Key takeaways
- Give people an easy way to report security events quickly.
- Early reports limit damage.
- Start here: provide a simple reporting channel such as an email address or form.
Purpose
Give people an easy way to report security events quickly.
Requirement
Requirement summaryThe organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.
Why it matters
Early reports limit damage. Staff need an easy, blame-free way to raise concerns.
How to implement
- Provide a simple reporting channel such as an email address or form.
- Explain what to report: phishing, lost devices, odd behaviour.
- Respond and thank reporters to encourage future reports.
- Log every report for triage.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.8. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Simple instructions telling staff how to report something suspicious.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.8 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Examples of reports from staff in your incident or ticket log.
- Training or poster material showing how to report.
Things you should be able to show or explain
- Staff should know where and how to report a security concern.
How much to show: Ask five staff from different teams.
Common mistakes
- Staff unsure how to report.
- Reports received but not logged.
- A reporting route that only the IT team knows.
- Staff afraid of blame for reporting mistakes.
- Tip: One email address or button for 'report something odd'.
Policies & documents to have
- Human Resource Security Policy
- Incident Response Plan
- Information Security Policy
FAQ
Is A.6.8 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.8?
Be ready to explain how the control works in your organisation and to provide things like: Simple instructions telling staff how to report something suspicious…