Incident Response, in the context of disaster management, security and infrastructure protection, implies designing and executing automatic and semi-automatic response workflows. Enabling accountability of related actions is necessary to ensure that the relevant stakeholders operate in a risk-controlled environment. Existing logging solutions for incident response workflows allow for some degree of assurance regarding traceability and accountability, by enabling post-incident analysis of the incident context and operators’ actions. In the scope of the IRIS European Union’s Horizon 2020 project, a Data Protection and Accountability (DPA) module was designed to support auditing functions for incident response, ensuring accountability and traceability based on a combination of distributed ledger technologies (DLT), 
blockchain, self-encryption, and secret key sharing technologies. The DPA enables secure, immutable, and resilient distributed logging for incident response workflows, optimized for cooperating networks of CERT/CSIRTs. The DPA solution will be demonstrated and evaluated in two realistic pilots in two European smart cities, featuring scenarios of autonomous transportation vehicles and smart grid infrastructures. To assess the progress beyond the stateof-the-art, societal acceptance and design science research methodologies will be used to elicit and validate the specific operational requirements of incident response stakeholders.