Incident management
From the first report to the lesson learned, with the clock running.
Incident management
Record incidents with classification, impact, timeline and actions. Playbooks drive what happens for each incident type, SLAs track how long each stage takes, and an escalation monitor pushes an incident up the chain when it stalls. Closing an incident captures what was learned, not just that it ended.
Key capabilities
- Incident taxonomy, templates and playbooks
- Impact assessment and severity scoring
- SLA tracking with due dates per stage
- Automatic escalation when an incident ages
- Lessons learned captured at closure
- Suspicious email reporting as an intake route
- Links to risks, assets, controls and findings
Describe it, and the form fills itself
The person who noticed the problem has a sentence, not a taxonomy. Type what happened in plain words and the fields are proposed for you: category, ratings, department. Nothing is saved. Every field stays editable, because the person who submits is the author of record.
Key capabilities
- Plain-language description turned into a structured draft
- Available on both the risk and incident registers
- Create only, never on an edit
- Stops at a likely duplicate and shows why it matched
Escalation paths
Define escalation paths once and have risks, incidents and findings follow them. A severity matrix decides which path applies, and a stalled item moves without somebody remembering to chase it.
Key capabilities
- Paths with ordered recipients and time thresholds
- Severity matrix mapping a rating to a path
- Automatic escalation on age or inactivity
- Raising an escalation separated from configuring the paths
Proof point
It stops at a duplicate. When something close already exists, the matches are shown with the words that produced them and no field is touched. Drafting a new one anyway is a second, deliberate click.
Questions about this module
Do we need to notify customers of every incident?
No. The impact assessment determines whether personal data, regulated data or a contractual commitment is involved. The register records the decision and the reasoning either way, which is what a regulator or auditor asks for.
What evidence do auditors want for incident management?
The documented process, the incident register for the period, at least one exercised or real incident with a full timeline and post-incident review, and proof that corrective actions were completed.
Can incidents link to vendors?
Yes. A vendor-caused incident is recorded against the supplier in the vendor register and triggers a re-assessment.