What records do we need to answer questions about past incidents?

An incident register and the evidence behind each entry. For each incident, record when it started, when it was detected and by whom, what was affected (systems, data, customers), how it was contained, whether it was reported and to whom, the root cause and what changed afterwards. Keep the supporting material too: alerts, logs, tickets, decisions and messages to authorities or customers. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). already requires controllers to document every personal data breach, including those not reported, and auditors and buyers will ask for the same facts. NetSenX contributes the network part: alerts with time, devices and destinations, the audit log of who decided what, and NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. deadline tracking per incident. Keep the register itself somewhere you control.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on For the board and financeAll topics