<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-incident-documentation-standards
description: >-
  Define documentation standards with structured templates, required field validation, evidence chain-of-custody, and completeness scoring.
domain: cybersecurity
subdomain: incident-management
tags:
  - documentation
  - templates
  - evidence
  - chain-of-custody
  - standards
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.AN-1", "RS.RP-1"]
  frameworks: ["NIST SP 800-61", "NIST SP 800-86"]
---

# Implementing Incident Documentation Standards

## Overview

Consistent documentation ensures incidents are recorded with sufficient
detail for RCA, regulatory compliance, legal proceedings, and trend analysis.

## Required Fields by Severity

| Field | S1 | S2 | S3 | S4 |
|-------|----|----|----|----| 
| Classification | ✓ | ✓ | ✓ | ✓ |
| Timeline | ✓ | ✓ | ✓ | ✓ |
| Summary | ✓ | ✓ | ✓ | ✓ |
| Impact Assessment | ✓ | ✓ | ✓ | Opt |
| Response Actions | ✓ | ✓ | Opt | Opt |
| Evidence Inventory | ✓ | ✓ | Opt | — |
| Root Cause | ✓ | ✓ | ✓ | Opt |
| Lessons Learned | ✓ | ✓ | Opt | — |

## Evidence Chain of Custody

```
HANDLING: Collection (who/when/what/how) → Hash (SHA-256) → Encrypted Storage →
Transfer Log → Access Log → Retention per legal hold
```

## Completeness Scoring

| Rating | Score | Action |
|--------|-------|--------|
| Complete | ≥ 90% | Closure approved |
| Partial | 70–89% | Review required |
| Incomplete | < 70% | Cannot close |

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Templates enforced in ticketing system
- [ ] Required fields validated on closure
- [ ] Evidence chain of custody documented
- [ ] Completeness scoring automated
