> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://docs.brainframe.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Incident Management

# 🚨 **Incident** Management
> *Log it, classify it, track it*, *and notify the relevant parties.*


## **1️⃣ Page Overview**  
The **Incidents menu** is your central place to document, classify, and manage incidents quickly. To help you work efficiently, we provide a **structured incident template** (ensuring consistent reporting), and then allows you to move each incident into a **Kanban workflow** for tracking until resolution.  

| Did you know you can override our templates from Settings > Document Templates by importing and modifying the content. That way you can fully align them with your needs. These templates can also be a word/excel document if that is how you prefer to work.

---

## **2️⃣ Creating an Incident (from Template)**  
When logging an incident, the form ensures that all important details are captured.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-19480_1qooow.png =221xauto)Here is the template you will see when creating a new incident:

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/security-incident-template_1ql6hht.png =572xauto)


**Sections include:**  
* **Incident Identification** — Reference number, description, who reported it.  
* **Assessment** — Date, location, severity classification.  
* **Incident Classification** —  Confidentiality breach, Integrity violation, Availability disruption, Quality issue
* **Incident Category** — Incident, Event, or Weakness.  
* **Incident Source** — Internal, External, or both.  
* **Personal Data Considerations** — Processing role (e.g., Controller, Processor).  

📌 *Think of this as your standardized reporting sheet that ensures nothing is left out.*  
---

## **3️⃣ Existing Security Measures**  
Document **controls already in place** at the time of the incident, such as:  
* Encryption  
* Password policies  
* Monitoring & alerting measures
* Access control configurations

| 🔗 You can also @link related controls in the system for traceability.  
---

## **4️⃣ Incident Response Actions**  
Capture actions taken to contain and mitigate the incident:  

Date                | Action Taken        | Responsible Party        |  
YYYY-MM-DD | Describe action   | Assigned person/team |  
YYYY-MM-DD | Describe action   | Assigned person/team |  
---

## **5️⃣ Review & Lessons Learned**  
Prevent future recurrence by documenting corrective actions:  

Date                | Preventive Measure          | Responsible Party         |  
YYYY-MM-DD | Describe preventive step | Assigned person/team |  
YYYY-MM-DD | Describe preventive step | Assigned person/team |  
---

## **6️⃣ Resolution**  
Once resolved, the incident is **closed and archived** as per retention policies.  

* **Date of Resolution** (YYYY-MM-DD)  
* **Justification for Closure** — Explain why the incident is considered resolved, including mitigation evidence and ongoing monitoring.  

| A resolved incident should always include proof of action and closure notes.  
---

## **7️⃣ Notification Requirements**  
Brainframe allows you to record **who needs to be informed**. Checkboxes make it simple:  

* [ ] All Stakeholders  
* [X] Company Board  
* [ ] InfoSec & Risk Board  
* [ ] Authorities/Regulator  
* [X] Employees  
* [ ] Customers  
* [ ] DPO  
* [ ] Top Management  
* [ ] Data Subjects  
* [X] Legal  
---

## **8️⃣ Incident Kanban Board**  
Make sure to add incidents to the **Kanban board **to properly keep track of their resolution.  

**Stages include:**  
* 🟢 **Open** — New, not yet managed.  
* 🟡 **In Progress** — Being investigated.  
* 🔵 **Mitigated** — Addressed, awaiting confirmation.  
* ✅ **Closed** — Fully resolved and documented.  

📌 *Update incidents to advance stages as your team progresses.*  
| The stages are fully configurable to match your own preferred workflows
---

## **9️⃣ Best Practices**  
* 🚨 **Log incidents immediately** — Never wait, details fade quickly.  
* 🗂 **Keep evidence attached** — Controls, logs, screenshots.  
* 📨 **Update notifications** — Regulators and boards expect timely updates.  
* 🧩 **Always document lessons learned** — Prevent repeating mistakes.  
* 🔄 **Keep Kanban up to date** — Ensures audit readiness at all times.  
---

### **🎯 Visual Checklist**  
* [x] Incident logged in template  
* [x] Security measures noted  
* [x] Response actions documented  
* [x] Notifications sent  
* [ ] Lessons learned completed  
* [ ] Incident closed & archived