GRC Incident Management & Breach Response

Frequently Asked Questions About Incident Management and Breach Response

How long do we have to report a security incident under NIS2?

NIS2 Article 23 runs a three-stage clock for significant incidents: an early warning to your national CSIRT within 24 hours of becoming aware, a fuller incident notification within 72 hours, and a final report within one month. Personal data breaches trigger a separate GDPR clock — 72 hours to the supervisory authority — and neither obligation discharges the other, so both need tracking in parallel.

NorthGRC's incident module starts the clock the moment an incident is registered and time-stamps every action taken against it. For personal data breaches specifically, the platform automatically generates the authority-notification and data-subject-notification tasks on the incident, so the relevant deadline isn't something your team has to remember to create manually.

Do we have to report every minor incident, or only the serious ones?

No — regulatory notification depends on severity and specific threshold criteria under each framework, not every logged event. But GDPR Article 33(5) requires documenting all personal data breaches, including the ones you decide not to notify, so under-reporting internally is its own risk.

NorthGRC lets you register every incident regardless of severity, and its task workflow requires a written justification comment before a notification task can be marked as not necessary — for example, low severity combined with strong encryption. That justification stays attached to the incident permanently, giving you a defensible record either way.

How do we manage incidents involving suppliers and vendors, not just internal systems?

Vendor incidents typically get lost in a separate spreadsheet or a supplier's own portal, disconnected from the rest of an organisation's incident history.

NorthGRC lets you register a vendor incident directly on the vendor's own record, or in the central Incidents module, using the exact same React – Respond – Resolve – Done workflow either way. That keeps internal and supply chain incidents in one connected register instead of two, so a pattern across several vendors is visible rather than hidden across separate tools.

Can past incidents actually influence future risk assessments, or do they just sit in a log?

In most tools, incidents are documented and then forgotten — a closed ticket rarely feeds back into how risk gets scored later.

NorthGRC's incident registry feeds directly into risk assessments: when you assess a vendor or system, the assessment view shows the number and severity of its past incidents alongside prior self-assessment results, and this history factors into the vendor's inherited risk. Recurring incidents on the same system or supplier surface automatically instead of needing to be manually recalled from memory.

What does the actual incident response workflow look like, step by step?

A structured response typically moves from identifying what happened, to containing and acting on it, to closing it out with lessons captured — but many teams handle this informally over email and chat, with no consistent record of who decided what.

NorthGRC guides every incident through four states — React, Respond, Resolve, Done — with template-driven fields for description, root cause, and corrective actions at each stage, viewable as a list or a kanban board. This gives every incident, regardless of who's handling it, the same structured and auditable path from registration to close.

How do we prove to an auditor or regulator that an incident was handled properly?

Auditors and regulators want to see not just what happened, but that a consistent process was followed and that decisions — including decisions not to act — are documented and defensible.

NorthGRC automatically timestamps every action, status change, and decision made on an incident, including the specific justification recorded whenever a team decides a notification isn't necessary. When an audit or regulatory request comes in, the answer is an existing structured record rather than a reconstruction exercise pulled together from emails and memory.

Is a GDPR personal data breach handled separately from a general security incident?

A personal data breach is still fundamentally a security incident, just one with extra regulatory obligations attached — NorthGRC doesn't run two parallel systems for it.

NorthGRC registers a personal data breach through the same incident module as any other security event, but automatically adds the GDPR-specific notify-the-authorities and notify-the-data-subjects tasks to that incident. That keeps the 72-hour clock, the decision trail, and the rest of the documentation inside one record instead of splitting compliance paperwork away from the operational incident handling.

Incident Management

Turn Incident Pressure Into Structured, Defensible Response

Guided Incident Response That Supports Sound Decisions Under Pressure

Compliance-Intelligent Breach Handling with Built-In Regulatory Guidance

One Connected Register for Internal and Vendor Incidents

Turn Incident History Into Actionable Risk Intelligence

Audit-Ready Documentation From the First Action Taken