{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Security Incident Report","description":"Internal record of a cybersecurity or information-security incident. Distinct from eu.gdpr.data_breach_notification_authority — the GDPR Art. 33 notification is a downstream output when this incident affects personal data and meets the notification threshold.","type":"object","required":["incident_id","detected_on","detected_by","severity","classification","initial_assessment","post_incident_owner"],"additionalProperties":false,"properties":{"incident_id":{"type":"string"},"detected_on":{"type":"string","format":"date-time"},"detected_by":{"type":"string"},"severity":{"type":"string","enum":["low","medium","high","critical"]},"classification":{"type":"string","enum":["phishing","malware","unauthorised_access","data_leak","ddos","insider_threat","physical","other"]},"affected_systems":{"type":"array","items":{"type":"string"}},"affected_users_estimated":{"type":"integer","minimum":0},"timeline":{"type":"array","items":{"type":"object","required":["timestamp","action"],"additionalProperties":false,"properties":{"timestamp":{"type":"string","format":"date-time"},"action":{"type":"string"}}}},"initial_assessment":{"type":"string"},"containment_actions":{"type":"array","items":{"type":"string"}},"eradication_actions":{"type":"array","items":{"type":"string"}},"recovery_actions":{"type":"array","items":{"type":"string"}},"root_cause":{"type":"string"},"lessons_learned":{"type":"array","items":{"type":"string"}},"gdpr_notifiable":{"type":"boolean"},"art33_reference":{"type":"string","description":"Reference of the GDPR Art. 33 filing if gdpr_notifiable is true."},"post_incident_owner":{"type":"string"},"closed_on":{"type":"string","format":"date"}}}