# What records do we need to answer questions about past incidents?

An incident register and the evidence behind each entry. For each incident, record when it started, when it was detected and by whom, what was affected (systems, data, customers), how it was contained, whether it was reported and to whom, the root cause and what changed afterwards. Keep the supporting material too: alerts, logs, tickets, decisions and messages to authorities or customers. The GDPR already requires controllers to document every personal data breach, including those not reported, and auditors and buyers will ask for the same facts. NetSenX contributes the network part: alerts with time, devices and destinations, the audit log of who decided what, and NIS2 deadline tracking per incident. Keep the register itself somewhere you control.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [For the board and finance](https://netsenx.com/en/faq/board) · https://netsenx.com/en/faq/what-records-do-we-need-to-answer-questions-about-past-incidents

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/blog/2026-10-09_cybersecurity-for-the-board
- https://netsenx.com/en/pricing

## Related questions

- [What should the board know about the cost of IT downtime?](https://netsenx.com/en/faq/what-should-the-board-know-about-the-cost-of-downtime)
- [What questions should the board ask the IT manager about security?](https://netsenx.com/en/faq/what-questions-should-the-board-ask-the-it-manager)
- [What should cyber security training for the board cover?](https://netsenx.com/en/faq/what-should-cyber-security-training-for-the-board-cover)
- [Who should own cyber security in a small company?](https://netsenx.com/en/faq/who-should-own-cyber-security-in-a-small-company)
- [What should the CEO do in the first hour of a cyber incident?](https://netsenx.com/en/faq/what-should-the-ceo-do-in-the-first-hour-of-a-cyber-incident)