Reviewed 17 August 2026
CRA incident reporting template: what to prepare before the clock starts
A structure for rehearsal. This is not an official notification form and must never hold live incident evidence.
A useful template is a map of owners and sources, not a blank document. Each field below should have a named owner, a system of record and an evidence status before a real event occurs.
Fictional worked example
Scenario label: “Fictional Gateway Model X — sanitised drill”. Awareness recorded at T+0 by the on-call product-security lead. Event type: actively exploited vulnerability (fictional).
| Stage | Field | Owner role | Source system | Status |
|---|---|---|---|---|
| 24h | Event type and awareness time | On-call PSIRT lead | Incident record | Ready |
| 24h | Member States of availability | Sales operations | Market register | Unknown — assign |
| 24h | Submission owner and deputy | Compliance lead | RACI | Draft |
| 72h | Product identifier and versions | Product management | Release inventory | Ready |
| 72h | Initial severity and impact | PSIRT | Severity method | Draft |
| 72h | User mitigation advice | Support lead | Advisory template | Unknown — assign |
| Final | Corrective update and distribution | Engineering manager | Release plan | Draft |
Keep short structured labels. Do not record exploit steps, credentials, customer names or personal data in a preparation template.