Report what is known. Mark what is still being checked.

PROVIDER SECURITY INCIDENT NOTIFICATION FORM

NOTICE DETAILS
Notice type: [Initial notice, update, or closure proposal]
Provider incident reference:
Provider and service affected:
Submitted date, time, and timezone:
Previous update reference, if any:
Approved notice route or ticket:

DISCOVERY AND TIMELINE
Discovery date, time, and timezone:
Detected by:
How it was detected:
Earliest known activity time: [Confirmed, estimated, or unknown]
Provider incident owner notified at:
Client first notified at:

WHAT IS KNOWN NOW
Short factual summary:
Confirmed facts and source:
Reported or suspected details not yet confirmed:
Important unknowns still being checked:

SYSTEMS, SERVICE, AND DATA
Provider systems, accounts, devices, or locations involved:
Client systems or integrations involved:
Service status: [Operating, limited, paused, or unavailable]
Data categories potentially involved:
Approximate scope and basis, if known:
Subcontractor or subprocessor involved, if any:
Items checked and outside the current known scope:

CURRENT ACCESS AND CONTAINMENT
Can suspicious access or activity still continue? [Yes, no, or unknown]
Status last checked at, including timezone:
Actions completed, with owner, time, scope, and observed result:
Actions in progress and next check:
Action held pending approval:

EVIDENCE AND RECORDS
Evidence preserved and source system:
Relevant date range:
Preserved by and time:
Approved secure location or evidence reference:
Evidence owner and known gaps:

OWNERS AND DECISION
Provider incident lead, route, timezone, and backup:
Client incident or system owner, route, timezone, and backup:
Exact client decision or approval requested:
Decision owner and needed-by time:
Action held while waiting:
Where the decision will be recorded:

NEXT UPDATE
Next update date, time, and timezone:
Update route, recipients, and provider owner:
What will be checked before then:
Events that will trigger an earlier update:

CLOSURE RECORD
Closure conditions checked and evidence references:
Remaining unknowns or accepted residual risk:
Open corrective actions, owners, and due dates:
Provider closure approver:
Client closure approver:
Post-incident review date:
Final secure record location:

Do not include passwords, keys, recovery codes, live customer records, raw logs, exploit details, or other sensitive evidence. Exchange sensitive material only through an approved secure channel.

This form supports coordination. It is not an incident-response plan, legal opinion, breach determination, or compliance assessment. Follow the applicable contract, incident plan, company policy, and law.

The full form stays visible and selectable. Nothing is uploaded or saved.