What belongs in a useful security incident report?

Start with a clear record of time and place

Record the report identifier, author, event location, observed event time and time the report was prepared. Make uncertain or approximate times explicit. If a later correction is needed, preserve the original entry and add a dated clarification through the approved reporting process. A clean chronology matters more than dramatic wording. Use the property’s approved private reporting channel for detailed locations and personal information.

Separate what was seen from what was reported

Write direct observations as observations and attribute statements to their source. An illustrative entry might say: “At approximately 8:15 p.m., a visitor reported that a vehicle window was damaged. The officer observed broken glass beside the parked vehicle.” This is a fictional writing example, not a GTS case study. It does not establish when the damage occurred, who caused it or whether a crime took place. Avoid filling those gaps with speculation.

Record actions and notifications

State what action was taken, when, by whom and to whom information was passed. Use the approved emergency procedure when immediate assistance is needed; report writing must not delay that process. Record whether a notification was acknowledged and whether an issue remains open. OSHA’s emergency planning resources discuss emergency reporting in a broader workplace context; they do not prescribe or endorse this incident-report template. Source: OSHA emergency action plan resources.

Handle attachments and personal information carefully

Reference authorized photographs, messages or other supporting material using the organization’s approved storage and access process. Describe what an attachment shows without assuming it proves an unobserved event. Include only the personal information necessary for the report’s purpose, and follow the applicable retention and disclosure policies. Do not publish resident details, access credentials, employee records or sensitive site vulnerabilities as examples of good reporting.

Close the loop without rewriting history

Assign an owner for each follow-up, such as a maintenance referral, review of an access issue or a clarification requested by management. Record later updates separately so readers can distinguish the original account from new information. At the service review, discuss recurring operational issues and whether instructions need revision. Report counts alone are not a reliable measure of crime reduction or officer performance: changes may reflect reporting habits, property activity or scope changes.

Sources and scope

OSHA: Emergency action plan resources. Official resources accessed September 29, 2026. Agency links are references, not endorsements of GTS. The checklist is original planning material, not an official form.

This AI-assisted guide provides general planning information. It is not a site assessment, legal determination or evidence of a completed GTS assignment. Site-specific procedures require approval by the responsible organization. Read our editorial policy and corrections process.