---
title: "Incident management"
canonical: "https://auditbadger.com/features/incident-management/"
last-updated: "2026-10-19"
---

# Incident management

Security incident lifecycle from first report through post-incident review, with severity classification, severity-based assignment and notifications, and anonymous reporting with a private tracking link.

## What it does

| Capability | Detail |
|---|---|
| **Incident logging** | Central register; incident type, severity and priority set when the incident is reported |
| **Severity classification** | Four severity levels (critical / high / medium / low); response-time targets set per incident type |
| **Response workflow** | Stages from reported to acknowledged, investigating, resolved and closed, each timestamped; resolution notes required |
| **Assignment and notifications** | Incidents assigned by type and severity; the assignee is notified |
| **Anonymous reporting** | Where the incident type allows it, reporters can stay anonymous and follow their report through a private tracking link |
| **Post-incident review** | Lessons-learned stage with required notes |
| **Attachments** | Supporting files attached to the incident, with who added or removed them and when |
| **Audit trail** | Status changes, updates and attachments timestamped and attributed |
| **Trend analysis** | Metrics by incident type, severity and status, plus MTTR and trends over time |

## Standards alignment

| Framework | Reference |
|---|---|
| **ISO 27001:2022** | A.5.24 (Planning), A.5.25 (Assessment), A.5.26 (Response), A.5.27 (Learning), A.5.28 (Evidence collection) |
| **SOC 2** | CC7.3 (Incident response), CC7.4 (Incident recovery) |

## Common incident types

- Data breaches and unauthorized access
- Cybersecurity threats and attacks (ransomware, phishing, account takeover)
- System outages and service disruptions
- Privacy violations and data loss
- Compliance violations and audit findings

## Workflow

1. **Report**: record the incident with type, severity and details, anonymously if needed
2. **Acknowledge**: the incident is assigned by type and severity, and the assignee is notified
3. **Investigate**: add updates and attach supporting files
4. **Resolve**: record resolution notes
5. **Learn**: document lessons learned
6. **Close**: close the incident with its full timeline kept

## Useful links

- Book a demo: [cal.com/mlitwiniuk/live-demo](https://cal.com/mlitwiniuk/live-demo)
- Pricing: [/pricing](/pricing)
- All features: [/features](/features)
- Risk assessment (companion module): [/features/risk-assessment](/features/risk-assessment)
- Business continuity: [/features/business-continuity](/features/business-continuity)
- ISO 27001 deep dive: [/compliance/iso27001](/compliance/iso27001)