���Ҵ�ý

1. Incident Details: Basic information including incident ID, date/time of discovery, reporter details, and initial categorization of the incident

2. Incident Description: Detailed narrative of the incident, including how it was discovered, initial symptoms, and affected systems/areas

3. Initial Response Actions: Immediate steps taken to contain or mitigate the incident, including timestamp of actions and responsible personnel

4. Impact Assessment: Evaluation of the incident's impact on systems, data, operations, and stakeholders, including any breach of personal data

5. Notification Requirements: Documentation of required notifications to regulators, law enforcement, affected individuals under PDPO and other applicable laws

6. Response Team Details: List of team members involved in incident response, their roles, and contact information

7. Resolution Actions: Details of actions taken to resolve the incident, including remediation steps and verification of effectiveness

8. Incident Closure: Final status, closure criteria met, sign-off from relevant authorities, and lessons learned

1. Appendix A - Technical Investigation Report: Detailed technical analysis of the incident, including logs, system impacts, and technical remediation details

2. Appendix B - Evidence Collection Log: Documentation of all evidence collected during the investigation, including timestamps and chain of custody

3. Appendix C - Communication Log: Record of all internal and external communications related to the incident

4. Appendix D - Affected Assets Inventory: Detailed list of all systems, data, and assets affected by the incident

5. Schedule 1 - Response Team Contact List: Complete contact information for all incident response team members and stakeholders

6. Schedule 2 - Regulatory Notification Templates: Standard templates for required notifications to various regulatory bodies in Hong Kong