Incident Report Template You Can Copy Today

Every team needs a standard incident report template before the next outage hits, not during it. A template removes the guesswork about what to write when people are tired and stressed. It also makes every report comparable, so you can spot patterns across incidents — the same service failing every other week shows up only if the reports share a shape.

This guide gives you a ready-to-use incident report template, shows how to fill it, and points out the fields teams forget.

Why a Fixed Template Helps

When an incident starts, nobody wants to design a document. A template answers "what do I write" in one move. It also trains the team to think in the same categories: impact, root cause, action. After twenty incidents, your archive reads like one continuous log instead of twenty different formats.

A shared template also helps new responders. A junior engineer who has never filed a SEV-1 can copy last month's structure and produce something complete. That consistency is what lets leadership trust the reports enough to act on them.

What Goes in the Template

A complete incident report template needs fields for the facts, the story, and the fix. Build it from these blocks:

• Identification — incident ID, title, date, author, severity.
• Summary — a short paragraph for executives.
• Timeline — a time-ordered list with real timestamps.
• Impact — users, duration, and lost function.
• Root cause — one line stating the trigger.
• Resolution — what restored service.
• Follow-up — checkboxes with owner and due date.

Leave the follow-up as checkboxes, not free text. A box stays open until someone closes it. Free text gets forgotten.

Template

Use this as your default incident report template:

# Incident Report: [Title]

Incident ID: INC-XXXX
Date: YYYY-MM-DD
Reporter: [Name]
Severity: SEV-1 / SEV-2 / SEV-3

## Summary
[What broke and who it affected, in 2-3 sentences]

## Timeline
- HH:MM — Symptom detected
- HH:MM — Responder acknowledged
- HH:MM — Cause found
- HH:MM — Fix applied
- HH:MM — Service restored

## Impact
- Users affected: [number or "all"]
- Duration: [minutes]
- Functions lost: [list]

## Root Cause
[The trigger, one sentence]

## Resolution
[Steps that restored service]

## Follow-up Actions
- [ ] Action — Owner: @name — Due: YYYY-MM-DD
- [ ] Action — Owner: @name — Due: YYYY-MM-DD

Real Example

Here is the same template filled for a security incident:

# Incident Report: Phishing Link in Support Inbox

Incident ID: INC-2026-088
Date: 2026-10-29
Reporter: Lee Park
Severity: SEV-2

## Summary
A phishing email reached the support shared inbox. One agent clicked the link
and entered credentials on a fake login page before reporting it.

## Timeline
- 11:02 — Phishing mail delivered to support inbox
- 11:18 — Agent clicked link, entered credentials
- 11:25 — Agent reported to security channel
- 11:40 — Account suspended, sessions killed
- 12:10 — Password reset, MFA enforced

## Impact
- Users affected: 1 agent account (no customer data exposed)
- Duration: 68 minutes from click to containment
- Functions lost: none externally

## Root Cause
No filter caught the sender, and the agent had no phishing training for
look-alike domains.

## Resolution
Suspended account, forced reset, revoked active sessions, scanned inbox.

## Follow-up Actions
- [x] Reset agent credentials, enable MFA — Owner: Lee — Done
- [ ] Add sender-domain filter for look-alikes — Owner: Mia — Due 2026-11-03
- [ ] Run phishing drill for support team — Owner: Mia — Due 2026-11-10

Common Mistakes

Templates fail when the fields are wrong or unused. Watch for these:

1. Too many fields. A ten-section template nobody fills is worse than a three-section one everyone uses. Cut anything your team skips twice in a row.
2. No severity scale. Without SEV levels, everything reads as urgent and nothing gets priority. Define the scale in the template header.
3. Timeline without timezones. "9am" means nothing across regions. Stamp every entry with the real timezone.
4. Follow-up with no owner. "Investigate further" attached to nobody happens never. Every box needs a name.
5. Reusing the template but editing out impact. Teams trim the impact block to soften bad news. Keep it. The numbers are the point.

Copy the Template and Use It

Save the incident report template above into your team's wiki or your reporting tool today, before the next incident. Pair it with our write-up on how to write an incident report so responders know the thinking behind each field. If you already run a sales report or keep a sales report template, use the same cadence and filing habit so all your reports live in one place. The next outage will come; the only question is whether you are ready to write it down.