Which information must be left out of a final incident report?

Server hardware configurations are operationally sensitive details that are not relevant to documenting the security incident itself, and including them in a final report could expose the organization to further risk if the report is shared with stakeholders, executives, or third parties. Incident reports are intended to document what happened, the impact, detection methods, and remediation steps.

The exploit or vulnerability used must be included so that the organization and stakeholders can understand the attack vector and take corrective action to prevent recurrence.

Impact and financial loss must be included to inform management, justify remediation costs, and satisfy regulatory or insurance reporting requirements.

How the incident was detected must be included to evaluate detection capabilities and improve future response times.