Security incident report template

A useful security incident report records what was detected, when and where, who reviewed it and what they decided, each action taken in order, the outcome and any follow up still open. The template below shows the structure NightMarshal uses for every incident, completed for an after hours intrusion at an equipment yard.

Updated 18 October 2026

Incident summary

ReferenceINC-87421
SiteEquipment Yard 01, north gate
CameraCAM 07 north gate
Detected02:14 local time
RuleNo access between 20:00 and 06:00
OutcomePerson left the site after a speaker warning. Site contact informed.
StatusClosed with one open follow up

Timeline

TimeStepBy
02:14:06Motion detected in the restricted zone at the north gateDetection software
02:14:19AI check. One person on foot outside access hoursAI
02:14:41Incident confirmed after reviewing the clip and site notesReviewer
02:15:02Speaker warning playedReviewer
02:15:30On call site contact called and informedReviewer
02:16:12Person seen leaving toward the east fence lineReviewer

Evidence

One clip from 02:14:06 to 02:16:12 is attached to the record and stored under the retention period in the customer agreement.

Follow up

  • Inspect the fence line near the north gate. Owner is the site manager.

What every incident report should include

  • What was detected, when and on which camera
  • The rule or reason it needed attention
  • Who reviewed it and what they decided
  • Each action taken, in order, with times
  • The outcome and any follow up with an owner
  • Where the clip is stored and who can see it

Get a quote for your site

Tell us what you protect and how incidents are handled today. We check your cameras and outline a monitoring plan with a written quote.

Get a site assessment