Security incident report: what to write, and how to make it hold up

01

What a security incident report is, and where the rules touch it

A security incident report is the written account, made by the officer who dealt with it, of one specific event on a post: a trespasser, a theft, a fight, a medical call, a fire alarm, a door found forced, a vehicle damaged in the parking lot. It is separate from the daily activity report, which records the whole shift in time order. The daily activity report says that something happened at 22:40; the incident report explains it, in enough detail that someone who was not there can understand what happened, what the officer did and what is still open.

No federal law sets a format for a private security incident report, and OSHA has no standard for one. The format comes from the security company's procedures and the site's post orders, which should say which events need a report, who is told and how quickly. What the states regulate is the officer, and several of them treat report writing as part of the job:

• California. The Bureau of Security and Investigative Services lists Observation & Documentation, a four-hour mandatory course covering report writing and observation and patrol techniques, among the courses a new guard completes after registration, in its security guard training requirements.
• New York. The Department of State's security guard training requirements include a 16-hour on-the-job course, completed within 90 days of employment, described as "a course relevant to the duties of guards, requirements of the work site, and the needs of the employer." How and when incidents are reported at that work site is part of what it should cover.
• Other states license guards through their own boards and set their own training hours and topics. Check the rules of the state where the post is, not the state where the company is based.

Some incidents also have to be reported to a regulator, not just to the client. In California, Business and Professions Code section 7583.2 makes it a violation for a private patrol operator to fail to deliver to the bureau's director a written report describing the circumstances of the discharge of any firearm, or of a physical altercation with a member of the public, by the licensee or an employee acting in the course of their employment, within seven business days. An officer's incident report is usually where that account starts, which is one more reason to write it well on the night.

02

Which incidents need a report

The post orders should list them, because an officer on nights should not have to decide alone whether something was serious enough to write up. A typical list for a commercial building, campus or warehouse includes:

• Unauthorized entry and trespass: someone found inside after hours, on the roof or in a restricted area, or refusing to leave when asked.
• Theft and damage: property missing, vehicles broken into, vandalism, graffiti, a forced door or window.
• Violence and threats: a fight, an assault, a verbal threat, harassment of staff or visitors. OSHA describes workplace violence as "any act or threat of physical violence, harassment, intimidation, or other threatening behavior that occurs at the work site" on its workplace violence page.
• Use of force and detentions: any time an officer put hands on someone, detained someone or drew a weapon. Most companies want a separate, more detailed use of force report as well.
• Medical calls and injuries: a visitor who fell, an employee taken ill, an officer hurt on duty.
• Fire and life safety: an alarm activation, a sprinkler flow, an elevator entrapment, a smell of gas, a water leak.
• Suspicious activity: behavior, not appearance. The Department of Homeland Security's If You See Something, Say Something guidance on suspicious activity says that factors such as race, ethnicity, sex, national origin, religion or disability are not suspicious, and asks people to report behavior and situations to local law enforcement, calling 911 in an emergency.

When in doubt, write it. A short report on something that came to nothing costs a few minutes; a missing report on something that became a claim or a police investigation costs far more.

03

What a security incident report should contain

Whatever form or reporting app the company uses, a good incident report answers the same questions. It should carry:

1. The date and time of the incident, and separately the time the report was written. Exact times matter more than rounded ones.
2. The exact location: building, floor, door, gate, parking level or space number, not just "the property".
3. The type of incident, from the categories the post orders use.
4. A narrative in time order: what the officer saw, heard and did, step by step, with times against each step.
5. The people involved: names and contact details of witnesses, employees and anyone injured, and a physical description where a name is not known, including clothing and direction of travel.
6. Who was notified and when: the supervisor, dispatch, 911, the police, the fire department, the property manager, the client's contact. Include the responding officer's name and badge number and the police case number when there is one.
7. Evidence: photographs taken, which cameras cover the area and whether footage was requested, items found or retained and who now holds them.
8. Injuries and property damage, described plainly, with first aid given and by whom.
9. The outcome and what is still open: a door awaiting repair, a follow-up with the police, a trespass warning issued.
10. The officer's name, guard card or license number where the state issues one, and signature, and the supervisor's review once it is done.

If an officer is hurt on duty, the employer has separate duties under OSHA's recordkeeping rules. For example, under 29 CFR 1904.39 a work-related fatality must be reported to OSHA within eight hours, and an in-patient hospitalization, amputation or loss of an eye within 24 hours. The security incident report is useful evidence for that, but it is not the OSHA form; the workplace incident report guide covers the employer's side.

04

How to write an incident report that holds up

An incident report is read by people who were not there, sometimes long afterward, and sometimes by someone whose job is to find the gaps in it: an opposing attorney, an insurance adjuster, an internal investigator. The habits that make a written report reliable are well known, and they are what report-writing training teaches:

• Write it at the time, or as close to it as you can. A note made in a notebook or on a phone while the details are fresh is worth more than a polished account written at the end of a double shift.
• Facts, not conclusions. Write "the man was shouting, unsteady on his feet and smelled of alcohol", not "he was drunk". Put what people said in quotation marks, in their words.
• Keep it in time order. A clear chronology with times against each step is easier to follow and harder to pick apart.
• Be specific. "Stairwell door B on P2 not latching" can be acted on; "doors unsecure" cannot.
• Say how you know. If you arrived afterward, say so, and say who told you what happened. Keep what you saw separate from what you were told.
• Leave nothing to be filled in later by someone else. The report is the writing officer's account. A supervisor can add a review note; they should not rewrite it.
• Never alter it after it is filed. Corrections go in as a dated addendum. A changed report invites questions that the original incident did not.

Paper forms are fine if they are legible, complete and kept safely. Many companies now use a reporting app, which helps with legibility, photographs and speed, but the rules are the same either way: a clear, factual report on paper beats a vague one in an app.

05

What happens after the report is filed, including the logs that depend on it

A report nobody reads improves nothing. On a well-run account the security supervisor reads each incident report on the same shift or the next morning, checks it is complete and decides what follows:

• The client is told, in the way and within the time the post orders set, with serious incidents passed on at once by phone rather than waiting for the paperwork.
• Faults go to the people who fix them: a work order to the building engineer for the door, a ticket to the access control vendor for the reader. The report should say who it went to.
• Evidence is preserved. Camera systems overwrite footage on a cycle, so a request to save the clip has to be made quickly, particularly when the police may want it.
• The next shift is told through the pass-down log, so an open issue is not lost at shift change.
• Patterns are looked for: repeated incidents at one gate, one time of night or one part of the parking lot point to a change in patrol routes, lighting or post orders.

Some incident reports also feed a record the law requires someone else to keep:

• California workplace violence prevention. Since July 1, 2024, Labor Code section 6401.9 requires most California employers to record every workplace violence incident in a violent incident log, with details such as the date, time, location, type of violence and a description, but without personal identifying information such as names, and to keep the log for at least five years. At a multiemployer worksite, the employer whose employees experienced the incident records it and gives a copy to the controlling employer. See the guide to California workplace violence prevention.
• Campus security. A college or university with a campus police or security department must keep a daily crime log under 34 CFR 668.46, the Clery Act regulations, recording the nature, date, time and general location of each crime reported and its disposition if known, with an entry made within two business days and the most recent 60 days open to public inspection. Officers' incident reports are often where those entries come from; see the Clery daily crime log guide.

In both cases someone else owns the statutory record, so the report form should ask for what it will need.

06

Where security reporting fails, and where SiteClara fits

The incident report is usually the strongest record on a post, because something happened and someone had to write it down. The weak records are the routine ones around it. A daily activity report that says "all patrols completed, all secure" every two hours for a month tells the client nothing about which doors were tried. A door noted as not latching at 02:10 may never reach the building engineer. And when a client asks, after an incident, whether anyone had checked that stairwell earlier in the night, the answer is an assurance rather than a record.

SiteClara is a way to record the routine part. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint that matters: a stairwell door, a loading dock, a roof access, a parking level. The officer scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks them done, or says what stopped them. The time and the named officer are recorded as it happens, with a photo when one helps. A problem found on the round, such as a door that will not latch or a light out, is reported there and goes onto the team's list of jobs until someone closes it.

The security supervisor sees what was due, done and missed, with the reason where one was given, and a job that needs the building manager can be escalated to them to answer. Each day the supervisor reviews the totals and photos, adds a note and approves a report that goes to nominated management or client contacts at 08:00 the next morning, showing what was reported, what is still open and how the scheduled checks went.

07

Questions people ask

What does "security incident report" mean?

On a guarded post it means the officer's written account of one event, as described above. In cybersecurity the same words mean something different: the NIST glossary entry for security incident, quoting 44 U.S.C. 3552, defines one as "an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies." A report of that kind of threat to data goes to the organization's incident response team under its own plan; this guide is about the physical kind.

Which is an example of a security incident?

On a physical post, a trespasser found after hours, a forced door, a theft from a parked vehicle, a fight or a threat made to staff are all security incidents. Violence covers a wide range: OSHA's workplace violence page says it "ranges from threats and verbal abuse to physical assaults and even homicide", and every point on that range at a site deserves an incident report.

How do you write a security incident report?

Write it as soon as you can after the event, in time order, with exact times and the exact location, the people involved, who was notified, what evidence exists and what is still open, and keep to facts rather than conclusions. Report writing is taught: in California it is part of Observation & Documentation, a four-hour mandatory course that also covers observation and patrol techniques and asking appropriate questions, listed in the Bureau of Security and Investigative Services' security guard training requirements and completed within the first six months of registration or employment.

08

Further reading, and a list to take away

Start with the licensing board in the state where the post is: its training requirements and rules say what officers are taught about report writing and which incidents the company must report to it (in California, the Bureau of Security and Investigative Services and Business and Professions Code section 7583.2). OSHA's recordkeeping rules in 29 CFR Part 1904 cover the employer's duties when someone is hurt. California employers should read Labor Code section 6401.9, and colleges and universities 34 CFR 668.46.

Before the next shift, check that:

• the post orders list which incidents need a report, who is told and how quickly;
• officers know the difference between a daily activity report entry and an incident report;
• the report form asks for exact times, exact locations, who was notified and what evidence exists;
• officers write facts, not conclusions, and correct by addendum, never by rewriting;
• a supervisor reads every incident report and tells the client;
• faults found go to someone who will fix them, and the report says who;
• the form collects what any statutory log will need, such as California's violent incident log or a campus daily crime log;
• reports are stored securely and kept for a set period.