Unauthorized Access Incident Response Checklist Form
Document an unauthorized access incident, track immediate response actions, and record follow-up status.
Incident Identification
Incident Title / Summary
*
Date/Time Detected
*
 -
Month
 -
Day
Year
2 digit month, 2 digit day, 4 digit year
Date
Hour Minutes
AM
PM
AM/PM Option
Detection Channel / Source
*
Please Select
Monitoring alert
User report
Partner notice
Unknown
Other
Affected System / Application Name(s)
*
Access Scope and Impact
Affected Account or Asset Identifier
*
Suspected Access Type
*
Please Select
Account Takeover
Privilege Misuse
Unauthorized Login
Data Viewing
Data Change
Other
Impact Severity
*
Low
Moderate
High
Critical
Response Actions Checklist
Immediate response actions
*
Isolate affected system
Disable or reset compromised access
Preserve logs and evidence
Notify security owner
Begin containment review
Other
Incident owner / responder name
First Name
Middle Name
Last Name
Incident owner / responder role
Notes and Follow-up
Incident Notes or Observations
Additional Systems or Accounts Potentially Affected
Follow-up Status
Please Select
Open
Monitoring
Contained
Closed
Submit Incident Checklist
Should be Empty: