What it asks for. The organisation should give personnel a way to report observed or suspected information security events through appropriate channels and in a timely manner. Reporting should be easy and expected.
In practice. There is one well publicised route, such as a phishing report button, a service desk category or a dedicated mailbox, that staff know about and can reach at any time. Awareness training explains what to report, including mistakes such as a misdirected email, and makes clear that prompt reporting is welcomed. Reports are triaged and feed into the incident management process. Evidence includes the published procedure, training records, report volumes and examples of reports that were assessed and closed.
Common gaps. Staff often do not report their own mistakes because they fear blame, which delays response. Reporting channels may exist but be unknown to contractors or new starters, and reports are sometimes collected without anyone tracking the outcome or giving feedback to the reporter.