Build your security incident management.
Keep reported security observations, restricted ownership and response tasks connected.
How to build your security incident management
Describe the job
Keep reported security observations, restricted ownership and response tasks connected.
Review the first version
Choose how the incident coordinator records the incident reference and how the authorized incident reviewer reviews the next step.
Refine the views
Ask First to adjust the fields and views for the people who will use the app.
Test before sharing
Walk through the process with a sample record and check who owns the next action.
A security incident management example
A suspected incident is reported without a confirmed impact.
Security incident management example
- Record
- Security incident management · 01
- Owner
- Incident coordinator
Current stage · Incident coordinator
Open the incident reference
A suspected incident is reported without a confirmed impact.
Read the full walkthrough
Open the incident reference
A suspected incident is reported without a confirmed impact.
- Record:
- Security incident management · 01
- Owner:
- Incident coordinator
Review the response task
Preserve the uncertainty and route it to authorised responders rather than declaring containment.
- Stage:
- Review pending
- Owner:
- Authorized incident reviewer
Keep the observation unconfirmed
Keep the observation unconfirmed until the responsible incident team reviews it.
- Next action:
- Keep the observation unconfirmed until the responsible incident team reviews it.
- Owner:
- Response owner
What to include in your security incident management
Keep the incident reference in context
Keep incident reference, reported observation, restricted owner, timeline, evidence reference and response task together so the next person can understand the request or record.
When the next step needs a decision
A suspected incident is reported without a confirmed impact. Preserve the uncertainty and route it to authorised responders rather than declaring containment.
Keep response task visible
Keep the observation unconfirmed until the responsible incident team reviews it.
Choose what each person needs
Give the incident coordinator a working view and the authorized incident reviewer a review view. Keep incident reference and reported observation attached to the decision as the work moves between them.
Questions about security incident management
Start with incident reference, reported observation, restricted owner, timeline, evidence reference and response task. Describe who enters the information and who reviews the next step.