Free Security Incident Report Template

A security incident report is a written record of an event that threatened people, property, or a restricted area. Think of a break-in, a theft, a trespasser, or a badge used by the wrong person.

Most organizations keep these records for two reasons. First, they capture a factual account while memories are still sharp. Second, they give security leads, insurers, and investigators something concrete to work from months later.

A security incident report also differs from a police report. Yours is an internal record you control and share as you choose. A police report belongs to the responding agency, and it reaches you only on request.

The report is documentation, not an accusation. So keep the language neutral, and stick to what you observed or were told.

Use one any time an event puts people or property at risk, even when nothing goes missing. Patterns only surface when someone logs the small events too.

Severity matters less than consistency. A minor event you record today can explain a major one next quarter, so use the same form for both.

Common triggers include:

• Theft or missing property — stock, equipment, cash, or personal belongings.
• Unauthorized access — a stranger in a restricted area, a propped fire door, or a borrowed access badge.
• Break-ins and forced entry — damaged locks, broken windows, or tampered gates.
• Vandalism — graffiti, damaged vehicles, or destroyed equipment.
• Suspicious behavior — loitering near an entrance, someone photographing access points, or repeated failed entry attempts.
• Threats and confrontations — verbal threats, an aggressive visitor, or an escorted removal.
• Lost credentials — a missing key, fob, or uniform that could let someone walk in.

Tip: File the report even when the incident resolves on its own. One propped door means little. However, the same door propped every Friday is a pattern worth fixing.

A complete report answers four questions: what happened, where, who was there, and what you did next. Work through them in that order and the form fills itself in.

The Basics

• Date and time the incident happened, plus the time it was discovered.
• Exact location — building, floor, entrance, or camera zone.
• Name, role, and contact details of the person filing.

What Happened

• A plain, factual summary written in the order events occurred.
• The type of incident: theft, access breach, vandalism, threat, or other.
• Property affected, with serial numbers or asset tags where you have them.
• Whether anyone was hurt, and what care was given.

Who Was Involved

• Names and roles of anyone directly involved or affected.
• Witnesses, what each one saw, and how to reach them.
• A description of any unknown person: build, clothing, direction of travel, or vehicle.

Response and Evidence

• Immediate actions, such as doors secured, area cleared, or a supervisor notified.
• Whether law enforcement was contacted, plus any reference number given.
• Supporting evidence — camera footage, access logs, alarm records, or photos.
• Follow-up steps, with an owner and a target date for each.

Record what you don’t know as unknown. A gap is information, while a guess becomes a problem later.

Write it the same day whenever you safely can. Details fade quickly, and door logs are easiest to pull while the timestamps are recent.

1. Secure the Scene First

Handle safety before paperwork. Once people are safe and you have secured the area, start the record.

2. Pull the Evidence Early

Camera footage and access logs often overwrite themselves on a fixed schedule. So export the relevant window before you write anything else, then note where you stored it.

Record the camera or door number alongside the timestamp. Whoever reviews the file next may not know your site layout.

3. Separate Fact From Interpretation

Write what you saw, heard, or were told. Then keep any conclusions in their own section, clearly marked as assessment rather than observation.

4. Describe People Neutrally

Stick to observable details like clothing, height, and direction of travel. Avoid assumptions about someone’s intent, background, or identity.

5. Close the Loop

Finish with what changes next: a rekeyed door, a revoked badge, or a new patrol route. In addition, name who owns each action and when it is due.

A security incident report is only useful if someone acts on it. Therefore, send it to whoever makes security decisions rather than filing it away.

Security reports often hold sensitive material, including camera stills, medical details, and named individuals. So handle the file carefully from the first draft onward.

Reporting duties vary by industry, by your insurer, and by where you operate. Therefore, confirm the specifics with your security lead, your insurance carrier, or your state’s official website. Do not assume a report is optional.

A few practices hold up well anywhere:

• Limit access to people who genuinely need the file.
• Store reports and footage in a secure, access-controlled location.
• Keep the tone factual, since the report may be read during an investigation.
• Preserve original evidence instead of editing or cropping it.

Retention is worth settling in advance too. Decide how long you keep reports and footage. Then apply that rule to every incident rather than judging case by case.

For an injury, a criminal matter, or a possible claim against your organization, talk to a local attorney early. Meanwhile, keep the record factual and complete, because every later decision rests on it.

Start your security incident report now and have a clear, shareable file in minutes.