What should a security incident report contain?
A security incident report needs to satisfy three readers at once: a privacy regulator, your insurer, and the people who have to stop it happening again. Canadian law already specifies most of the fields, so the template below is not an invention. What it adds is the decision record, which the federal breach regulations do not ask for and which is the part your own review cannot function without.
What is the difference between an incident report and an after-action report?
An incident report is about something that happened to you. An exercise’s after-action report is about something you staged. The incident report is the one a regulator may read.
They share a spine, and that is worth exploiting. If your team has filled in the exercise version once, the real one should get written faster and better, which is one of the quieter arguments for exercising at all.
What fields does it need?
Canada’s breach reporting regulations set out what a report to the Privacy Commissioner must contain, and the list transfers almost unchanged into an internal template.
| Field | Why it is there |
|---|---|
| Circumstances of the breach, and the cause if known | a description of the circumstances of the breach and, if known, the cause |
| When it happened | The day or period, or the approximate period if neither is known |
| What information was involved | Described to the extent it is known |
| How many people are affected | The number, or the approximate number |
| What you did to reduce or mitigate harm | The steps you took to reduce the risk of harm to affected individuals, written as actions |
| How you are notifying affected individuals | Steps taken or intended |
| Who can answer questions | A person, with contact details, who can speak for the organization |
| The decision log | Not in the regulation’s list. Who decided what, when, and on what information |
The first seven are the regulation’s own list (Breach of Security Safeguards Regulations, SOR/2018-64, section 2, 2018). The eighth is ours, and it is the field that turns a report into something you can learn from. A report without it records what happened and the steps taken. With it, it also records who decided each step, and on what information.
The notice you send to affected individuals is a shorter list and carries one field the Commissioner’s report does not: a description of the steps that affected individuals could take to reduce the risk of harm that could result from the breach or to mitigate that harm (Breach of Security Safeguards Regulations, SOR/2018-64, section 3, 2018).
Who receives it, and when?
The Privacy Commissioner, where it is reasonable to believe the breach creates a real risk of significant harm to an individual, and the affected individuals themselves (Personal Information Protection and Electronic Documents Act, subsection 10.1(1), 2018). The timing is as soon as feasible after you determine the breach occurred. There is no fixed day count in the federal law, unlike the European seventy-two hour rule.
Quebec runs on its own trigger, the risk that serious harm will be caused, with notification to be made with diligence (Loi sur la protection des renseignements personnels dans le secteur privé, P-39.1, article 3.5, 2022). Quebec publishes the law in French and in English. The French says avec diligence, which word for word is “with diligence”. The official English version says promptly (Act respecting the protection of personal information in the private sector, CQLR c P-39.1, section 3.5 (English version), 2022). Both mean without delay, and neither sets a number of days.
Your insurer is a separate call, with its own clause and its own timing. Find that clause before you need it.
What do you have to keep, and for how long?
Every breach, for 24 months from the day you determine it occurred, whether or not it was reportable (Breach of Security Safeguards Regulations, SOR/2018-64, section 6, 2018). The record has to contain any information that enables the Commissioner to verify compliance with the reporting and notification duties (Breach of Security Safeguards Regulations, SOR/2018-64, section 6, 2018).
In Quebec the register runs longer, at least 5 years, and the clock starts when the organization became aware of the incident (Règlement sur les incidents de confidentialité, chapitre A-2.1, r. 3.1, article 8, 2022).
So the small incidents you decided not to report still need a file. That duty is easy to miss, and hard to fix retroactively, because the information you needed was in somebody’s head on the day.
Do we have to report every incident to the Privacy Commissioner?
No. The reporting duty attaches to a breach of security safeguards where it is reasonable to believe the breach creates a real risk of significant harm to an individual. The record-keeping duty is different and much wider: it covers every breach, reportable or not.
Is an incident report the same thing as the report after a tabletop exercise?
No. An incident report describes something that happened. An exercise produces an after-action report describing something you staged on purpose. The fields overlap, which is useful, because a team that has filled in the exercise version once should fill in the real one faster.
Who writes the incident report?
Whoever kept the decision log, which means somebody has to be given that job at the start rather than at the end. Reconstructing a timeline from memory and message threads a week later is where a report can lose the detail a regulator or a carrier would have wanted.