SIM-03 Documentation and reporting of security incidents
Once an incident has been worked through, record the resolution as the contract requires and issue that report to the customers affected so they can acknowledge it or confirm the outcome.
4
artefacts
0
held by a system
0
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Closure reports issued to customers after incident resolution · Document repository
- Contract extracts defining the report content and deadline owed to customers · Vendor register / contract repository
- Acknowledgement or confirmation responses received back from affected customers · HR system / LMS
- Tracker showing which affected customers were sent a report and on what date · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Incidents closed internally with no report reaching the affected customer
- Report sent only to the customer who reported it rather than all customers affected
- Report content falls short of what the contract commits to deliver
- No record of customer acknowledgement, so closure cannot be evidenced
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSIM-02 Processing of security incidents · SIM-04 Duty of the users to report security incidents to a central body