What Is an Incident Intake Form?
An incident intake form captures early facts when something may have gone wrong.
It helps your team document the first details before memories fade, messages get scattered, or the response becomes harder to reconstruct.
A simple incident intake form may include:
Date and time When was the issue reported or discovered?
Reporter Who reported the issue?
System or asset What system, account, device, vendor, or process may be affected?
Severity How serious does the issue appear at intake?
Description What happened, what was observed, and what is known so far?
Evidence What screenshots, logs, files, alerts, or messages should be preserved?
Owner Who is responsible for reviewing, assigning, or escalating the incident?
The goal is not to have every answer immediately.
The goal is to capture enough information to start the response in an organized way.
Follow Contra Average for practical cybersecurity and incident response documentation tips.
