Network Incident Response Plan Checklist
Use this form to document, track, and review a network incident response from detection through containment, recovery, and lessons learned.
Incident Identification
Incident title / summary
*
Incident ID / ticket reference
Date and time incident was detected
*
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Date and time reported
*
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Reporter name / role / contact method
*
Incident Classification and Scope
Incident Category / Type
*
Malware
Phishing
Unauthorized Access
DDoS
Data Exfiltration
Service Outage
Misconfiguration
Suspicious Network Traffic
Other
Severity / Priority
*
Critical
High
Medium
Low
Affected Environment or Business Unit
Brief Description of Impact / Scope
*
Affected Assets and Detection Details
Affected systems/assets
*
Servers
Endpoints
Network devices
Cloud services
Email systems
VPN
Firewall
Other
Asset identifiers or hostnames
*
Detection source
*
SIEM
IDS/IPS
User report
Monitoring alert
Firewall log
Antivirus
Other
Observable indicators of compromise or anomaly details
Incident Timeline and Actions Taken
Time first noticed
*
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Time containment started
*
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Time containment completed
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Time eradication started
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Time recovery started
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Time recovery completed
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Immediate containment actions taken
Eradication steps completed
Current incident status
*
Open
Contained
Under investigation
Eradicated
Recovered
Monitoring
Escalation, Notifications, Evidence, and Review
Who was notified
*
Notification date and time
*
-
Month
-
Day
Year
Date
Hour Minutes
AM
PM
AM/PM Option
Teams or vendors engaged
Internal IT
Security Team
Legal
Management
External Vendor
Evidence and attachments
Upload a File
Drag and drop files here
Choose a file
Cancel
of
Post-incident notes and lessons learned
Closure and approval status
*
Open
Pending Review
Closed
Approved
Owner Sign-off
Submit Checklist
Should be Empty: