Which standards require a security event reporting procedure?

ISO/IEC 27001:2022: 6.8, 5.25; The NIS2 Directive: Art. 21(2)(b).

What must a security event reporting procedure contain under ISO 27001?

6.8: Give people an easy, timely channel to report observed or suspected security events. 5.25: Triage security events and decide which become incidents. The ISO 27002 guidance beside 6.8: Requires a mechanism through which personnel can report security events they have observed or suspect, using appropriate channels and without delay.

Who should own the security event reporting procedure?

The clauses imply the information security lead (CISO or ISMS manager). The register names the role so the line on your list can carry a name.

How often should a security event reporting procedure be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a security event reporting procedure?

No template yet; the page names what the clauses expect the document to contain, which is the outline to start from.

Every policy type · Resilience and incidents

Security event reporting procedure

How anyone who sees a security event reports it, to whom, through which channel, and what happens next.

How the register reads it

Also called	event reporting procedure, how to report an incident
Family	Resilience and incidents
Document type	Procedure. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the incident response plan; when neither is listed, the gap is counted once, under the parent.
Expected owner	The information security lead (CISO or ISMS manager).
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, incident response plan, is).
Template	No template yet. The clauses below say what the document is expected to contain.

Which standards require it, and what each expects it to contain

3 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 6.8 Information security event reporting

Give people an easy, timely channel to report observed or suspected security events.

What the ISO 27002 guidance expects the document to say: Requires a mechanism through which personnel can report security events they have observed or suspect, using appropriate channels and without delay.

Evidence an auditor accepts: The defined reporting mechanism and channels, and evidence they are known to personnel and to relevant third parties; reporting records for the period, showing volume, source and the time between observation and report; evidence the channel is available at all times and does not depend on a system that may itself be affected
Common gap: no anonymous reporting option
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 5.25 Assessment and decision on information security events

Triage security events and decide which become incidents.

What the ISO 27002 guidance expects the document to say: Requires information security events to be assessed and a decision taken on whether each event is to be categorised as an information security incident.

Evidence an auditor accepts: The criteria used to decide whether an event is an incident, and the severity scale applied; records of events assessed in the period, including those assessed as not incidents, with the reason recorded; evidence of who performed the assessment and that they were competent and authorised to do so
Common gap: no documented triage steps
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

The NIS2 Directive

NIS2 Art. 21(2)(b) Incident handling

Incident handling here is the internal capability to detect, triage, contain, eradicate, recover from and learn from incidents. It is separate from the reporting duty in Article 23: reporting tells the authority what happened, handling is what the entity does about it. The capability needs defined severity levels, an escalation path that reaches decision makers out of hours, named responsibilities, and evidence that it functions rather than exists on paper. Post-incident review matters because it is the link back to Article 21(2)(f), where the effectiveness of the measures is assessed. The classification scheme deserves particular attention, because the same triage has to be able to recognise a significant incident under Article 23(3) and start the 24-hour clock.

Evidence an auditor accepts: The incident handling procedure with severity levels, roles and escalation paths; incident records for a representative period showing detection, containment and recovery times; evidence of out-of-hours coverage and of how escalation reaches decision makers
Common gap: A response plan that has never been exercised against a realistic scenario
Source: NIS2 Directive

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Pandemic response plan · Consent management policy