[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-6-8":3},{"item":4,"lessons":16,"controls":26,"related":36},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-6-8","Annex A 6.8","Information security event reporting",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** The organisation should give personnel a way to report observed or suspected information security events through appropriate channels and in a timely manner. Reporting should be easy and expected.\n\n**In practice.** There is one well publicised route, such as a phishing report button, a service desk category or a dedicated mailbox, that staff know about and can reach at any time. Awareness training explains what to report, including mistakes such as a misdirected email, and makes clear that prompt reporting is welcomed. Reports are triaged and feed into the incident management process. Evidence includes the published procedure, training records, report volumes and examples of reports that were assessed and closed.\n\n**Common gaps.** Staff often do not report their own mistakes because they fear blame, which delays response. Reporting channels may exist but be unknown to contractors or new starters, and reports are sometimes collected without anyone tracking the outcome or giving feedback to the reporter.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"slovenian-dpa-penalises-controller-for-breach-response-failures-and-poor-access-policy","Slovenian DPA Penalises Controller for Breach Response Failures and Poor Access Policy","2026-06-30T14:20:40.746+00:00",{"slug":23,"title":24,"published_at":25},"coordinated-fake-review-campaign-weaponizes-ai-data-consumption-against-brand-reputation","Coordinated Fake Review Campaign Weaponizes AI Data Consumption Against Brand Reputation","2026-06-19T14:20:38.044+00:00",[27,32],{"slug":28,"name":29,"problem":30,"stories":31},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":33,"name":34,"problem":35,"stories":31},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[37,42,47,51,54,58,62,66],{"family":38,"item":39,"code":40,"title":41,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":43,"item":44,"code":45,"title":46,"together":9},"cis","17","Control 17","Incident Response Management",{"family":38,"item":48,"code":49,"title":50,"together":31},"15","Article 15","Right of access by the data subject",{"family":38,"item":44,"code":52,"title":53,"together":31},"Article 17","Right to erasure ('right to be forgotten')",{"family":38,"item":55,"code":56,"title":57,"together":31},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":38,"item":59,"code":60,"title":61,"together":31},"34","Article 34","Communication of a personal data breach to the data subject",{"family":5,"item":63,"code":64,"title":65,"together":31},"a-5-33","Annex A 5.33","ISO\u002FIEC 27001:2022 Annex A 5.33: Protection of records",{"family":5,"item":67,"code":68,"title":69,"together":31},"a-5-7","Annex A 5.7","ISO\u002FIEC 27001:2022 Annex A 5.7: Threat intelligence"]