# How do we show an auditor what we decided on each security alert?

With a record that links each alert to a decision, a person, a time and a reason. Auditors want to see that alerts do not disappear: each was looked at, classified as harmless, under investigation or an incident, and closed with an explanation. A spreadsheet can do this for a handful of alerts, but it breaks down as volume grows and is easy to fill in afterwards. Use the tool's own workflow where you can, write short reasons rather than one-word statuses, and review a sample of closed alerts each quarter to check the quality of the decisions. In NetSenX, analyst decisions on alerts are recorded in the audit log on every plan, with who decided and when; from the Starter plan you can export PDF reports for the auditor.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/how-do-we-show-an-auditor-what-we-decided-on-each-alert

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [How long must we keep security incident records?](https://netsenx.com/en/faq/how-long-must-we-keep-security-incident-records)
- [Can a network map be generated automatically from traffic for an auditor?](https://netsenx.com/en/faq/can-a-network-map-be-generated-automatically-for-an-auditor)
- [Must we document data breaches that we decide not to report?](https://netsenx.com/en/faq/must-we-document-data-breaches-we-do-not-report)
- [When must we tell the affected people about a data breach?](https://netsenx.com/en/faq/when-must-we-tell-affected-people-about-a-data-breach)
- [When does the NIS2 24-hour clock start?](https://netsenx.com/en/faq/when-does-the-nis2-24-hour-clock-start)