17.3: Establish and Maintain an Enterprise Process for Reporting Incidents
Incorporates the following controls from the previous version: 19.4: Devise Organization-wide Standards for Reporting Incidents, 19.6: Publish Information Regarding Reporting Computer Anomalies and Incidents.
Control Statement
Establish and maintain an enterprise process for the workforce to report security incidents. The process includes reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to all of the workforce. Review annually, or when significant enterprise changes occur that could impact this Safeguard.
[csf.tools Note: For more information on the Critical Security Controls, visit the Center for Internet Security.]