Why should we keep a written log during an incident?

Because memory fails under stress, and everyone will later ask what happened when. A simple log records the time, what was observed, what was decided, by whom and why, and what was done. It lets a second person take over at night without starting again, shows the insurer and the regulator that you acted promptly and deliberately, and is the basis for the timeline in a NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. report or a GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). notification. It also protects decision-makers: a choice that looks wrong afterwards was often reasonable with what was known at the time, and the log shows that. Keep it outside the affected systems, on paper or in a shared document reachable from a clean device, and note all times in one time zone. NetSenX contributes timestamped alerts and an audit log of analyst decisions that you can attach to your own record.

← All 60 questions on Incident responseAll topics