# Incident handling

URL: /systems/trust-and-governance/controls/incident-handling · Id: `control:incident-handling`

> Each Incident is contained, restored and closed with a postmortem and the Change that prevents a repeat.

Each [Incident](/business/nouns/incident) is contained, restored and closed with a postmortem and the [Change](/business/nouns/change) that prevents a repeat.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC7.3](/systems/trust-and-governance/criteria/soc2/cc7-3) | The entity evaluates security events to determine whether they are incidents that require a response. |
| [SOC2 CC7.4](/systems/trust-and-governance/criteria/soc2/cc7-4) | The entity responds to security incidents with a defined program to understand, contain, remediate and communicate them. |
| [SOC2 CC7.5](/systems/trust-and-governance/criteria/soc2/cc7-5) | The entity identifies, develops and performs activities to recover from identified security incidents. |
| [ISO27001 A.5.24](/systems/trust-and-governance/criteria/iso27001/a-5-24) | Incident management is prepared in advance, with defined processes, roles and responsibilities. |
| [ISO27001 A.5.26](/systems/trust-and-governance/criteria/iso27001/a-5-26) | Information security incidents are answered according to documented procedures. |
| [HIPAA 164.308(a)(6)](/systems/trust-and-governance/criteria/hipaa/164-308-a-6) | The entity identifies, responds to, mitigates and documents security incidents. |

## Implemented by
- [Incident response](/workflows/processes/incident-response)
- [Resolve an incident](/workflows/processes/incident-response/resolve-incident)
- [Status pages](/systems/status-pages)
- [Monitoring](/code/systems/monitoring)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Incident closed in the report period. |
| Assert | Each has a containment Event, a restore Event, a published postmortem and a linked preventing Change. |

## Owner
[Reliability Engineer](/agents/engineering/reliability-engineer), [Engineering Team](/agents/engineering).

## Example
Lesson booking fails after a deploy. The Change reverts in 5 minutes, booking is restored, and the postmortem links the Change that adds the missing test.