Security Incident Management
When implementing an ISMS according to ISO 27001, a complete reporting system for security and data protection incidents should be should be also considered. Furthermore, it is essential to proceed in a structured and methodical way in case of a security incident in order to have an overview of the situation at any time.
The QSEC module Security Incident Management offers this along an integrated risk management process. The relevant security and data protection incidents are recorded. Security incident measures are managed in a structured way, in order to improve the risk assessment within the ISMS process according to ISO 27001.
In addition to the category and degree of severity of an incident, the following points are documented
- Amount of damage,
- Severity,
- Damage class and
- Type of damage.
A status with resubmissions and persons responsible is maintained for each damage or incident, which is linked to corresponding measures and security objectives.
Incidents recorded in Security Incident Management are assigned to business units and the asset groups affected by them.
Security Incident Management – overview
Features (excerpt)
- Recording of category, severity, amount, class and type of damage
- Registration of affected asset groups and persons
- Indication of the associated risk scenarios
- Acquisition of the security target
- Responsibility, resubmission
- Link to other objects
- Integration into the QSEC Risk Management
QSEC modules
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |