Incident handling
Each Incident is contained, restored and closed with a postmortem and the Change that prevents a repeat.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC7.3 | The entity evaluates security events to determine whether they are incidents that require a response. |
| SOC2 CC7.4 | The entity responds to security incidents with a defined program to understand, contain, remediate and communicate them. |
| SOC2 CC7.5 | The entity identifies, develops and performs activities to recover from identified security incidents. |
| ISO27001 A.5.24 | Incident management is prepared in advance, with defined processes, roles and responsibilities. |
| ISO27001 A.5.26 | Information security incidents are answered according to documented procedures. |
| HIPAA 164.308(a)(6) | The entity identifies, responds to, mitigates and documents security incidents. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Incident closed in the report period. |
| Assert | Each has a containment Event, a restore Event, a published postmortem and a linked preventing Change. |
Owner
Reliability Engineer, Engineering Team.
Example
Lesson booking fails after a deploy. The Change reverts in 5 minutes, booking is restored, and the postmortem links the Change that adds the missing test.