Control A.6.8Information security event reporting
What it means in practice
The organisation must provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.
The control that produces most of an organisation’s early warning. Technology detects what it was configured to detect; people notice the things nobody anticipated — an odd request, a process that behaved strangely, a colleague’s account doing something unusual.
Three requirements make the mechanism work. It must be available — known, and usable from a phone when the network is not trusted. It must be timely — a route that takes a day to reach anyone is not a reporting channel. And it must be safe to use: reporting must not expose the reporter to blame, including when they caused the event.
The metric worth watching is the report rate, and a falling one is rarely good news. An organisation whose reports decline has usually taught its people that reporting is unwelcome, not that there is less to report.
How to put this in place
Early reports shrink damage, so the project needs one well-known route for reporting events and weaknesses. If people fear blame or cannot tell where to report, incidents surface late.
- Choose one simple reporting route, such as a mailbox, form or phone number.
- Write a short procedure for who receives reports, how they are acknowledged and how they feed incident handling.
- Tell everyone where to report and what counts as worth reporting, and state that reporting is blame-free.
- Log every report and its handling, including the trivial ones.
- Test awareness by asking staff how they would report.
Evidence an auditor usually looks for: the reporting route and procedure, a log of reports and how each was handled, and staff who can say how to report.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Security Incident Management Policy
in Security Incident ManagementIts Framework References list this control. Supported by: Everyone reports at once through the reporting route (IM-01). - Word
Incident Triage & First-Hour Assessment Procedure
in Security Incident ManagementIts Framework References list this control. Supported by: Reporting routes; step 1. - Word
Classification Quick-Reference Card & Staff Briefing
in Information Classification & HandlingIts Framework References list this control. Supported by: What to do after a mistake; part 7 of the briefing. - Word
Phishing Simulation Programme Method
in Security Awareness ProgrammeIts Framework References list this control. Supported by: Reporting as the success measure; the reporting route in every campaign.