Digital Risk Incident Templates & Response Logs

Fillable tools to help districts document, preserve, escalate, and review digital risk incidents with a clear response record.

These digital risk incident templates are designed for use when an alert requires documentation, internal routing, access review, evidence preservation, external escalation tracking, or post-incident review. Each resource is available as a printable PDF and an editable Word document.

PDF: Best for printing, review, and standardized internal use.
Word: Best for editable, fillable working copies during an active response.

Digital Risk Incident Intake Form

Used when an alert first comes in.

Captures:

  • Date/time alert received
  • Person who received alert
  • Employee/user involved
  • Device/account involved
  • Alert category
  • Initial internal notifications
  • Immediate preservation steps
  • Assigned response lead

Response Timeline Log

A chronological record of what happened and when.

Captures:

  • Alert received
  • HR notified
  • Legal counsel notified
  • IT preservation started
  • Device secured
  • Employee access restricted
  • JPA/insurer notified
  • Law enforcement /CPS/NCMEC/CTC considered or contacted
  • Board/parent/media communication decisions

Chain-of-Custody Log

Used when a device, account export, alert record, or evidence item is handled.

Captures:

  • Item/device description
  • Serial number/asset tag
  • Date/time transferred
  • Released by
  • Received by
  • Purpose of transfer
  • Storage location
  • Notes/signature

Employee Access Restriction Checklist

Used by HR/IT/admin when access needs to be limited.

Captures whether access was reviewed or disabled for:

  • Laptop/device
  • Email
  • Cloud storage
  • SIS/LMS
  • VPN
  • Building badge
  • District phone/messaging tools
  • Shared drives
  • Admin systems

Notification & Escalation Tracker

Used to track who was notified and when.

Captures:

  • HR
  • Legal counsel
  • Superintendent/designee
  • IT
  • Site administrator
  • JPA/risk pool
  • Insurer
  • Law enforcement
  • CPS
  • NCMEC
  • CTC
  • Board
  • Parent/guardian communications

Post-Incident Review Worksheet

Used after the immediate response stabilizes.

Captures:

  • What went well
  • What was delayed
  • What policies were unclear
  • Whether evidence was preserved properly
  • Whether access was contained quickly
  • Whether communication was controlled
  • Training gaps
  • Recommended policy/procedure updates