{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Internal security incident report - Rapport interne d'incident de sécurité / Intern beveiligingsincidentrapport (BE)","description":"The internal record of a security incident of an SME (phishing, ransomware, lost laptop, unauthorised access): detection, classification, severity, systems and users affected, timeline, assessment, containment, eradication and recovery, root cause, lessons, the personal-data answer, the NIS2 status and, for a NIS2 entity, the notifications. No law makes this report mandatory. It is input for the breach register of the GDPR (art. 33 (5)) and, for a NIS2 entity, for the notifications to the CSIRT. The template never says that a breach is or is not notifiable, never states a NIS2 scope, computes no deadline and prints a visible blank for what is missing.","type":"object","additionalProperties":false,"required":["entity","incident","assessment","personal_data","nis2","owner"],"properties":{"entity":{"type":"object","additionalProperties":false,"required":["name"],"description":"The enterprise.","properties":{"name":{"type":"string","description":"Name of the enterprise."},"enterprise_number":{"type":"string","description":"Belgian enterprise number (KBO/BCE), written 0123.456.789.","pattern":"^[01][0-9]{3}\\.[0-9]{3}\\.[0-9]{3}$"}}},"incident":{"type":"object","additionalProperties":false,"required":["id","detected_date","detected_by","severity","classification","near_miss"],"description":"The incident.","properties":{"id":{"type":"string","description":"Reference of the incident in the enterprise's own numbering."},"detected_date":{"type":"string","format":"date","description":"Date the incident was detected."},"detected_time":{"type":"string","description":"Time of detection. Optional, as written by the user (for example 09:40)."},"detected_by":{"type":"string","description":"Who detected the incident."},"severity":{"type":"string","enum":["low","medium","high","critical"],"description":"Severity as the enterprise assesses it: low, medium, high or critical."},"classification":{"type":"string","enum":["phishing","malware","ransomware","unauthorised_access","data_leak","ddos","insider_threat","physical","lost_or_stolen_device","other"],"description":"Kind of incident: phishing, malware, ransomware, unauthorised_access, data_leak, ddos, insider_threat, physical, lost_or_stolen_device or other."},"near_miss":{"type":"boolean","description":"Whether the event was a near miss: an event that could have compromised availability, authenticity, integrity or confidentiality, but did not (NIS2 law art. 8, 6°)."}}},"affected":{"type":"object","additionalProperties":false,"description":"What was affected.","properties":{"systems":{"type":"array","description":"Systems affected.","items":{"type":"string","description":"An affected system."}},"users_estimated":{"type":"integer","description":"Estimated number of users affected.","minimum":0}}},"timeline":{"type":"array","description":"Chronology of the incident.","items":{"type":"object","additionalProperties":false,"required":["timestamp","action"],"properties":{"timestamp":{"type":"string","description":"When, as the user writes it (date and time in free text)."},"action":{"type":"string","description":"What happened or was done."}}}},"assessment":{"type":"object","additionalProperties":false,"required":["initial"],"description":"Assessment.","properties":{"initial":{"type":"string","description":"Initial assessment of the incident."}}},"actions":{"type":"object","additionalProperties":false,"description":"Actions taken.","properties":{"containment":{"type":"array","description":"Containment actions.","items":{"type":"string","description":"A containment action."}},"eradication":{"type":"array","description":"Eradication actions.","items":{"type":"string","description":"An eradication action."}},"recovery":{"type":"array","description":"Recovery actions.","items":{"type":"string","description":"A recovery action."}}}},"root_cause":{"type":"string","description":"Root cause, in the enterprise's words."},"lessons":{"type":"array","description":"Lessons learned.","items":{"type":"string","description":"A lesson learned."}},"personal_data":{"type":"object","additionalProperties":false,"required":["breach"],"description":"Personal data.","properties":{"breach":{"type":"string","enum":["not_assessed","no","yes"],"description":"Whether the incident is a personal data breach: not_assessed, no or yes. A statement of the user, never of the template."},"register_reference":{"type":"string","description":"Reference of the entry in the breach register, if there is one."},"apd_notified":{"type":"string","enum":["not_applicable","no","yes"],"description":"Whether the Data Protection Authority was notified: not_applicable, no or yes."},"apd_notified_date":{"type":"string","format":"date","description":"Date the Data Protection Authority was notified."},"apd_notified_time":{"type":"string","description":"Time of that notification. Optional, as written by the user (for example 09:40)."}}},"nis2":{"type":"object","additionalProperties":false,"required":["status"],"description":"NIS2.","properties":{"status":{"type":"string","enum":["not_in_scope","in_scope_important","in_scope_essential","unknown"],"description":"The user's answer on the NIS2 status of the enterprise: not_in_scope, in_scope_important, in_scope_essential or unknown. A statement of the user, never of the template."},"significant":{"type":"boolean","description":"Whether the incident is a significant incident within the meaning of the NIS2 law (art. 8, 57°)."},"early_warning_date":{"type":"string","format":"date","description":"Date of the early warning to the CSIRT."},"early_warning_time":{"type":"string","description":"Time of the early warning. Optional, as written by the user (for example 09:40)."},"notification_date":{"type":"string","format":"date","description":"Date of the incident notification to the CSIRT."},"notification_time":{"type":"string","description":"Time of the incident notification. Optional, as written by the user (for example 09:40)."},"final_report_date":{"type":"string","format":"date","description":"Date of the final report to the CSIRT."},"final_report_time":{"type":"string","description":"Time of the final report. Optional, as written by the user (for example 09:40)."},"progress_report_on":{"type":"string","format":"date","description":"Date of the progress report, for an incident still ongoing when the final report is due."},"recipients_informed":{"type":"boolean","description":"Whether the recipients of the entity's services were informed of the significant incident."},"recipients_informed_on":{"type":"string","format":"date","description":"Date the recipients of the services were informed."},"cross_border_impact":{"type":"string","enum":["yes","no","unknown"],"description":"Whether the incident has a cross-border impact: yes, no or unknown."}}},"evidence":{"type":"object","additionalProperties":false,"description":"Evidence.","properties":{"kept_where":{"type":"string","description":"Where the evidence is kept."}}},"insurer_informed":{"type":"boolean","description":"Whether the insurer was informed."},"police_complaint":{"type":"boolean","description":"Whether a complaint was filed with the police."},"owner":{"type":"object","additionalProperties":false,"required":["name","role"],"description":"Owner of the follow-up.","properties":{"name":{"type":"string","description":"Name of the person who owns the follow-up of the incident."},"role":{"type":"string","description":"Function of that person."}}},"closed_on":{"type":"string","format":"date","description":"Date the incident was closed."},"approvals":{"type":"array","description":"Approvals of the report.","items":{"type":"object","additionalProperties":false,"required":["name","title","date"],"properties":{"name":{"type":"string","description":"Name of the approver."},"title":{"type":"string","description":"Function of the approver."},"date":{"type":"string","format":"date","description":"Date of the approval."}}}}}}