  

## 6.8 Information security event reporting

  

| **Control type** | **Information security properties** | **Cybersecurity concepts** | **Operational capabilities** | **Security domains** |

|------------------|-----------------------------------------|---------------------------|---------------------------------------------|---------------------|

| #Detective | #Confidentiality #Integrity #Availability | #Detect | #Information_security_event_management | #Defence |

  

**Control**

  

The organization should provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

  

**Purpose**

  

To support timely, consistent and effective reporting of information security events that can be identified by personnel.

  

**Guidance**

  

All personnel and users should be made aware of their responsibility to report information security events as quickly as possible in order to prevent or minimize the effect of information security incidents.

  

They should also be aware of the procedure for reporting information security events and the point of contact to which the events should be reported. The reporting mechanism should be as easy, accessible and available as possible. Information security events include incidents, breaches and vulnerabilities.

  

Situations to be considered for information security event reporting include:

  

a\) ineffective information security controls;

  

b\) breach of information confidentiality, integrity or availability expectations;

  

c\) human errors;

  

d\) non-compliance with the information security policy, topic-specific policies or applicable standards;

  

e\) breaches of physical security measures;

  

f\) system changes that have not gone through the change management process;

  

g\) malfunctions or other anomalous system behaviour of software or hardware;

  

h\) access violations;

  

i\) vulnerabilities;

  

j\) suspected malware infection.

  

Personnel and users should be advised not to attempt to prove suspected information security vulnerabilities. Testing vulnerabilities can be interpreted as a potential misuse of the system and can also cause damage to the information system or service, and it can corrupt or obscure digital evidence. Ultimately, this can result in legal liability for the individual performing the testing.

  

**Other information**

  

See the ISO/IEC 27035 series for additional information.