ISO 27001 A.6.8: Information security event reporting

Set up multiple reporting channels: a dedicated security incident email address, a security hotline or phone number, a web-based reporting form, integration with your IT service desk, an instant messaging channel or chatbot, and a physical option for when electronic channels are not available. Give people clear guidance with concrete examples of what to report: suspected phishing emails, unauthorised access attempts, lost or stolen devices, suspicious behaviour by colleagues or visitors, unusual system behaviour, potential data breaches or exposures, physical security concerns, social engineering attempts, malware suspicions, and anything that just feels off from a security perspective. Keep the reporting process simple and fast. The initial report should need minimal information: what happened, when, where, and who is reporting. Do not ask reporters to do technical analysis. The security team follows up for details. Acknowledge every report promptly so people know it was received and is being looked at. Publicise the reporting mechanism everywhere and keep reminding people. Cover it in security awareness training. Put reporting contact details on the intranet and in common areas. Add them to email signatures or login screens. Include reporting in new joiner induction. Send periodic reminders. Build a positive reporting culture. Never punish or blame anyone for a good-faith report, even if it turns out to be nothing. Thank people who report. Share anonymised examples of how reports helped prevent or contain real incidents. Make it clear that early reporting is valued and helps the whole organisation. Track reporting activity. Monitor volume, types of reports, response times, and outcomes. Low volumes probably mean people do not know about the mechanism or do not feel safe using it. Growing volumes are usually a sign of a healthy security culture.