THE HSWAGATA BUDDHA TOOTH RELIC PRESERVATION MUSEUM
FOR INTERNAL USE ONLY
Template No.: T236
Template Title: Security Incident Report (Unauthorised Access / Tampering / Vandalism / Threat)
Related Research Case IDs / Cluster: Cluster F – HGT Conflicts & Security (Cases 66–85)
Linked Templates / Policies: T226 (Overview), T227 (Chronology), T229 (Evidence Index), T232 (Risk Sheet), T234 (Key & Access Register), T237 (Emergency Relic Protection), T241 (Threat Report)
Date of form: ____ / ____ / ______
Prepared by / Role: _______________________
Office / Unit: ____________________________
Country / Location: _______________________
Confidentiality Level:
Internal only [ ] Restricted [ ] Sacred-Restricted / Sensitive [ ]
Use of this form (tick):
New case / action [ ] Follow-up [ ] Annual review [ ] Archive only [ ]
A) Incident identification
A1) Incident Report ID: ___________________________
A2) Linked Case ID (if any): _______________________
A3) Date/time incident happened (best estimate): //______ Time: ______
A4) Date/time discovered / reported: //______ Time: ______
A5) Reported by (role/code): _______________________
A6) Location (site/building/room): ___________________________________
B) Incident type (tick all that apply)
Unauthorised access / entry attempt [ ]
Missing key / access card issue [ ]
Forced lock / door damage [ ]
Suspicious person / suspicious behaviour [ ]
Tampering suspected (display/storage/records) [ ]
Vandalism / property damage [ ]
Theft / missing item suspected [ ]
Threat / intimidation at site [ ]
Crowd risk / pushing / unsafe gathering [ ]
Cyber / digital access issue (restricted folder) [ ]
Other: _______________________________________
C) Immediate safety actions (first response)
C1) People safe now? Yes [ ] No [ ] Unsure [ ]
If No/Unsure, what was done now (tick):
Move people to safe area [ ]
Call security support [ ]
Call emergency services / authorities (as required) [ ]
Stop public access to area [ ]
Other: _______________________________________
C2) Relics / sacred objects safe now? Yes [ ] No [ ] Unsure [ ]
If No/Unsure, protection action taken (tick):
Lock down relic area [ ]
Increase supervision/guard [ ]
Start T237 Emergency Relic Protection Plan [ ]
Start relic condition check (authorised staff only) [ ]
Other: _______________________________________
C3) Area isolated to protect evidence? Yes [ ] No [ ]
If Yes, how: tape/guard/closed door/signage/other: ______________________
D) Short incident summary (facts only, 5–10 lines)
Write simple and neutral (no blame):
E) Persons involved (use roles/codes, not full names)
E1) Staff present (roles/codes): ______________________________________
E2) Visitors present (count + codes if used): ___________________________
E3) Suspect person(s) description (non-personal, simple):
Clothing/behaviour/where seen (no guessing): ___________________________
F) What was affected?
F1) Area/asset affected (tick):
Relic storage room [ ] Display case [ ] Shrine area [ ]
Archive/evidence cabinet [ ] Office safe [ ] Door/lock [ ]
CCTV/alarm [ ] Digital folder / device [ ] Other: ___________
F2) Signs noticed (tick):
Door not normal / unlocked [ ]
Lock damaged [ ]
Items moved [ ]
Broken glass / damage [ ]
Missing item suspected [ ]
Strange message/note [ ]
Alarm triggered [ ]
Other: _______________________________________
F3) Relic condition checked by authorised custodian? Yes [ ] No [ ]
If Yes, result (short): _______________________________________________
G) Evidence and documentation
G1) Evidence collected/recorded (tick):
Photo [ ] Video [ ] CCTV note [ ] Screenshot [ ] Witness note [ ] Other: ______
G2) Evidence ID(s) (log in T229): ___________________________________
G3) Linked timeline number (T227): _________
G4) Where stored (cabinet/folder label): _______________________________
H) Notifications and escalation
Tick who was informed and when:
Security lead (role): __________________ Time: ______ Date: //____ [ ]
Relic custodian/head (role): ___________ Time: ______ Date: //____ [ ]
Unit head / Director (role): ___________ Time: ______ Date: //____ [ ]
Board emergency contact (role): ________ Time: ______ Date: //____ [ ]
Authorities / police (if required): _____ Time: ______ Date: //____ [ ]
Legal adviser (if needed): _____________ Time: ______ Date: //____ [ ]
I) Access and key check (link to T234)
I1) Was a key/card used or missing? Yes [ ] No [ ] Unsure [ ]
I2) If Yes/Unsure, actions taken (tick):
Check key register (T234) [ ]
Revoke access for specific role/code [ ]
Change lock / re-key request [ ]
Reset digital access / passwords [ ]
Notes: _______________________________________________________________
J) Cause and contributing factors (best known, no guessing)
J1) Likely cause (tick one):
Accident [ ] Neglect [ ] Conflict pressure [ ] Opportunistic [ ] Unknown [ ] Other: ______
J2) Contributing factors (tick):
Weak lock/door [ ] Poor supervision [ ] Crowded event [ ] Staff shortage [ ]
Poor lighting [ ] Unclear procedures [ ] Rumour caused panic [ ] Other: ______
Short notes (facts we know):
K) Corrective actions (what we will do next)
(One owner per action. Add to T231 Actions Tracker.)
Action: __________________________ Owner (role): ______ Due: //____
Action: __________________________ Owner (role): ______ Due: //____
Action: __________________________ Owner (role): ______ Due: //____
Update needed (tick):
Update T232 Risk Sheet [ ]
Update visitor controls (T235) [ ]
Update key/access controls (T234) [ ]
Staff briefing / training [ ]
Repairs / maintenance request [ ]
Communications control / spokesperson rule [ ]
L) Closure (when finished)
Incident status:
Open [ ] Under review [ ] Closed [ ] Referred to authorities/legal [ ]
Closure date (if closed): //______
Closure summary (3–6 lines):
M) Sign-off
Reported by (Name): _________________________ Role: ___________________
Signature: _________________________________ Date: //______
Reviewed by Security Lead (Name): ____________ Role: ___________________
Signature: _________________________________ Date: //______
Approved by (Supervisor/Head): _______________ Role: ___________________
Signature: _________________________________ Date: //______
