Incident Handling Forms

...

Contacts is six pages long. The form consists of contact information for people to contact in case of an emergency. The contacts include, Corporate Security Officer, Corporate Incident Handling CIRT or FIRST, Corporate Legal Affairs Officers, etc.

The Incident Identification form is two pages long. The form consists of two sections, the general information and Intellectual Property Summary. The form asks a lot of questions regarding the IP information and the Incident Detector’s has information relating to the person that detected the information.

The Incident Containment is two pages long. The form consists of sections regarding the incident. The form asks questions about how the intellectual property was compromised.

The next form is the Incident Eradication form. This form is a page long. The form consists of sections regarding the incident. The form asks questions about the person performing the forensic tasks and vulnerability identified.

The Incident Communication Log form is a page long. The form consists of sections regarding the communication involved during the incident. The form asks questions about the initiator and receiver involved when reporting an incident.

Lastly, we look at the chain of custody form. This form requires a detailed documentation of the chain of evidence. It requires item number, quantity and description of articles.

Conclusion

It is important for an Incident Handling Form to have all the necessary information detailing the breach. This paper provided an overview of the different Incident Handling Forms. This paper was an attempt to briefly introduce the reader to the different forms available to report and incident.

Reference

Sample Incident Handling Forms. (April 23, 2016). Retrieved from https://www.sans.org/score/incident-forms/