Capture the reasoning behind response actions so technical and business teams can stay coordinated.
Record decisions as they happen
An incident can involve several teams acting under pressure. A decision log creates a common record of important choices: what was decided, who authorised it and why. It does not need to reproduce every chat message. Focus on decisions that change containment, investigation, recovery or communication, and link to the supporting records where appropriate.
Use a consistent entry structure
Each entry should identify the time and time zone, the decision owner, the information available and the action agreed. Include the affected service and any important dependency. A small set of consistent fields is easier to use during a busy response than a long form that nobody completes until the incident is over.
Keep uncertainty visible
State which parts of the decision rely on confirmed facts and which rely on working assumptions. Record missing information that could change the choice. If new evidence reverses a decision, add the new reasoning rather than silently replacing the earlier entry. This helps later reviewers understand the sequence without judging an earlier action using facts that were not yet available.
Connect actions to operational consequences
Containment can interrupt a legitimate service, while restoring too early can reintroduce risk. Record the relevant trade-off and the people consulted. Where a temporary exception is agreed, give it an owner and a review trigger. A decision is not complete if nobody knows when the exception should end.
Control access to the record
An incident log may include sensitive business and technical information. Store it in an approved location with suitable access and a usable alternative if normal systems are unavailable. Share audience-appropriate updates instead of forwarding the complete record to everyone. Avoid including credentials or unnecessary personal information in the entries.
Use the log after the response
Review the record to identify slow handoffs, unclear authority and assumptions that proved incorrect. Turn lessons into specific improvements with owners and completion checks. The aim is to strengthen the next response, not simply to produce a timeline. Keep the operational record and formal reporting requirements aligned with the agreed engagement and relevant advice.
Related service: Incident response. Further guidance: CISA #StopRansomware Guide.