What is an incident timeline and why is it important in investigations?

• A. A chronological record of events from detection to resolution; used to identify root causes and verify corrective actions.
• B. A single event log only noting the final outcome.
• C. A timeline that starts after corrective actions have been implemented.
• D. An optional sequence that managers can skip during investigations.

Answer: (A)

An incident timeline is a chronological record of events from detection through to resolution, capturing what happened, when, who acted, what actions were taken, and what systems or locations were involved. This keeps a clear, step-by-step view of the incident, making it possible to see exactly how it unfolded and where things went wrong. Because of that, investigators can identify root causes and contributing factors, verify that corrective actions were implemented, and confirm they were effective. It also creates an auditable trail for stakeholders and supports clear communication of findings.

The other descriptions miss important parts: a simple log of the final outcome ignores all earlier events and containment steps; a timeline that starts after actions have been taken leaves out the analysis of what caused the issue in the first place; and treating the timeline as optional ignores its essential role in producing a solid, defendable investigation.