A cyber incident file needs the decisions, too

Executive summary

Keep one incident timeline covering alerts, verification, escalation, containment and notification decisions. Identify the source and certainty of each fact, using consistent time zones.

Our recommendation is to record a short reason for key decisions as well as the technical findings. Limit access and avoid copying irrelevant personal data into the incident file. The aim is a reliable account of what the organisation knew at each stage, not an indiscriminate archive of every message.

Sources

KVKK · Veri güvenliğine ilişkin yükümlülükler

https://www.kvkk.gov.tr/Icerik/2040/Veri-Guvenligine-Iliskin-Yukumlulukler