Security incident management
When an incident hits, every hour counts. We structure detection, reporting, handling and lessons learned so your team knows what to do.
What we see too often
The first serious incident almost always reveals the same thing: nobody knows who decides, what to tell the client, or how to tell an incident from a simple nonconformity.
- a copied procedure, never exercised, impossible to find on the day
- everyone writes in chat, nothing is timestamped
- confusion between an IT ticket, a security incident and an ISMS nonconformity
- no criteria to notify a client, an insurer or the privacy regulator
- no lessons learned, so the same hole reopens
What this module is
Incident management means detect, qualify, contain, communicate, close and learn. ISO 27001 asks for a process, roles and evidence, not a SOC tool if you do not need one.
We set a procedure your on-call person can open at 2 a.m.: thresholds, contacts, report template, a link to continuity if the service is down. Pentest and SOC remain separate services.
Where this sits in ISO 27001
The module covers the Annex A incident process and the link to nonconformities (clause 10.2). It does not recreate a security operations centre.
What this module includes
- Definition of what counts as an incident for you
- Reporting channel and escalation criteria
- Roles during and after the incident
- Evidence to keep for audit and, in Quebec, for Bill 25 if personal information is involved
- Post-incident review
How we work
Define what an incident is for you
Thresholds, examples, distinction from a routine ticket and from a nonconformity. Without that, everything is urgent, or nothing is.
Roles and channels
Who is called, who speaks to the client, who decides to escalate. A simple tree, tested with real numbers.
Conduct and evidence
Containment steps, action log, report template. We write for the team, not for the binder.
Closure and learning
Lessons learned, corrective actions, optional link to the risk register. An incident with no lesson is a wasted incident.
What you receive
- Incident management procedure
- Escalation and communication matrix
- Incident record template
- Incident log and post-mortem canvas
Who it is for
SMBs that already receive alerts, or that have no clear path between an employee, IT and leadership.
Who it is not for
This module is not a 24/7 monitoring service, nor a full digital investigation, nor the business continuity plan. It does not buy a SIEM.
Typical duration
2 to 4 weeks, including a tabletop exercise.
What you need to provide
You provide current alert channels, client contracts that impose notification delays, and someone who can decide after hours.
What this module does not cover
This module structures the process. It does not provide a 24/7 SOC or a full forensic investigation.
Frequently asked questions
- How is this different from continuity?
- Incidents handle the security event. Continuity prepares recovery of critical activities, including backups, if the incident becomes a major outage.
- Must every IT ticket be logged as an incident?
- No. We distinguish security incidents, simple outages and service requests so the process is not flooded.
- What about Bill 25 duties?
- If personal information is involved, the process must include assessment and, when required, notification. We align the two regimes without merging them.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.