Incident Reporting vs Incident Investigation

Business Context

Major ICT incidents require immediate regulatory notification while technical investigations are still evolving. Organizations must satisfy strict reporting deadlines without compromising the accuracy of incident information.

Conflict

Rapid reporting improves regulatory awareness but may rely on incomplete information. Delayed reporting improves accuracy but risks regulatory non-compliance.

Regulatory Obligations

Classify ICT incidents using documented criteria

Define reporting thresholds

Notify regulators within required timeframes

Update reports as investigations progress

Preserve forensic evidence

Conduct post-incident reviews

Business Risks

Delayed recovery

Poor crisis management

Increased financial losses

Compliance Risks

Late regulatory notifications

Inaccurate reporting

Regulatory investigations and penalties

Recommended Controls

Implement integrated incident response procedures involving cybersecurity, legal, compliance, communications, and executive management. Separate preliminary notifications from final investigative conclusions through structured reporting updates.

Evidence Required

Incident Response Policy

Incident Classification Procedures

Regulatory Notification Records

Investigation Reports

Lessons Learned Register

Audit Questions

Are ICT incidents classified consistently?

Are reporting deadlines achieved?

Are investigations documented?

Are post-incident reviews completed?

Suggested Kpis

Percentage of reportable incidents notified on time

Average incident classification time

Percentage of incidents completing root cause analysis

Number of reporting deficiencies