Incident management
Incidents tracked from first report to lessons learned
When something goes wrong, the report, the severity call, the owner and every step to closure go into one incident record, kept in the same workspace as your controls and risks.
In short
An ISO 27001 auditor will often pick one incident and follow it end to end. In Certifyi each incident has an owner and a timeline from first report through triage and response to closure, and the record sits beside your controls and risk register. Whether you must notify a regulator, and which one, stays a decision for your team and your advisers.
Incident reporting
People report incidents sooner when reporting is quick. Each report records the incident type, a first estimate of severity, a description and any supporting files, and goes to the people responsible for incident response.
Incident triage
Each new incident is classified by severity, impact and urgency, and assigned to an owner.
- Severity
- Critical, high, medium or low, based on business impact, the sensitivity of the data involved and the number of people affected.
- Impact
- Which systems, data and people are affected.
- Owner
- The person responsible for driving the incident to closure.
Post-incident review
Once the incident is closed, review what happened, why it happened, what worked and what has to change. Give each improvement action an owner and a due date, and follow it up the way you would an audit finding.
- Timeline. When the incident started, when it was detected, and each decision taken.
- Causes. The immediate cause and the underlying one, plus anything that made it worse.
- Actions. Each improvement with an owner, a due date and evidence once it is done.
What an ISO 27001 auditor checks
ISO 27001 Annex A 5.24 to 5.28 cover planning for incidents, assessing events, responding, learning from incidents and collecting evidence. Expect the auditor to pick an incident from the past year and follow it from first report to lessons learned, so every step needs a date and a name against it.
Incident dashboard
The incident dashboard shows active incidents and their status. Open any incident to see its timeline.
Decide these before your next incident
Each is far easier to settle in a quiet week than during a breach.
-
Severity definitions
What critical, high, medium and low mean for your business, with an example of each.
-
Who decides on notification
The people who decide whether a regulator or customer must be told, and their deputies.
-
Where evidence goes
Where logs and screenshots collected during the response are kept, and who can change them.
-
A tested contact list
Out-of-hours numbers for the response team, legal counsel and key suppliers.
Related modules
Incidents relate to the risks they realise, the controls that failed and the continuity plans they may set in motion.
How Certifyi helps
How Certifyi handles incidents
One workflow from first report to lessons learned.
-
Reporting
Incidents are logged by the team and routed to the people who respond.
-
Triage by severity
Classify each incident, assess its impact and assign an owner.
-
Tracked to closure
Every incident has a status, an owner and a timeline until it is closed.
-
Lessons learned
A post-incident review with root cause analysis and improvement actions.
Questions
Incident management questions
Does Certifyi decide which regulators we must notify?
No. Whether a notification duty applies, and to whom, is a legal judgement for your team and advisers. Certifyi holds the incident record that decision is based on.
What should a post-incident review cover?
A timeline, the immediate and underlying causes, what worked, what did not, and a short list of actions with owners and due dates. Keep it blameless so people are open about what happened.
How do incidents relate to the rest of the platform?
Incidents sit in the same workspace as your controls, risk register and continuity work, so whoever reviews an incident has that context to hand.
Track your next incident from report to review
Book a walkthrough and we will take an example incident from the first report to the improvement actions agreed in its review, so you can judge whether the record would satisfy your auditor.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them