How do we show an auditor what we decided on each security alert?

With a record that links each alert to a decision, a person, a time and a reason. Auditors want to see that alerts do not disappear: each was looked at, classified as harmless, under investigation or an incident, and closed with an explanation. A spreadsheet can do this for a handful of alerts, but it breaks down as volume grows and is easy to fill in afterwards. Use the tool's own workflow where you can, write short reasons rather than one-word statuses, and review a sample of closed alerts each quarter to check the quality of the decisions. In NetSenX, analyst decisions on alerts are recorded in the audit log on every plan, with who decided and when; from the Starter plan you can export PDF reports for the auditor.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics