# ISO/IEC 27001 6.8 — Information security event reporting

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27001_68_1b8a802f0f-isoiec-27001-68-information-security-event-reporting
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27001:2022](https://support.icompaas.com/support/solutions/c_gen_iso27001) › [People controls](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27001_peoplecontrols)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27001 · Control 6.8 · Priority: critical · Component: People controls

### What this control covers

The organization should provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

### Why it matters

How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.

### How to implement

#### AWS

Wire **GuardDuty**, **Security Hub** and **Macie** findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run **quarterly tabletop exercises**.

#### Azure

Use **Defender for Cloud** + **Microsoft Sentinel** with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.

#### GitHub

Subscribe to **secret-scanning** alerts and **Dependabot** security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `code_repo_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Information security event reporting.

### Quick checklist

-   Policy — Information Security / Management
-   Information — Information Security / Management
-   Management — Information Security / Management
-   Response — Information Security / Management
-   Security — Information Security / Management
-   Application — Information Security / Management

### Related articles on this site

-   [CMMC 2.0 SI.1.210 Identify, report, and correct information and information system flaws in a timely manner.](https://support.icompaas.com/support/solutions/articles/62000229437-cmmc-2-0-si-1-210-identify-report-and-correct-information-and-information-system-flaws-in-a-timely-)
-   [NIST 800-171 3.14.1 Identify, report, and correct system flaws in a timely manner.](https://support.icompaas.com/support/solutions/articles/62000229241-nist-800-171-3-14-1-identify-report-and-correct-system-flaws-in-a-timely-manner-)
-   [NIST 800-171 3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.](https://support.icompaas.com/support/solutions/articles/62000229266-nist-800-171-3-2-2-ensure-that-personnel-are-trained-to-carry-out-their-assigned-information-security)
-   [NIST 800-171 3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat.](https://support.icompaas.com/support/solutions/articles/62000229270-nist-800-171-3-2-3-provide-security-awareness-training-on-recognizing-and-reporting-potential-indicat)