ISO/IEC 27001 · Control 6.8 · Priority: critical · Component: People controls

What this control covers

The organization should provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

Why it matters

How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.

How to implement

AWS

Wire GuardDuty, Security Hub and Macie findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run quarterly tabletop exercises.

Azure

Use Defender for Cloud + Microsoft Sentinel with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.

GitHub

Subscribe to secret-scanning alerts and Dependabot security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.

On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

Evidence to collect

  • code_repo_scan — See the iCompaas Evidence library for the canonical source for this evidence type.

Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Information security event reporting.

Quick checklist

  • Policy — Information Security / Management
  • Information — Information Security / Management
  • Management — Information Security / Management
  • Response — Information Security / Management
  • Security — Information Security / Management
  • Application — Information Security / Management

Related articles on this site