What are the key components of a cybersecurity incident report?

• A. Incident facts and timeline only.
• B. Affected assets, containment actions, and remediation steps.
• C. Incident facts, timeline, affected assets, containment actions, root cause, remediation steps, evidence, lessons learned, stakeholders.
• D. Only the stakeholders need to be identified.

Answer: (C)

A cybersecurity incident report should capture a full, actionable record of what happened, when it happened, and how it was handled. This means documenting incident facts and the timeline to establish what occurred and in what order, the assets that were affected to show the scope and impact, the containment actions taken to stop the incident, and the remediation steps to restore operations and prevent recurrence. It also includes a root-cause analysis to identify underlying vulnerabilities or failures, evidence collected for forensics and accountability, lessons learned to improve future response, and the stakeholders who need to be informed or involved.

This comprehensive set of elements ensures the report is useful for post-incident review, regulatory or legal needs, and ongoing security improvements. Leaving out any of these parts—such as the timeline, affected assets, containment, or lessons learned—can leave gaps in understanding, accountability, or the ability to prevent similar incidents in the future.