What it means
Cyber incident reporting documents what occurred, impact, scope, actions, evidence, decisions, recovery status, and remaining risk for the intended audience.
Why it matters
Good reporting supports coordination, accountability, learning, assurance, and informed leadership decisions.
Practical focus
- Use a consistent structure and version history
- Separate facts, assessments, and recommendations
- Record sources and material uncertainty
- Tailor technical depth to the audience
Common mistakes
- Writing only after the incident closes
- Copying raw ticket notes into the final report
- Omitting business impact and decisions
- Publishing sensitive details too broadly
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: