ISO 27001:2022 · People controls
ISO 27001:2022 6.8: Information security event reporting
ISO 27001:2022 6.8 covers Information security event reporting. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.6.8, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Staff do not know where or how to report, so events surface late.
A mechanism is to be provided so personnel can report information security events they notice or suspect, promptly and through the right channels. Purpose (stated in ISO/IEC 27002:2022): supports timely, consistent and effective reporting of events personnel can identify. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 6.8.
What evidence supports 6.8?
- Annex A people controlStatement of Applicability entry for control A.6.8, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A people controlA documented reporting procedure naming the point of contact and the channels available, such as a portal, hotline or mailbox
- Annex A people controlAwareness material telling personnel and users what to report, how quickly and where
- Annex A people controlRecords of events reported by personnel, with time from observation to report
- Annex A people controlGuidance instructing people not to test suspected vulnerabilities themselves
Where this requirement comes from
This is our own statement of ISO 27001:2022 6.8, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Staff do not know where or how to report, so events surface late
- The channel is a single person's inbox with no cover
- Users try to verify suspected vulnerabilities themselves
- Human errors and near misses go unreported because reporting is seen as blame
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.