Document what happened, who was involved, and what was done about it accurately, promptly, and in a format that holds up under scrutiny.
This security incident report is used to formally record the details of any event that compromises physical security, endangers personnel or disrupts operations. It's the go-to tool for security officers and security managers who need to capture accurate, factual accounts of incidents for legal, regulatory, and internal accountability purposes. Make the most of this report by following these guidelines:
Start collecting information at the scene as soon as it's safe to do so; don't rely on memory alone.
Record only facts. Avoid assumptions, personal opinions, or emotional language.
Document every person involved, including witnesses, with their names and contact details where possible.
Describe the sequence of events clearly and in chronological order.
Note every action taken in response to the incident, including who authorized it and when.
Submit the completed report to your supervisor or designated reviewer within the timeframe set by your organization's policy.
Retain all reports on file in accordance with your compliance and record-keeping requirements.
A security incident report is a formal written record of an event that compromised or threatened the safety, security or integrity of a workplace, facility or system. It documents the who, what, when, where and why of the incident and captures the actions taken in response.
Security incidents range from unauthorized access, theft and physical altercations to trespassing, vandalism, workplace violence and cybersecurity breaches. Each type requires the same disciplined approach to documentation, factual, objective and complete.
For security officers and managers, the report serves multiple purposes. It creates an accurate record for internal investigations, supports disciplinary or legal proceedings, satisfies regulatory reporting obligations and helps identify patterns that can prevent future incidents. A well-written report is also one of the most important things a security professional can produce, because when an incident is reviewed months later, the quality of the documentation often determines the outcome.
A complete security incident report captures the full picture of what happened, who was involved and what was done. Here's what every report should include:
Report number: A unique reference for tracking and cross-referencing in logs and investigations
Date and time of incident: When the incident occurred, as precisely as possible
Date and time of report: When the report was completed
Location: The specific address, area or zone where the incident took place (e.g., Main Entrance, Car Park Level 2, Server Room B)
Incident type: Category of the event (e.g., unauthorized access, theft, assault, trespassing, data breach)
Reporting officer: Name, position and badge or ID number of the officer completing the report
Subjects involved: Names, descriptions and contact details of any individuals directly involved in the incident
Victims: Names and contact details of any individuals who were harmed or directly affected
Witnesses: Names and contact details of anyone who observed the incident
Narrative: A clear, factual, chronological account of what happened — what was observed, heard or reported, and in what order
Physical evidence: Description of any items, damage or physical conditions relevant to the incident
Supporting materials: Reference to any CCTV footage, photos, access logs or other documentation attached to the report
Immediate actions: Steps taken to manage the situation, protect people or secure the scene
Notifications made: Who was contacted and when (e.g., supervisor, police, emergency services, IT security team)
Outcome: Status of the incident at the time of reporting ongoing, contained, referred or resolved
Reporting officer signature: Certifying the accuracy of the report
Supervisor review signature: Confirming the report has been reviewed and accepted
Date of submission
To fill out a security incident report, start at the scene. Collect as much factual information as possible while details are fresh names, times, descriptions of events and any physical evidence. Use a notepad or your mobile device if a printed form isn't immediately available, then transfer to the official report as soon as practicable.
When writing the report:
Start with the basic facts: date, time, location, and incident type.
Write the narrative in the first person and in chronological order. Describe only what you directly observed or were told by a reliable source. Attribute anything you didn't personally witness (e.g., "Witness Jane Lee stated that...").
Be specific. "The subject was approximately 180 cm tall, wearing a black jacket and grey pants, and was observed at 22:14" is more useful than "a man in dark clothing was seen at night."
Avoid jargon, abbreviations or acronyms that might not be understood by someone outside your team.
Document every action you took in response, including the exact times notifications were made and to whom.
Proofread before submitting. Errors, inconsistencies or missing information can undermine credibility in a legal or disciplinary context.
If your organization uses a specific form or reporting system, follow that format exactly. Consistency in format makes reports easier to review and supports pattern analysis across multiple incidents.
Report No.: SIR-2026-047
Date of incident: May 6, 2026
Time: 21:35
Location: Ground Floor Reception, Oakfield Corporate Centre.
Incident type: Unauthorized access attempt.
Reporting officer: T. Nguyen, Security Officer, Badge #204.
Narrative: At approximately 21:35, I was conducting a scheduled patrol of the ground floor when I observed an unknown male attempting to access the stairwell door adjacent to reception using what appeared to be a key card. The door did not open. The subject then attempted the same door twice more before noticing my presence. When approached, the subject stated he was visiting a tenant on Level 4. The subject was unable to produce valid identification or confirm the name of the tenant. I requested the subject remain in the reception area while I contacted the Level 4 tenant by phone. The tenant confirmed no visitor was expected. The subject was escorted from the premises at 21:49 without further incident. CCTV footage covering the reception area from 21:30 to 21:55 has been saved and referenced as Attachment 1.
Actions taken: Supervisor M. Chen notified at 21:50. No police attendance requested. Access logs reviewed, no successful entries recorded. Incident logged in site security register.
Outcome: Subject removed from premises. No further threat identified at time of reporting.
Use this to guide a structured post-incident investigation, covering root cause analysis, evidence gathering, and corrective action planning after a security incident report has been filed.
Use this to evaluate physical and operational security controls across a facility and identify vulnerabilities before they result in a reportable incident.
Use this to conduct and document scheduled security patrols, identify threats or abnormalities on-site and create a record of surveillance activity that supports any subsequent incident report.
