Security event reporting
Reporting culture is measured by the number of events reported and formally treated by the incident response team, relative to the number of security roles the organization defines.
What the published 2016 guidance says
Reporting culture is measured by the number of events reported and formally treated by the incident response team, relative to the number of security roles the organization defines. The illustrative target is at least one event per role per year. Evidence is the ticketing system used to treat events. It is collected and reported yearly. The response team owns it, the security manager collects and, with top management, is the client. Incident reports are the data. A trend line of reported events shows whether the reporting channel is alive.
What it means in practice
Reporting culture is measured by events reported and formally treated, relative to the number of security roles. The target of at least one per role per year is a floor, not a goal. Pair it with a quality check so that volume is not rewarded over substance.
Status of this record. For B.35, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the event tickets and the list of security roles. Count the events reported and formally treated per role. Report the trend. Check a sample for quality so that volume is not the only signal.
Evidence an assessor asks for
- Incident managementTicketing records of reported and treated events
- Awareness and trainingThe defined list of security roles used as the denominator
The question an assessor will ask
An assessor will ask for ticketing records of reported and treated events. The test for B.35 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Events reported informally and never ticketed
- Security roles undefined, so the ratio has no denominator
Before the next review
Before the next review, test this against one live record: events reported informally and never ticketed.
What to check when the revision publishes
When DIS 27004 is published, compare the B.35 Security event reporting record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.