# Event website incident report — editable template

Use one copy per incident. Record facts while the response is active, then complete analysis after service stabilizes. This is an operations document, not an emergency procedure, legal notification or security forensic report. Store evidence links in an access-controlled system; do not paste attendee personal data, secrets or payment details here.

## 1. Incident identity and impact

| Field | Record |
|---|---|
| Incident ID and event edition | |
| Coordinator, recorder and review owner | |
| Reporter / alert source | |
| First known failure, detection, escalation and recovery times, with time zone | |
| Affected regions, languages, devices and URLs | |
| Event phase: presale / on-sale / event day / post-event | |
| Status: investigating / mitigated / recovered / follow-up open | |

| Attendee task | Observed impact | Evidence link | Earliest and latest confirmed times |
|---|---|---|---|
| Event facts and access information | | | |
| Registration form or RSVP | | | |
| Official ticket or external checkout handoff | | | |
| Confirmation and support messages | | | |

If duration or scope is uncertain, record the bounds you can prove and mark the rest unknown. Do not equate page views with lost purchases.

## 2. Factual timeline

| Time and zone | Source or observer | What was observed | Action / decision | Owner | Evidence reference |
|---|---|---|---|---|---|
| | | | | | |

Separate a change from the first known symptom. Record provider case IDs and approved status messages. Preserve original logs/screenshots under the organization's access and retention rules; keep this report to references and conclusions.

## 3. Recovery and verification

| Item | Record |
|---|---|
| Mitigation and approval | |
| Known-good version or rollback reference | |
| Remaining degraded paths and workaround | |
| Public event facts checked | |
| Registration or RSVP test result | |
| Ticket link / checkout handoff test result | |
| Confirmation and support route test result | |
| Verifier, time, client/region and evidence | |

## 4. Review and action plan

**Confirmed contributing factors:**

**Hypotheses still open and evidence needed:**

**What detected the incident, and what did not:**

**Which response or communication step helped or failed:**

| Corrective action | Owner | Due point | Evidence of completion | Retest or follow-up result |
|---|---|---|---|---|
| | | | | |

**Review date and approver:**

**Related provider, security, privacy or financial case IDs:**

Do not call an action complete because it was assigned. Check that the change was made and that the affected attendee task was retested. Share a suitable summary with stakeholders while keeping restricted evidence in the proper system.