SekuRad operating guidance ·
Security Incident Report Checklist
A useful physical security incident report records the event, location, observation, accountable owner, response, evidence, outstanding actions, and closure review. It should let another authorised person understand the sequence without reconstructing it from separate messages.
This checklist supports documentation. Follow your site's emergency procedures first; completing a report should never delay a necessary response.
The eight fields to check
Event and reporting times
Record when the event was observed and when it was reported. Include the timezone. If a time is an estimate, label it as an estimate.
Site and precise location
Name the site and the specific gate, building, post, or area. Use identifiers that the responding team can understand.
Factual observation
Describe what the reporter directly observed. Put suspected causes and information supplied by another person in separate, attributed notes.
Reporter and accountable owner
Identify the reporter and the person responsible for the next action. Share personal details only with people who need them for the operation.
Immediate response
Record what was done, by whom, and when. Note emergency escalation separately and follow your established response procedure.
Evidence references
Reference relevant statements, documents, or photographs. Record their source and collection time. Protect originals and use approved retention and access rules.
Outstanding risk and follow-up
List unanswered questions, interim controls, the next action, its owner, and its due date. Missing evidence should remain visible.
Closure review
Record who reviewed the response, what supports closure, and what remains open. A completed action and a closed incident are separate decisions.
Fictional example, no customer information
Gate B found unsecured
- Observation
- At 09:12 site local time, the morning patrol finds Gate B unsecured at North Logistics Hub. No cause is confirmed.
- Response
- At 09:18, the site supervisor records that the gate was secured and the responsible team was notified.
- Evidence
- A supervisor statement is attached at 09:31. The statement describes the response; it does not independently establish the cause.
- Next action
- The site manager is responsible for reviewing why the gate was unsecured and setting a follow-up due date.
- Review status
- Draft summary. Closure awaits the responsible reviewer's decision.
Check the report before sharing it
- Can a reviewer distinguish a direct observation from an assumption?
- Do the event and response times use the same timezone?
- Does each outstanding action have a named owner and due date?
- Can an authorised reviewer locate the evidence behind the summary?
- Have unnecessary personal details and sensitive site information been removed from the recipient's view?
Print this page or use the eight fields in your existing reporting template. Adapt categories, retention, and escalation to your organisation's requirements.
From a checklist to a connected record
SekuRad connects incident records, follow-up actions, and supporting evidence to the relevant site. Explore physical security incident management or bring a redacted report to a working session to confirm the workflow you need.