Coding sheet: retrospective application of an organizational-legal decision-support framework to five critical-infrastructure incidents

Companion data for the manuscript "Governing Critical-Infrastructure Incident Response under AI-Enabled Threats: An Organizational-Legal Decision-Support Framework for Operators and CSIRTs" (submitted to Telematics and Informatics Reports, 2026). The dataset holds the coding sheet for the retrospective application of the framework to five documented critical-infrastructure incidents (Kyivstar, December 2023; KA-SAT, February 2022; Industroyer2, April 2022; Colonial Pipeline, May 2021; Danish energy sector, May 2023) and the list of every public source used for the coding, with the URL opened and the date of access (29 September 2026). Each incident is coded with one protocol: the law in force on the date of the incident, the moment of awareness and the significance decision, the notification as it happened, the response measure chosen, whether a contemporaneous proportionality record exists, attribution, the transition on which the case turned, and what the framework is silent on. The value "not recorded" means the public record does not contain the item; nothing was inferred to fill a cell. README.md describes the columns and the method.