What it asks for. Point (b) requires entities to have measures for incident handling, meaning the processes to prevent, detect, analyse, contain, respond to and recover from incidents. It links closely to the reporting obligations in Article 23.
In practice. The entity has an incident handling policy and procedures, defined roles, criteria for classifying incidents, and tooling to detect and log events. Incidents are recorded, analysed for root cause and used for improvement, and the process includes steps to assess whether an incident is significant and must be reported. Evidence includes procedures, incident logs, post incident reviews and exercise records.
Common gaps. Incident handling often lacks a clear path to decide significance for regulatory reporting. Small incidents are not logged, which hides trends.