Security incident report template

Security Incident Report Template: Free Printable Form for Guards

A free security incident report template for guards: incident details, people and witnesses, a narrative, actions taken, police or EMS, injuries and signatures.

By the PatrolBadges team · Updated · 7 min read

Print it, save it as a PDF from the print dialog, or open it in a spreadsheet.

Excel / Sheets (CSV)

Security Incident Report

Page ____ of ____
Report no.:
Site:
Location:
Incident type:
Incident date:
Incident time:
Report date:
Report time:
Officer:
Badge no.:
Supervisor:
Notified at:
Police/fire/EMS:
Case no.:
Photos taken:
CCTV saved:
NameRolePhone or emailDescription or ID seenStatement taken

What happened: who, what, when, where and how, in time order. Facts only. Continue on the back if needed:

Actions taken, in order, with times:

Injuries and property damage:

Reporting officer signature:
Supervisor reviewed by:
Supervisor signature:
Date reviewed:

Free template from PatrolBadges · patrolbadges.com/templates/security-incident-report

The short answer

A security incident report is the written record of one event a security officer saw or responded to: what happened, when and where, who was involved, who saw it, what the officer did, and whether police, fire or EMS were called. Write it as soon as you can after the incident, in plain facts rather than opinions, and give it to a supervisor to review. This template has fields for the incident details, a table for people involved and witnesses, a ruled narrative section, actions taken, police or fire report number, injuries and damage, photos and signatures.

When to write an incident report

Write an incident report for any event that's out of the ordinary and could matter later: a break-in or attempted entry, a theft, damage, an injury or a fall, a fight or a threat, a trespasser, a fire alarm, a flood, a vehicle accident on the property, a medical call, or anything police, fire or EMS came out for. If you're not sure whether it needs a report, write one. A report you didn't need costs ten minutes. One you needed and didn't write can't be put together properly a week later.

Write it as soon as you can after the incident, while the details are fresh, and before you leave the shift. Note it in your daily activity report with the report number, so the two match. This template is for physical security incidents on a property. A data breach or a cyber incident follows your IT team's process instead.

What to write in each field

FieldWhat to write
Report no.Your company's or site's numbering. If there's none, use the date and a sequence, like 2026-10-20-01.
Site and locationThe property, then the exact spot: "Garage P2, by the stairwell B door", not "garage".
Incident typeOne or two words: trespass, theft, vandalism, injury, fire alarm, water leak, medical.
Incident date and timeWhen it happened. If you don't know, when it was found, and say so in the narrative.
Report date and timeWhen you wrote this report.
Officer and badge no.Who is writing the report.
Supervisor and notified atWho you told, and when.
Police/fire/EMS and case no.Which agency came, if any, and the report or case number they gave you. Put the responding officer's name or unit in the narrative.
Photos taken and CCTV savedHow many photos you took and where they're kept, and whether you asked for camera footage to be saved before it's recorded over.
People involvedEveryone involved: name, role (victim, suspect, witness, staff, resident), how to reach them, and a description if you don't know their name. Mark whether you took a written statement.
What happenedThe narrative. See the next section.
Actions takenWhat you did, in order, with times: who you called, what you secured, first aid given, who you handed over to.
Injuries and property damageWho was hurt and how, as you saw it, and whether they were treated or refused treatment. What was damaged, and how badly.
SignaturesYours, and the supervisor's who reviewed it, with the date.

How to write the narrative

The narrative is the part people read. Write it in the first person and in time order, and answer who, what, when, where and how. Describe what you saw, heard and did. Leave out guesses about why, and don't label anyone as a thief or a drunk: describe what they did and how they acted.

  • Start with how you got involved. "At 01:12, on round 3, I heard glass breaking from the east side of Building A."
  • Describe people by what you saw. Height, build, clothing, direction of travel, and a vehicle's make, color and plate.
  • Quote what was said. Word for word where you can, in quotation marks.
  • Say what you did, and when. Each call, each person you spoke to and each thing you secured, with times.
  • End with how it was left. Who took over, what's still open, and what needs following up.
  • Read it back before you sign. Check names, times and spellings. After that, don't change it: if you learn more, add a dated supplement.

A filled-in example

Here are the main entries from a report about a made-up incident at a self-storage site.

Pine Ridge Self Storage, report IR-2026-031, officer L. Moreno (example)
FieldExample entry
LocationPine Ridge Self Storage, keypad at the main entrance gate
Incident typeVandalism
Incident date and timeOctober 18, 2026, between 02:50 and 03:40 (found at 03:40)
People involvedNone seen. Witness: R. Haddad, tenant of unit 212, saw a dark pickup leave east on Route 9 at about 03:35.
Police/fire/EMS and case no.County sheriff, Deputy L. Ford, arrived 04:30. Case no. 26-11873.
Photos taken and CCTV saved4 photos of the keypad. Asked the site manager to save gate camera footage from 02:45 to 03:45.

Common mistakes

  • Waiting until the end of the shift, or the next day, to write it.
  • Opinions and labels instead of descriptions of what people did.
  • Missing times, or times that don't match the DAR or the patrol log.
  • Leaving out people you couldn't identify. Describe them instead.
  • No police or fire report number, which the client and the insurer will ask for.
  • Forgetting to ask for camera footage to be saved before it's recorded over.
  • Changing the report after it's signed. Add a dated supplement instead.

How long to keep incident reports

Keep incident reports longer than routine logs. A claim or lawsuit over an injury or a loss can come years after the event, so a sensible default is to keep each report, with its photos and statements, until any claim is closed and the time to bring one has passed. Those time limits vary by place and by type of claim. Check your contract, your insurer and local rules, and ask your insurer or a lawyer if you're not sure.

Keep the original signed report, and file any supplements with it. If you scan reports to PDF, name each file by its report number so it matches the DAR.

Reporting from the spot with PatrolBadges

PatrolBadges doesn't write the full report for you, but it captures the first one from where it happened. An officer on patrol can report an incident from any checkpoint by scanning its QR code with their phone's camera, with no app or account: they pick a type, say what happened in a note and add photos. The report is stamped with their name, the time and the location, and it's emailed to you the moment it's sent. Urgent ones say URGENT in the subject. When an officer marks a checkpoint check as Problem, they add a note and it opens an incident too.

Tenants and visitors who scan a code can report a problem as well, with photos. Every incident shows on that day's report, which prints and can be emailed to your client each morning. Use it as the starting point, with its times and photos, and write the full narrative, witnesses and police details on this form. It's how HOA and apartment patrols get problems to the manager the same night.

Frequently asked questions

What should a security incident report include?

The date, time and exact location, the type of incident, everyone involved and any witnesses with their contact details, and a factual narrative of what happened. Then the actions the officer took, whether police, fire or EMS came and their report number, any injuries or damage, photos, and the signatures of the officer and the supervisor who reviewed it.

How soon should a security officer write an incident report?

As soon as the situation is under control, while the details are fresh, and before the end of the shift. Jot down times and names as things happen so the report is accurate. If you learn more later, add a dated supplement rather than changing the original.

How do you write a good incident report as a security guard?

Write in the first person, in time order, and stick to what you saw, heard and did. Describe people by their appearance and actions rather than labels, quote what was said, and give a time for each step. Read it back for names and times before you sign it.

What's the difference between an incident report and a daily activity report?

A daily activity report is a timed log of the whole shift, one line per activity. An incident report covers one event in full detail: the people, the witnesses, the narrative, what was done and who came. The DAR gets a short entry with the incident report's number, so the two can be matched.

Should I write an incident report if nobody was hurt?

Yes, if the event could matter later: damage, a trespasser, a door found forced, a hazard. Near misses are worth reporting too, since they show a problem before someone gets hurt. Follow your post orders on what must be reported.

Is this template for cybersecurity incidents?

No. It's for physical security incidents on a property, like trespass, theft, damage and injuries. For a data breach or a cyber attack, follow your IT or information security team's incident process.

Hear about the incident before the report is written.

Add your checkpoints and scan one from your phone, right off your screen. No card, and sign up only when you're ready to keep it.

Keep reading