What changes afterwards, and what should

Blameless, and within a fortnight

While people remember, and before the account has settled into a story. The purpose is to find what made the event possible and what delayed the response, not to identify who clicked.

Where the review produces a person rather than a process, it has usually stopped early. The person clicked because the message was convincing, or transferred the file because the compliant route was slower, and those are the findings that can be acted on.

Process more often than technology

The recurring outcomes are unglamorous: the contact list was wrong, the decision-maker was unreachable, logs from one system were not retained, nobody had the certificate, the machine was reimaged before anybody thought about evidence.

Each is fixed with an afternoon and none is fixed by a purchase, which is worth stating on a vendor's website.

The incident is evidence

The standard requires an incident response capability, and an assessor may ask how you know yours works. A documented incident, with a timeline, a decision record, a report and a review, is the strongest possible answer.

Which means the paperwork produced during a bad week has value afterwards, provided it was kept.

The control that makes work impossible

The strongest impulse after an incident is to prevent that exact thing forever, and the resulting control is frequently disproportionate: a route blocked entirely with nothing put in its place.

Within a month somebody has found another way and the organisation is worse off than before, because the new way is undocumented. The entry on the operator's view sets out the alternative.

Once, properly

What happened, what it cost, what has changed, and what remains open with a date. One page, at the next meeting, not a standing item that runs for six months.

A standing item invites monthly reassurance-seeking and prevents the matter being closed, which is bad for the programme and for the person running it.

The file

The timeline, the decision record, the report submitted, the correspondence with the customer, the forensic output, the review and the actions with their completion dates.

Retained for the period the clause requires at minimum, and in practice longer, because the questions arrive later than the retention period assumes.

Most incidents are not attacks

Across this sector the majority of reportable events involve error, misdirection and loss rather than a sophisticated intrusion. That is not a reason to relax; it is a reason to put effort where the events actually are, which is in ordinary processes used by ordinary people under time pressure.

Which is where most of this blog has been pointing.

Elsewhere in when something happens

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.