Establish and Maintain Contact Information for Reporting Security Incidents

All security incidents are addressed in a consistent manner to improve security based on what has happened.

In the incident treatment process:

• the reported incident is confirmed (or found unnecessary to record)
• the type and cause of incident is documented
• the risks associated with the incident are documented
• the risks are re-evaluated and treated if that is necessary after the incident
• risk mitigation measures or a decision their acceptance is documented
• people who need to be informed of the results of the incident treatment are identified (including external ones)
• possible need for a post-incident analysis is determined

The organisation should have clear communication channels for event reporting:

• Establish and maintain adequate communication channels for security event reporters, ensuring that:
• A common point of contact for reporting events is identified and communicated to all relevant parties.
• Different reporting channels are available based on the perceived severity of events, including real-time communication options for significant emergencies and asynchronous methods (e.g., tickets, email) for less urgent matters.

Organisation should also consider the possibility of external reporting. This could mean having a system to handle security event reports from external parties, including:

• An externally accessible and well-communicated method for reporting security events.
• Defined procedures for responding to and addressing security event reports from external sources.

The organisation should also ensure that the mechanisms and information for reporting incidents are easily accessible to all relevant reporters and establish a feedback procedure to provide timely responses and updates to those who report security events, ensuring they are informed of the outcomes and any necessary follow-up actions.

The organization lists the relevant government actors with whom it is important to actively contact and, if necessary, get in touch quickly. These authorities include national law enforcement and supervisory authorities.

A clear contact person should be defined for the relevant authorities to act as a contact point for the organization.

The organization must have a procedure for reporting disturbances, attacks and violations to the authorities. For example:

• Police
• Office of the Data Protection Commissioner
• Cyber Security Center