What should be included in a post-incident report to demonstrate time-based compliance?

• A. System uptime metrics.
• B. Future action proposals.
• C. Incident cost estimates.
• D. Timestamped actions, responsible parties, and closure times.

Answer: (D)

Time-based compliance hinges on having an auditable, time-stamped record of what was done, by whom, and when it was completed. A post-incident report should present a clear sequence of actions with exact times, the individuals or roles responsible for each action, and when each action was closed. This creates a verifiable timeline showing that response, containment, mitigation, and restoration occurred within the required time windows defined by the standards and internal procedures. For example, it should capture when the incident was detected, when notifications and escalations occurred, the initiation of containment or remediation steps, who performed them, and the exact closure time of each step. Timestamps should be consistent (ideally synchronized to UTC) so the timeline can be reviewed and validated against compliance requirements.

Other elements like system uptime metrics focus on overall availability rather than the incident-response sequence within the required timeframes, future action proposals describe planned work rather than what was executed within the mandated windows, and incident cost estimates are financial details not evidence of timely compliance.