Incident response workspace

This is a single-analyst worksheet, not a case-management system: nothing is sent anywhere, there is no collaboration, and evidence sources are hashed in this tab and then dropped. A hash alone is not chain of custody; the custody log under each item is the part that matters, so record who took the item, when, and why. Deadline clocks are computed from the times you enter. The SEC business-day count skips weekends but not federal holidays, and DORA's initial notification uses classification plus four hours capped at awareness plus 24. The JSON export round-trips through Import JSON, reports defang every indicator, and raw values stay only in the JSON you keep.