Logging Your First Security Incident
What to record when a security event happens, how severity and NDB flags work, and how to move an incident through to closure.
Log It Even If You're Not Sure Yet
Not every security event turns out to be serious, but every one is worth logging the moment you notice it. A suspicious email, a misconfigured permission someone spotted, a lost laptop — record it first, assess it second. The Incident Management module is designed for exactly this: capture what you know now, and refine severity and impact as the investigation proceeds.
Logging an Incident
Click Log Incident and record:
- Title and description — what happened, how it was detected, and what you know so far. It's fine to update this as the picture becomes clearer.
- Severity — a first estimate (low, medium, high, critical) based on likely scope and impact. You can revise this once you know more.
- NDB flag — if personal information may have been accessed, disclosed, or lost, flag it. This starts the notifiable-data-breach assessment clock under the Privacy Act — see Notifiable Data Breaches Scheme for what that involves. If you're not sure, flag it anyway; you can unflag it once assessed.
- Assignee — who is leading the response.
What Happens Next
The incident moves through Open → Investigating → Contained → Resolved → Closed as the response progresses. If it's flagged for NDB, a countdown badge tracks your assessment deadline — don't close the incident until that assessment is documented, even if the breach turns out not to be notifiable. See Incident Management for the full workflow, deadline colour coding, and how incidents feed into your NDB register.