Product-security incident readiness checklist
A tabletop checklist for scenario intake, awareness timestamp, human triage, evidence capture, clocks and handoff.
How to use it
Copy, assign owners, then attach real evidence.
A checklist is useful only if each item has an owner and a verifiable state. Do not mark an item complete because a tool returned a green badge.
- [ ] Product and scenario context defined - [ ] Awareness timestamp captured - [ ] Human triage owner and severity rationale recorded - [ ] Evidence checklist and gaps tracked - [ ] Preparation clocks visible to responsible owners - [ ] Exportable incident-preparation pack retained
Checklist
What complete should mean.
Product and scenario context defined
Awareness timestamp captured
Human triage owner and severity rationale recorded
Evidence checklist and gaps tracked
Preparation clocks visible to responsible owners
Exportable incident-preparation pack retained
Primary / official source basis
Keep the checklist tied to the current source.
Reviewed 2026-08-31. Source owner: European Union / European Commission.
The template is an operating aid, not certification.
Use the checklist to structure evidence, ownership and review. It does not replace the authoritative system, regulator, specialist audit, legal advice or professional judgement that may apply to the underlying job.
- Not a vulnerability scanner, public VDP or ticketing platform
- No automated legal reportability decision or regulatory submission
- No legal advice or CRA compliance certification