What does an incident report contain?

An incident report contains an executive summary, a timeline of the attack, the scope affected (systems, accounts, data), the entry point and root cause, the containment and remediation actions taken, the business impact, indicators of compromise and prioritised recommendations. A good report also states clearly what remains uncertain, so readers know how far they can rely on its conclusions.

This article is part of our series on how incident response unfolds. For the full picture, see How does incident response work?.

What an incident report is for

The report is the reference document for the incident. It meets three needs:

• Deciding: management learns what happened, what risk remains and what investment is needed.
• Fixing: technical teams or the MSP get the list of actions to carry out.
• Proving: insurers, authorities and sometimes the courts rely on its facts and timeline.

NIST, in Revision 3 of SP 800-61 published in April 2025, stresses that lessons from an incident should feed improvements across cybersecurity risk management as a whole. A report that is not read, or not followed by action, is of little value.

The sections of a complete incident report

Section	Content	Main reader
Executive summary	What happened in a few lines, severity, current status, decisions needed	Management
Timeline	Key dates and times: first attacker action, detection, containment, eviction, recovery	Everyone
Scope	Machines, accounts, applications and data affected	IT team, DPO
Entry point and root cause	How the attacker got in and why it was possible	Management, IT team
Actions taken	Containment, eviction, restoration, secret resets, with dates	IT team, insurer
Impact	Downtime, activities affected, data accessed or exfiltrated	Management, DPO, insurer
Indicators of compromise	Addresses, files, accounts, techniques observed	SOC, IT team
Confidence level	What is established, what is uncertain, areas not analysed	Management
Recommendations	Prioritised short- and medium-term measures, each with an owner	Management, MSP
Appendices	Evidence collected, analysis methods, relevant logs	Experts, authorities

The confidence level section is often missing. Yet it is essential: it tells readers whether the attacker can be considered evicted. See How do you know the attacker is gone?.

Incident report vs regulatory notifications

The incident report is an internal document. Notifications to authorities follow their own formats and deadlines, but they draw on the same investigative work.

Under NIS2 (Article 23), an essential or important entity reports a significant incident in three stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report no later than one month after the notification. The final report includes a detailed description of the incident (severity and impact), the type of threat or likely root cause, the mitigation measures applied and ongoing, and any cross-border impact. If the incident is still ongoing at that point, a progress report is submitted, followed by the final report within a month of the incident being handled. National transposition timing varies: as of 29 September 2026, France had not yet adopted its NIS2 law. See Does a managed SOC help with NIS2?.

Under GDPR (Article 33), a personal data breach that poses a risk is to be notified to the supervisory authority within 72 hours of becoming aware of it. The notification describes the nature of the breach (categories and approximate number of people and records), the data protection officer’s contact details, the likely consequences and the measures taken or proposed. The same article provides for every breach to be documented, notified or not: facts, effects and remedial action.

A well-structured incident report already holds all of this. That is why it is best built as the incident unfolds rather than at the end.

Common mistakes

• Too technical: management does not read it and decisions are not made. The summary should fit on one page.
• Recommendations with no owner or deadline: they never happen.
• An incomplete timeline: without the detection time, you cannot show that notification deadlines were met.
• Hiding uncertainty: the report loses credibility as soon as new facts emerge.
• Overlooking personal data: having the DPO review the report helps check the GDPR-related points. See Is incident response mandatory?.

Who receives the report when an MSP is involved?

When an SME is supported by a Cyna partner MSP, the MSP owns the client relationship and passes reports on to its client. Monthly activity and vulnerability reports from the Cyna platform can be exported as CSV or PDF, white-labelled. During an incident, when Cyna’s CERT is mobilised, it documents the investigation and the actions carried out with the MSP. For what comes next, see What happens after incident response?.

Talk to an expert

Want to know what your SOC would hand over after an incident, or need a second opinion on an existing report? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Who writes the incident report?

Usually the incident response provider that ran the investigation, with input from the IT team or MSP on the actions carried out. Management reviews it and approves the decisions that follow.

Can the incident report go to the insurer?

Yes, it often forms the basis of the claim. Before sharing it, check with your lawyer what is appropriate to disclose, particularly sensitive technical detail and personal data.

Is a report needed for a minor incident?

Yes, but in proportion. A few paragraphs are enough for a blocked phishing attempt. GDPR Article 33(5) also provides for every personal data breach to be documented, even when it is not notified to the supervisory authority.

How soon after the incident is the report delivered?

An initial situation update is useful within the first days. For entities subject to NIS2, Article 23 provides for a final report to the authorities no later than one month after the incident notification.