Resources / Incident report template
Free Template
Security incident report template
that holds up months later
This security incident report template is built for the moment a claim, a client or a court asks what happened on a given night. It has eleven sections — who, what, when, where, the people and vehicles involved, the narrative, notifications, evidence, a use-of-force section flagged as policy-dependent, and the sign-off — and each one is explained below. Download it as a printable PDF or an editable Excel file.
Free download — no sign-up
US Letter, three pages, blank. The only filled line is marked EXAMPLE.
The template, section by section
The same eleven sections appear in the PDF and the Excel file, in this order.
1. Report control
Report number, when the report was written, who wrote it (printed name and license or ID number), the supervisor reviewing it and the matching entry in the daily activity report. The report number is what every later document refers back to, so assign it before anything else.
2. When and where
Client, site address, the exact spot on the site, the date, the time it started and the time it ended — or the word ongoing. Add how the officer became aware (saw it, alarm, radio call, told by a tenant) and the lighting and weather, which explain what could and could not be seen.
3. Incident type
A fixed list of boxes rather than a free-text line: trespass, theft or loss, property damage, medical, injury, fire or alarm, disturbance, vehicle, safety hazard, suspicious activity, use of force, other. Fixed types are what let you count a year of reports by category.
4. Severity
Low, medium, high or critical, using definitions your company writes down once. Severity decides who gets called and how fast, so it cannot be a matter of the officer's mood that night.
5. People involved
One line per person: role (subject, victim, witness, employee), full name, contact or ID, a physical description, and whether a statement was taken. A witness with no phone number is a witness nobody will ever reach again.
6. Vehicles involved
Plate and state, make, model and color, where it was seen and what part it played. A plate is the single most useful fact in most property incidents and the one most often missing.
7. Narrative
The heart of the report — see the writing guidance below. Chronological, first person, a time on every step, facts rather than conclusions.
8. Actions taken and notifications
Who was notified — police, EMS, fire, the client, the supervisor — with the name or badge number, the time, the method, and any reference or case number they gave. This table is how you prove the escalation happened when it should have.
9. Evidence
Every photo, video, CCTV export or physical item, numbered, described, with who captured it, when, and where it is stored now. Evidence with no record of who holds it is evidence a lawyer will pick apart.
10. Use of force (policy-dependent)
Completed only when force was used, and only in the terms your own use-of-force policy, state law, licensing rules and client contract require: type of force or tool, reason, injuries to officer and subject, medical aid, law enforcement response and supervisor notification. The template flags this section on purpose — your policy governs it, not the form.
11. Sign-off
The officer's signature, date and time; the supervisor's name, decision (accepted or returned for correction) and signature; and when a copy went to the client and to whom.
About section 10. Use-of-force documentation is set by your company policy, state law, licensing rules and the client contract, and they differ. The template lists the facts most policies ask for; it does not replace your policy. Our guide to documenting a use-of-force incident goes further.
Writing the narrative
Start with a time and a place
At 02:14 I was at the north dock, roll-up door 4. Every paragraph that follows should begin the same way, with the time it happened.
Write what you saw, heard and did
A male, about six feet, grey hooded sweatshirt, pulled at the shutter handle — not a suspicious person was trying to break in. The first survives cross-examination; the second is a conclusion the reader can make for themselves.
Quote exact words
If someone said something that matters, put it in quotation marks, as close to word-for-word as you can. Paraphrase is where a statement changes meaning.
Name everyone present
Who else was there, including other officers, employees and people who left before you could speak to them. A narrative that mentions a witness who is not in section 5 has a hole in it.
End with the state you left it in
Door secured, area checked, subject left westbound on foot, police unit on scene, handed over to the supervisor. The reader needs to know where the incident stood when you stopped writing.
Questions about incident reports
What should a security incident report include?+
At minimum: who wrote it and when, exactly where and when the incident happened, what type it was, the people and vehicles involved, a chronological narrative, who was notified and when, the evidence collected and where it is held, and a supervisor review. This security incident report template sets those out as eleven numbered sections, with use of force as a separate section completed only when your policy requires it.
Is this template free, and do I need to give an email address?+
It is free and there is no form. The PDF and the Excel file download directly from this page, and you can put your own company name and logo on them.
How soon should an incident report be written?+
As soon as the situation is safe and before the officer leaves the site. Detail fades within hours, and a report written the next day reads like it. Your post orders or client contract may set a deadline — if they do, that deadline governs.
Does the use-of-force section cover what my state requires?+
Not on its own, and it is not meant to. Use-of-force reporting is governed by your company policy, state law, licensing rules and often the client contract, and those differ. The section lists the facts most policies ask for so that you can compare it against yours and adjust it.
How is an incident report different from a daily activity report?+
The daily activity report is the continuous log of the whole shift. An incident report covers one significant event in depth: narrative, witnesses, evidence and notifications. A serious event appears in both — one line in the DAR pointing to the incident report by number.
Can a report be changed after it is signed?+
Corrections happen, but they should never overwrite what was first written. On paper, strike through with a single line, initial and date it. A supervisor who returns a report for correction should note what was changed and why.
The same report, done digitally
Used by 600+ security companies worldwide, CGuardPro turns an incident into a case. The system stamps its own time and the device location, photos and video attach with their capture time and author, severity routes the case to the on-call supervisor, and the original narrative is kept alongside every revision. An incident written with no signal is stored on the phone and uploads when it reconnects, keeping the time it was captured.