What information should be included in a security incident report?

• A. Time, location, people involved, actions taken, witnesses, and outcomes
• B. Time and location only
• C. General description without specifics
• D. Passenger names only

Answer: (A)

When documenting a security incident, you want a complete, factual record that lets others understand what happened and how it was handled. Including time, location, people involved, actions taken, witnesses, and outcomes does exactly that. Time and location anchor the event in space and chronology so investigators know when and where it occurred. People involved identifies those who played a role, including crew or passengers, which helps assign responsibility and understand the dynamics. Actions taken shows how the situation was addressed in real time—alerts made, security steps taken, evacuations, or medical aid—so there’s a clear trail of the response. Witnesses provide corroboration and additional perspectives, which strengthens the accuracy of the report. Outcomes document the result of the incident—whether the situation was resolved, any injuries or damages, and follow-up steps needed—so the record supports any future actions, investigations, or regulatory requirements.

Other options miss key pieces: time and location alone don’t capture who was involved or what happened to resolve the incident; a general description lacks the specifics needed for a clear understanding and follow-up; listing passenger names only omits the response and outcomes, which are essential for a complete record.