Security incident cost
Incident cost puts security in the language of the board.
What the published 2016 guidance says
Incident cost puts security in the language of the board. The measure sums the cost of each incident in the sampling period, with a threshold the organization sets as acceptable. The evidence is a systematic record of cost per incident. It is collected quarterly. The incident response team owns the information, the security manager collects, and top management is the client. Incident reports are the data source. A column chart shows the period and the previous periods, with a drill-down to average cost per incident and per category.
What it means in practice
Incident cost makes the case for prevention in the language of the board. Define what counts as a cost, collect it per incident, and report the trend with a drill-down by category. A threshold turns the chart into a decision rule.
Status of this record. For B.8, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Define the cost categories and collect them per incident. Report the total and the drill-down by category. Set the threshold with the risk owner. Keep the incident reports as the evidence.
Evidence an assessor asks for
- Incident managementIncident reports carrying a cost field
- FinanceIncident categories defined in advance
- Incident managementColumn chart and per-category drill-down
The question an assessor will ask
An assessor will ask for incident reports carrying a cost field. The test for B.8 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Incident costs never captured, so the measure cannot be built
- Categories invented after the fact for each report
Before the next review
Before the next review, test this against one live record: incident costs never captured, so the measure cannot be built.
What to check when the revision publishes
When DIS 27004 is published, compare the B.8 Security incident cost record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.