# Why should we keep a written log during an incident?

Because memory fails under stress, and everyone will later ask what happened when. A simple log records the time, what was observed, what was decided, by whom and why, and what was done. It lets a second person take over at night without starting again, shows the insurer and the regulator that you acted promptly and deliberately, and is the basis for the timeline in a NIS2 report or a GDPR notification. It also protects decision-makers: a choice that looks wrong afterwards was often reasonable with what was known at the time, and the log shows that. Keep it outside the affected systems, on paper or in a shared document reachable from a clean device, and note all times in one time zone. NetSenX contributes timestamped alerts and an audit log of analyst decisions that you can attach to your own record.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/why-keep-a-written-log-during-an-incident

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we contain an incident without destroying the evidence?](https://netsenx.com/en/faq/how-to-contain-an-incident-without-destroying-evidence)
- [Should we unplug an infected computer or switch it off?](https://netsenx.com/en/faq/should-we-unplug-or-switch-off-an-infected-computer)
- [What should we avoid doing during a cyber incident?](https://netsenx.com/en/faq/what-not-to-do-during-a-cyber-incident)
- [How do we find patient zero, the first machine the attacker compromised?](https://netsenx.com/en/faq/how-to-find-patient-zero)
- [What is a forensic image, and when do we need one?](https://netsenx.com/en/faq/what-is-a-forensic-image)