Establish and Maintain an Enterprise Process for Reporting Incidents
Description
Establish and maintain an enterprise process for the workforce to report security incidents. The process includes reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to all of the workforce. Review annually, or when significant enterprise changes occur that could impact this Safeguard.
Implementation Checklist
Tool Recommendations
Security orchestration, automation, and response platform with playbook automation and case management
Palo Alto Networks · Enterprise subscription
Security orchestration and automated response platform with playbooks, case management, and 350+ integrations
Cisco (Splunk) · Event-based subscription
Security incident response and vulnerability response with orchestration, workflow automation, and CMDB integration
ServiceNow · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Security Incident Unreported by Employee Who Witnessed It
ConfidentialityAn employee observes indicators of compromise but does not report them because no enterprise reporting process defines how, when, or to whom incidents should be reported.
Delayed Incident Response Due to Informal Reporting Chain
ConfidentialityAn employee reports a suspected breach to their direct manager instead of the security team, and the information takes days to reach the right people because no formal reporting process exists.
Vulnerabilities (When Safeguard Absent)
No Standardized Incident Reporting Process for Workforce
Without a defined reporting process, employees lack clear guidance on reporting timeframes, who to contact, how to report, and what minimum information to include, resulting in unreported or poorly reported incidents.
Reporting Process Not Publicly Available to All Staff
Even if a reporting process exists, it is ineffective if not readily accessible to all workforce members, resulting in employees being unable to find reporting instructions during a suspected incident.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Response procedure/playbook documentation | Reviewed bi-annually |
| Record | Response action logs showing procedure execution | Per incident |
| Document | Incident response plan and playbooks | Reviewed bi-annually |
| Record | Incident reports and post-incident review documentation | Per incident |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |