Track Every Incident. Resolve It on Time. Prove Compliance.
Capture incidents the moment they happen, drive them through a five-stage workflow with built-in SLA targets, and gate closure behind root cause and corrective actions. Designed to align with ISO 27001 incident-management requirements.
From Report to Resolution with Compliance Built In
An incident-management workflow that's structured enough to satisfy auditors and quick enough that your team will actually use it.
Five-Stage Workflow
Reported → Triaged → Investigating → Resolved → Closed. Every transition is timestamped against the user who made it.
- Five clear states
- Auto-generated incident numbers
- Assignment & escalation
- Reopen if needed
Severity-Driven SLAs
Critical, High, Medium, Low, each with its own response target. Overdue incidents are flagged automatically so nothing slips through.
- Critical: 4 hours
- High: 8 hours
- Medium: 24 hours
- Low: 72 hours
Mandatory Documentation
Closure is gated behind root cause and corrective actions. Auditors get a paper trail, your team gets lessons learned that stick.
- Root cause required
- Corrective actions required
- Lessons learned (optional)
- Closure-gate enforcement
Pick a Severity. The Clock Starts.
The moment an incident is logged at Critical, the response clock is ticking. Auditors love the consistency; your team loves that the urgency is visible without anyone having to shout.
-
Critical (4h) System down, security breach, regulatory exposure. Drop everything.
-
High (8h) Significant impact on a major function. Same-business-day response.
-
Medium (24h) Localised disruption, workaround possible. Resolved within a day.
A Workflow That Won't Let You Skip Steps
Reported, Triaged, Investigating, Resolved, Closed. You can't close an incident without a documented root cause and corrective actions, exactly what auditors expect to see.
-
Reported Anyone in the workspace can raise an incident, gets an auto-numbered ID and the SLA clock starts.
-
Triaged & Investigated Severity, category, impact, and assignee get set. The investigation timeline records every comment and update.
-
Resolved (Gated) Closure is blocked until root cause and corrective actions are filled in. Lessons learned are optional but encouraged.
An Auditor-Ready Compliance Report
Mark an incident as a security incident and it joins the ISO 27001 compliance report, severity, response time, root cause, corrective actions, full timeline. Hand it to the auditor without spending a week pulling spreadsheets.
-
Security-Incident Flag One toggle on the incident routes it into the ISO 27001 compliance report.
-
SLA Performance Response and resolution times tracked against severity targets, the report shows your hit rate.
-
Annex A.16 Alignment Reporting, response, learning-from-incidents, and evidence collection, the controls auditors actually check.
Everything Your Business Needs
One subscription. One login. Zero limitations. Replace your entire software stack with a platform built to scale with you.
Ready to get started?
Discover how Wizard Application can streamline your team's work. Start your free trial today.
Frequently Asked Questions
The incident-management Feature is designed to align with ISO 27001 Annex A.16 (Information Security Incident Management), severity-driven SLAs, mandatory root-cause and corrective-action documentation, and a dedicated security-incident report. Certification of your organisation against ISO 27001 still requires an accredited audit, but this Feature produces the evidence auditors expect to see.
Critical 4 hours, High 8 hours, Medium 24 hours, Low 72 hours. The clock starts the moment the incident is logged at that severity, and overdue incidents are flagged automatically.
No. Closure is gated behind root cause and corrective actions, exactly what auditors expect to see. Lessons learned is optional but encouraged.
Yes. The eight defaults (IT, Security, Health & Safety, Data Breach, Service Outage, Access Control, Compliance, Other) can be extended with your own categories.