What counts as an incident

Because a clock attaches to it

Most organisations have an informal sense of what an incident is, and it is calibrated to how bad the day feels. Reporting obligations are not calibrated that way: they attach to a definition written in a contract clause, and that definition is broader than the informal sense.

Which means the first question after something happens is not how serious it is but which definition it meets.

Event, incident, breach, finding

An event is anything the systems recorded. Most are nothing.

An incident is an event that meets a defined threshold, and the threshold that matters is the contractual one rather than the one in your internal policy.

A breach is a term from data protection law with its own definitions and its own obligations, which may be engaged at the same time and by a different regime.

A finding is something an assessor identifies. It is not an incident, it does not carry a reporting clock, and the two are confused often enough to be worth separating.

Lower than people expect

The defence clause requires rapid reporting of cyber incidents that affect covered defence information or the contractor's ability to perform certain contract requirements. It does not require the incident to have been successful in the way people imagine, and it does not require certainty.

Read the clause in your own contract rather than a summary of it, including this one, because the wording governs.

Five things and whether they count

A laptop with covered information is lost. Almost certainly reportable. Encryption is relevant to the consequences and not necessarily to the obligation.

Covered information is emailed to the wrong supplier. Reportable, and commonly not recognised as an incident at all because nobody attacked anything.

Ransomware on a system with no covered information. Depends on whether it affected the ability to perform, which is the second limb of the clause and the one people forget.

A machine controller behaves oddly and is reimaged. Possibly reportable, and now unanswerable, because the evidence was destroyed. The entry on the first hour is about this.

An assessor finds a control not operating. Not an incident.

One named person, reachable

The determination is a judgement made quickly, sometimes at night, on incomplete information. It needs a named decision-maker with a deputy, both reachable, and both with the authority to start a report.

Where the decision requires assembling three people who are not on call, the clock runs while the meeting is arranged.

Including the decision not to report

A written record of what happened, what was considered, and why it was or was not reportable. Dated at the time rather than reconstructed later.

This protects a reasonable decision that turns out to have been wrong, and its absence makes a reasonable decision look like an oversight.

Not free, and better than the alternative

Reporting things that turn out to be nothing consumes your time and the recipient's, and it is recoverable. Failing to report something that was reportable is not, and the discovery usually happens at the worst moment.

Where the judgement is genuinely balanced, take advice quickly rather than deliberating past the deadline.

Elsewhere in when something happens

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.