • DateRequired

    Date of Incident

  • Short answerOptional

    Approximate Time of Incident

    e.g., 2:30 PM EST

  • DropdownRequired

    Incident Type

    9 choices
    • Phishing / Suspicious Email
    • Malware or Ransomware
    • Unauthorized Access
    • Data Breach or Data Exposure
    • Lost or Stolen Device
    • Social Engineering Attack
    • Suspicious Network Activity
    • Insider Threat
    • Other
  • Long answerRequired

    Describe What Happened

    Provide as much detail as possible: what you saw, what actions you took, and what led up to the incident.

  • Long answerOptional

    Systems, Files, or Data Affected

    List any systems accessed, files opened, data exposed, or accounts compromised.

  • Single choiceRequired

    Is the incident still ongoing?

    3 choices
    • Yes — active and ongoing
    • No — appears to be contained
    • Unknown
  • Single choiceRequired

    Have any external parties (customers, vendors, regulators) been notified?

    3 choices
    • Yes
    • No
    • Not sure
Where it fits

Who uses this template

Suggested uses, and why this starting point can help. Adapt the questions to your own process.

IT security teams

Employees report suspicious activity originating from a third-party vendor integration so security teams can isolate the connection while investigating.

Compliance and risk officers

Internal teams report suspected customer data exposure events so compliance officers can assess notification obligations under GDPR or CCPA.

Managed security service providers

Ask for the context needed to understand the request before replying. This reduces the back-and-forth needed to establish the basic facts. Review “Approximate Time of Incident” in particular and adapt it to the detail you need.

Healthcare organizations with HIPAA obligations

Clinical staff report accidental exposure of protected health information so compliance teams can determine HIPAA breach notification requirements.

Financial institutions

Use this as a starting point when you need the same essential information from each person. Review the questions against your process before sharing your copy. Review “Describe What Happened” in particular and adapt it to the detail you need.

SaaS companies with security SLAs

Turn initial interest into information you can review. Use the answers to prepare a relevant follow-up and decide whether the opportunity fits your work. Review “Systems, Files, or Data Affected” in particular and adapt it to the detail you need.

Any organization handling sensitive customer data

Gather the details needed before making arrangements. Consistent answers help you spot special requirements and prepare the next step. Review “Is the incident still ongoing?” in particular and adapt it to the detail you need.

What's included

Covers the most common incident types including phishing, malware, and data breach
Captures incident date, time, and whether it is still ongoing
Asks about external party notifications for regulatory compliance
Clear emergency callout at the top for active threats
Confidentiality assurance encourages honest, complete reporting
Immediate email notification to your security team on submission
Timestamped, auditable record for post-incident analysis

How to create a security incident report form

  1. 1

    Click 'Use this template' to copy the form into your formformform account.

  2. 2

    Customize the incident type dropdown to reflect threat categories relevant to your industry.

  3. 3

    Set the notification email to your security team's alias (e.g., security@yourcompany.com) so reports are triaged immediately.

  4. 4

    Add a paragraph field with your incident response hotline number and on-call engineer contact for active emergencies.

  5. 5

    Publish the form link in your security policy, employee handbook, and a pinned Slack message.

  6. 6

    Review submissions on a schedule and archive them with your incident response documentation.

Best practices for your security incident report form

Make it easy to find

a form no one can find is a form no one uses. Pin the link in your company Slack, add it to your intranet sidebar, and mention it in security awareness training.

Emphasize confidentiality

employees often hesitate to report incidents they feel they caused. A clear confidentiality statement increases report rates significantly.

Do not rely on this form alone for active threats

the form is for documentation, not emergency response. Always maintain a phone or Slack channel for immediate escalation.

Keep the form short enough to complete under stress

employees discovering malware on their machine are not calm. Limit required fields to the minimum needed to start an investigation.

Train employees to use it

run a quarterly phishing simulation and follow up with a walkthrough of how to report suspicious emails using this form.

Retain all submissions

incident reports are often requested by insurers, regulators, and auditors months or years after the fact.

12 form ideas you can build with this template

Phishing Email Report Form

Employees forward suspicious emails and describe what made them suspicious, helping the security team identify and block coordinated phishing campaigns.

Lost or Stolen Device Report Form

Staff report missing company laptops or phones immediately so IT can trigger remote wipe procedures before data is compromised.

Ransomware Incident Report Form

Affected employees document which files are encrypted and which systems are unreachable so the security team can scope the blast radius quickly.

Unauthorized Account Access Report Form

Employees report suspicious login alerts or unfamiliar sessions in their accounts so IT can disable compromised credentials and audit access logs.

Data Breach Notification Form

Internal teams report suspected customer data exposure events so compliance officers can assess notification obligations under GDPR or CCPA.

Vendor Security Incident Form

Employees report suspicious activity originating from a third-party vendor integration so security teams can isolate the connection while investigating.

Physical Security Breach Report Form

Staff report unauthorized individuals in secure server rooms or office areas, triggering physical security and IT joint investigation.

Social Engineering Attempt Report Form

Employees document phone calls or in-person requests for sensitive information so the security team can issue company-wide warnings.

Insider Threat Report Form

Employees or managers report unusual colleague behavior — such as bulk data downloads — through a confidential channel that feeds directly to the security team.

Healthcare Data Incident Report Form

Clinical staff report accidental exposure of protected health information so compliance teams can determine HIPAA breach notification requirements.

Financial System Intrusion Report Form

Finance staff report unauthorized transactions or suspicious ERP system activity so the team can freeze accounts and preserve forensic evidence.

Software Supply Chain Incident Form

Developers report suspicious behavior in third-party packages or unexpected code changes in dependencies so the team can assess compromise scope.

Frequently asked questions

Should employees use this form or call the IT security team directly?

For active, ongoing incidents, employees should call or message the security team immediately. This form is for formal documentation — ideally completed after the immediate threat is handled, or alongside direct notification.

Is this form suitable for HIPAA, GDPR, or SOC 2 incident logging?

Yes. The form creates a timestamped record of what was reported, when, and by whom. Most frameworks require documented evidence that incidents were reported and investigated — this form provides the initial record.

Can I receive incident reports anonymously?

The current template requires name and email, but you can mark those fields as optional if you want to allow anonymous reports. Note that anonymous reports are harder to investigate since there is no way to follow up for details.

How do I ensure my security team sees reports immediately?

Configure the formformform notification email to your security team's shared inbox or on-call alias. For high-urgency routing, use Zapier to trigger a PagerDuty alert or Slack message for submissions that select 'Yes — active and ongoing' in the incident status field.

What happens after someone submits this form?

The form captures and stores the submission with a timestamp. Your security team receives an email notification. From there, your incident response runbook takes over — the form feeds into, but does not replace, your IR process.

Part of this collection

Related templates

IT & Technology Forms

Software Access Request Form

Manage software access provisioning with a structured request and approval form.

Customer Support Forms

IT Help Desk Ticket

Let employees report IT issues with all the context your team needs to fix them fast.

IT & Technology Forms

IT Asset Request Form

Streamline equipment requests with a structured IT asset request form.

Customer Support Forms

Bug Report Form

Collect detailed bug reports with steps, severity, and environment info.

IT & Technology Forms

Remote Access Request Form

Manage VPN and remote desktop access requests with security review built in.

IT & Technology Forms

Website Feedback Form

Collect bug reports, suggestions, and content errors directly from site visitors.

IT & Technology Forms

Software Change Request Form

Manage software changes with a structured request, prioritization, and impact assessment.

IT & Technology Forms

Managed IT Client Onboarding Form

Discovery in one form — sites, users, identity, critical systems, backups, and who to call at 2am.

More IT & Technology form templates

View all IT & Technology form templates →

Want a second opinion?

Explore how formformform fits the forms you need to build.

Opens with product context and a link to this page.

View or copy the prompt

Start with the Security Incident Report Form template

Free for non-commercial projects, with unlimited forms and responses.

Use this template