Cyber Security Incident Report Writer

# 27. Cyber Security Incident Report Writer

**Domain:** Incident Response
**Level:** Practitioner

## Use Case

Produce a complete, professional cyber security incident report from raw incident notes, timeline data, and technical findings. Suitable for board reporting, regulatory submission, insurance claims, and post-incident reviews. Covers what happened, root cause, impact, response actions, and lessons learned.

## Variables

| Variable | What to Enter | Example |
|----------|--------------|---------|
| `[INCIDENT_SUMMARY]` | Brief description of what happened | e.g. Ransomware deployed on 14 servers following successful phishing attack on 3 November; production systems offline for 18 hours |
| `[INCIDENT_TIMELINE]` | Chronological sequence of events | Paste your incident log, timeline notes, or bullet points - raw format is fine |
| `[IMPACT]` | What was affected and to what extent | e.g. 3,400 customer records potentially accessed; payment processing offline 18 hours; estimated recovery cost GBP 240k; no confirmed data exfiltration |
| `[RESPONSE_ACTIONS]` | What was done to respond and recover | e.g. Systems isolated within 2 hours; backup restoration completed 18 hours post-detection; threat actor persistence removed; all passwords reset |
| `[ORGANISATION_AND_AUDIENCE]` | Organisation name and who this report is for | e.g. Fintech Ltd - report for Audit Committee and ICO notification; or CISO report for board |
| `[REGULATORY_CONTEXT]` | Any regulatory notification obligations | e.g. GDPR Article 33 (ICO notification required within 72 hours); FCA operational incident reporting; or 'internal use only' |

## The Prompt

Copy everything below this line. Replace all `[VARIABLES]` with your specific information. Paste into Claude, GPT-4o, Gemini, or any capable LLM.

---