If someone in your organisation notices something suspicious, they report it in Varmo under “Incidents” – better once too often. The incident team assesses the report, handles the incident and records the cause and lessons learned in the post-incident review. This guide is aimed at all employees and at the incident team.

Before you start

  • By default, all employees may Report.
  • People with the permission to edit incidents (the incident team, by default the ISMS managers) may Assess and handle. The person responsible for an incident handles it even without this permission.
  • Settings: under ISMS settings › Incidents (Incident management card), you define an emergency contact that appears at the top of the report form, maintain the categories and choose the reporting obligations to authorities that apply to your organisation.
  1. EmployeesReport

    What happened, when was it noticed?

  2. Incident teamAssess

    Category, severity, responsible person.

  3. Responsible personHandle and resolve

    Log, immediate measure, “Mark as resolved”.

  4. Responsible personComplete post-incident review

    Cause and lessons learned.

Not an incident

The decision is justified; the report is kept as evidence.

Reporting obligation to authorities

One task per report with a statutory deadline, for example 24 hours for the report to the BACS. Closing only once a decision has been made on all reports.

The path of an incident

Four steps: a person reports the incident. The incident team assesses the report and defines the responsible person. This person contains the incident and marks it as resolved. They then complete the post-incident review with cause and lessons learned. If it is not an incident, this is justified. For chosen reporting obligations to authorities, a task with the statutory deadline is created per report; the incident can only be closed once a decision has been made on the reports.

Reporting an incident

  1. Open Incidents and click Report incident.
  2. Describe what happened (e.g. “Clicked a link in a suspicious email”), what you noticed and have already done, and when you noticed it. Do not copy any passwords or confidential content into it.
  3. State whether personal data is affected and which asset is affected, as far as you know.
  4. Submit the report.

You see the status of your reports under My incident reports. In the event of acute danger, the emergency contact in the report form also applies.

Handling an incident

  1. Assess: the incident team opens the report and chooses Assess report. For Yes, security incident, you define the category, severity, personal data and the responsible person. For No, not an incident, you justify the decision, for example for a false alarm or spam without a click; the report is kept as evidence.
  2. Handle: the responsible person contains the incident, records in the Log what was done and, if necessary, creates an Immediate measure. Log entries have a type: note, containment / resolution, communication or evidence preservation. Use Evidence preservation to record which traces (e.g. log files, emails) you have secured and where (ISO/IEC 27001, Annex A 5.28).
  3. Resolve: with Mark as resolved, you describe how the incident was contained and resolved. If it occurs again, bring it back with Reopen.
  4. Complete post-incident review: record the cause as well as lessons learned and consequences. If the incident shows that a requirement was not met, record a Finding from the incident; it is then handled further in the register of findings.

If personal data is affected, you decide under Reporting obligation (data protection) whether a report was made (date, recipient, reference) or why no report is needed.

Reports to authorities

If you have chosen obligations under ISMS settings › Incidents › Incident management in the Reporting obligations to authorities section, the responsible person decides for each incident under Check reports to authorities which bodies are notified, or justifies why no report is needed. For each report, a task is created with the statutory deadline, counted from the time the incident was noticed or from the previous report:

  • BACS (cyberattacks on critical infrastructure): report within 24 hours, completion within 14 days if details were missing.
  • FINMA (cyber attacks): initial notification within 24 hours, report via the EHP within 72 hours, root cause report after the case has been dealt with.
  • DORA (major ICT-related incidents): initial notification within 4 hours of classification as major, at the latest 24 hours after becoming aware, intermediate report within 72 hours of the initial notification, final report within one month of the last intermediate report. As the due date for the initial notification, Varmo sets the 24-hour limit from becoming aware; you monitor the 4 hours from classification yourself.
  • NIS2 (significant incidents): early warning within 24 hours, notification within 72 hours, final report at the latest one month after the notification.

For each report, record the time and the reference / case number. Varmo then creates the next stage.

What happens next

  • New reports appear for the incident team as the task “Assess report”.
  • The responsible person receives the tasks for containment and resolution, for the reporting obligation and for the post-incident review.
  • An incident can only be closed once a decision has been made on reports to authorities and no report is still open.
  • Closed incidents cannot be changed and appear in the next management review.

Frequently asked questions

Can I delete a report?

Only as long as it has not been assessed, for example in the case of an accidental or duplicate report. Assessed incidents are always kept as evidence.

Do reporting people see all details of the incident?

No. Reporting people see their report and its status. Only the incident team and the responsible person see the log, immediate measures and reports to authorities.

Are there internal deadlines for handling?

No, Varmo does not track internal deadlines. Varmo only sets due dates for the statutory reports to authorities (BACS, FINMA, DORA, NIS2). Statutory deadlines also apply to reports under data protection law, which Varmo does not track as due dates (see “Deadlines in data protection” above).