Incident management

Log, review and resolve incidents

Key capabilities

• Incident register with a review workflow
• Corrective actions assigned and tracked
• Complete audit trail

Learn more

Handle incidents with a clear, auditable process

Record security and privacy incidents, route them through a review workflow, assign corrective actions and keep a complete audit trail from first report to resolution.

Security Incident Register

What this module is for

The Security Incident Register holds every security and privacy incident in your company, from the first report to the final review. Québec’s Law 25 (the privacy law) requires an incident register whatever the severity. Record each incident, even one that seems minor.

Before you start

• Select the Security Incident Register card on the dashboard, or select Report incident in the Security incidents panel.
• Every role can read incidents. Users and Admins record and work on them. Only an Admin can delete an incident.
• Gather the facts first: who reported the incident, when it happened and what you saw.

Report an incident

1. 1
   Enter the reporter, timing and description

   On Reporter, timing, description, enter who reported the incident, when it happened and what happened. Select Next.

2. 2
   Answer the simple questions

   On Simple questions, answer the short questions. Select Next.

3. 3
   Check the result

   On What we worked out, read the result. Select Back to change an answer, then finish the report.

Find and assign incidents

Search the list, or filter it by status and severity. The statuses are:

• Open
• Under Investigation
• Contained
• In Review
• Closed
• Reported

Select Open and assign to me to take an incident. Change its status on the incident page.

Work on an incident

Open an incident to see its parts:

• Events: the log of what happened on the incident.
• Comments: every role can add a comment.
• Checklist: the response steps. Users and Admins tick each step when it is done.
• Evidence: files and links that support the incident. Accepted file types are png, jpg, jpeg, webp, pdf, txt, csv, mp3 and m4a. Users and Admins add evidence, and every role can view and download it.
• Corrective actions: the actions that fix the problem. Users and Admins add, edit and delete them.
• Severity: Users and Admins can override the severity.

Write the post-incident review

After you handle an incident, write its post-incident review. Select Post-incident in the Security incidents panel to see the review queue, labelled Awaiting review.

1. 1
   Write the review

   Name the root cause. Answer the privacy-impact question and give the reason for your answer. The answer and the reason are both required.

2. 2
   Send it for approval

   Save the review, then send it for approval.

3. 3
   Wait for the decision

   An Admin approves the review or asks for a revision. Every role can see the revisions and the review queue.

A review is complete only when it names a root cause, records the privacy-impact answer and gives the reason.

Draft a breach communication

Users and Admins can draft a breach communication for an incident. Check the text, then send the breach email. Law 25 requires prompt notice when an incident presents a risk of serious injury. Notify the Commission d’accès à l’information du Québec (CAI) and the people concerned.

Open actions, History log and reports

• Open actions: the corrective actions that are still open.
• History log: the event log of all incidents. Select the export option to download it as a CSV file.
• Incident report: open an incident, choose a language, then create its report as a PDF.

Tips

• Record each incident as soon as someone reports it.
• Check the Awaiting review queue every week, so reviews do not wait.
• If you connect an AI assistant, it can open or resolve an incident for you. It asks for your approval first.

Related

• Domain security scan
• Data subject requests
• Software and costs