Playbooks
Handle an incident
Record, follow the status, reassess risks, prepare notification deadlines and write the lessons learned.
Role: Compliance manager This playbook follows a security incident in the app. The technical response stays in your tools; the app keeps the trace and links the incident to assets and risks. Screen details: Incidents.
1. Record
"Record an incident": title, severity ("Low" to "Critical"), date and time of detection in UTC, owner, affected assets, linked risks. With Jira Service Management, enter the ticket key: the app never changes it. Without JSM, the app keeps a light register.
2. Move the status on
In the drawer: mark contained, mark resolved, close, reopen. A closed incident can no longer be edited.
3. Reassess risks
For a serious incident, reassess the linked risks in the risk register, then click "I reassessed these risks". The app does not change the risks.
4. Prepare notification deadlines
By choosing DORA or NIS2, the app prepares deadlines from the detection date. You record each submission by hand. Dates are prepared from the texts, to be confirmed with your counsel.
5. Write the lessons learned
What happened, what changes. A serious incident cannot be closed without them.
6. The proof
The incident's steps are in the audit log. The printable report (Reports) lays out the incidents section.
What the app does not do
- It sends nothing to the authorities and does not say a notification is required in your case.
- It neither contains nor resolves the incident.
- It changes neither the JSM ticket nor the linked risks.
Was this page helpful?