ISO 27001 A.6.8: reporting security events, explained for startups

A.6.8 Information security event reporting

Staff know how to report anything suspicious, and do. What proves it: a simple channel for staff to report security events, and a record of the reports received.

A certification auditor samples the reporting channel and reported events. A file that usually does the job: a security reporting address or chat channel named in onboarding, and a ticket raised from a staff report.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.6.8 walks you through it in this order.

1. Set up one reporting channel, such as a security email address or chat channel.
2. Tell every staff member about it at onboarding and in training.
3. Record every report in your incident register.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do you have an incident response procedure and a log of incidents?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Information Security Incident Management Policy covers A.6.8. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC2.2, internal communication and CC7.3, incident triage.

People controls

A.6.8 is one of the 8 people controls in Annex A. What happens before, during and after someone works for you: screening, terms, training, discipline, remote work and reporting. Small teams meet these with a handful of signed records.

Nearby controls in the same theme:

• A.6.5, duties after leaving
• A.6.6, confidentiality agreements
• A.6.7, remote work

Before it: A.6.7, remote work. After it: A.7.1, physical perimeters. Every control, by theme, is on the Annex A controls page.