Security incidents trend
Incident trend compares the recent average with the longer average, for all incidents and for each category.
What the published 2016 guidance says
Incident trend compares the recent average with the longer average, for all incidents and for each category. The construct uses a timeframe such as a month, and illustrative thresholds: below 1.0 green, 1.00 to 1.30 yellow and above 1.3 red. Evidence is the monthly indicator values. It is collected monthly. The incident response team owns and collects it, and the technology and security leads are clients. The data is the incident reports. A table of values and a trend diagram are reported, and the severity mix should be read alongside them.
What it means in practice
The incident trend compares the recent average with the longer average, overall and by category. It is a simple leading indicator of whether the incident landscape is improving. Read it with the severity mix, because a rise in trivial events is not the same as a rise in serious ones.
Status of this record. For B.34, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the monthly incident counts by category. Calculate the recent average against the longer average. Report the table and the trend. Read the result with the severity mix.
Evidence an assessor asks for
- Incident managementMonthly incident counts overall and per category
- Incident managementTwo-month against six-month averages with the colour thresholds
The question an assessor will ask
An assessor will ask for monthly incident counts overall and per category. The test for B.34 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Category assignment inconsistent month to month
- Short history, so the six-timeframe baseline does not exist
Before the next review
Before the next review, test this against one live record: category assignment inconsistent month to month.
What to check when the revision publishes
When DIS 27004 is published, compare the B.34 Security incidents trend record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.