Incident in progress right now? Call the Security Operations Centre on +1-867-765-2020. Do not wait for this form.

CasCom Security Operations Centre

Report a Cybersecurity IncidentWe respond around the clock

This form opens a ticket with the CasCom Security Operations Centre and creates a formal record of the incident. Give us what you know now. You do not need every answer to submit.

P1 CRITICAL15 minutes

P2 HIGH1 hour

P3 MEDIUM4 hours

P4 LOW1 business day

Cybersecurity incidents only. This form is not for technical support, password resets, hardware or software faults, new user setup, or service outages with no security cause. Use it only for a current or suspected cybersecurity incident. For everything else, contact the CasCom helpdesk at helpdesk@cascom.ca or +1-867-765-2020. If you are not sure which this is, submit it here and we will redirect it.

What happens next. You will receive an emailed copy of this report and a reference number within a few minutes. A CasCom analyst is alerted immediately and will contact you within the response time shown for the severity you select.

Reporter Information

So we know who to contact and how quickly we can reach you

Full name *

Enter your full name.

Job title or role *

Enter your job title or role.

Organization or company *

Enter the organization this incident affects.

Department

Email address *

Your copy of this report goes here. If your mailbox may be compromised, use a different address.

Enter a valid email address.

Phone number *

We call rather than email when an account is compromised.

Enter a phone number we can reach you on.

Date of report

Time of report (24h)

Incident Details

When it happened, how bad it looks, and what kind of incident it is

Date first detected *

Enter the date the incident was first noticed.

Time first detected

Date the incident occurred

Leave blank if this is the same as detection, or if you do not know.

Time it occurred

Estimated severity *

P1 Critical Active breach or ransomware. Systems are being damaged now. 15 min response P2 High Confirmed compromise. An account or system is known to be in the wrong hands. 1 hour response P3 Medium Suspicious activity that has not been confirmed as a compromise. 4 hour response P4 Low Policy matter or informational report. Nothing is at immediate risk. 1 business day

Estimate is fine. A CasCom analyst confirms the final severity, and we would rather you over-report than under-report.

Choose a severity level.

Incident category *

Malware or ransomware Phishing or social engineering Unauthorized access or privilege escalation Data breach or exfiltration Denial of service or DDoS Insider threat Supply chain or third-party compromise Physical security breach Cloud misconfiguration or unauthorized cloud access

Other, please specify

Select at least one category, or describe it under Other.

Affected Systems and Data

What is touched, and whether regulated data is involved

Never enter passwords here. If a credential was exposed, name the account, not the password. Change the password separately, and tell us that you have done so under Actions already taken.

Affected systems, hostnames, or IP addresses

Approximate names are better than nothing.

Affected user accounts

Number of systems affected

Number of users affected

Sensitive or regulated data involved

Personal information (PIPEDA) CUI or protected data Client data No, or unknown

This drives our breach notification obligations, so flag it even if you are unsure.

Data types potentially affected

Incident Description

The part an analyst reads first

Describe what happened *

Plain language is ideal. Write it the way you would explain it to a colleague.

Describe what happened in at least a couple of sentences.

Indicators of compromise

Paste anything technical you have. Leave blank if none of this is familiar.

Actions already taken

Include times where you can. This becomes part of the incident timeline.

Business Impact

What has stopped working, and who else is affected

Systems or services currently unavailable

Yes No Unknown

Services currently down or degraded

Data lost, stolen, or modified

Yes, confirmed Suspected No Unknown

Clients directly affected

Yes No Unknown

Clients notified

Yes No

Hold off on client notification until CasCom has confirmed the facts, unless a contract requires otherwise.

Evidence and Attachments

Screenshots, headers, logs, anything you have

Do not delete anything. Leave suspicious emails, files, and log entries in place. Deleting evidence removes our ability to trace what the attacker did and can compromise an insurance claim.

Drop files here, or click to browse You can also paste a screenshot directly from your clipboard

Evidence notes

If a file is too large to attach, tell us where it is instead.

Declaration

Confirm and send

I confirm that the information in this report is accurate to the best of my knowledge, and I understand that CasCom will act on it. I understand this report forms part of a formal incident record.

Confirm the declaration before sending.

Submitting opens a ticket with the CasCom Security Operations Centre and emails you a copy of this report.

Report received

Your report is with the CasCom Security Operations Centre and a ticket is open. A copy has been emailed to you.

Keep this reference for any follow-up.