Control A.6.8Information security event reporting
The organisation must provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.
The control that produces most of an organisation’s early warning. Technology detects what it was configured to detect; people notice the things nobody anticipated — an odd request, a process that behaved strangely, a colleague’s account doing something unusual.
Three requirements make the mechanism work. It must be available — known, and usable from a phone when the network is not trusted. It must be timely — a route that takes a day to reach anyone is not a reporting channel. And it must be safe to use: reporting must not expose the reporter to blame, including when they caused the event.
The metric worth watching is the report rate, and a falling one is rarely good news. An organisation whose reports decline has usually taught its people that reporting is unwelcome, not that there is less to report.
How to put this in place
Early reports shrink damage, so the project needs one well-known route for reporting events and weaknesses. If people fear blame or cannot tell where to report, incidents surface late.
- Choose one simple reporting route, such as a mailbox, form or phone number.
- Write a short procedure for who receives reports, how they are acknowledged and how they feed incident handling.
- Tell everyone where to report and what counts as worth reporting, and state that reporting is blame-free.
- Log every report and its handling, including the trivial ones.
- Test awareness by asking staff how they would report.
Evidence an auditor usually looks for: the reporting route and procedure, a log of reports and how each was handled, and staff who can say how to report.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.