Cyber Defense · lesson 6 of 12 · 12 min

Incident documentation

summary: Clear incident notes record what was observed, when it happened, who was notified, and what actions were approved. Documentation supports teamwork, recovery, and lessons learned.

question: What should incident notes include?

options:

• Facts, timestamps, and approved actions
• Rumors and guesses only
• Passwords
• Unrelated personal details

correct: Facts, timestamps, and approved actions

explanation: Accurate notes help a team understand and respond to an event.

---

Previous lesson: Asymmetric encryption and PKI
Back to Cyber Defense
Next lesson: Why logs matter