Incidents are for when something goes wrong: a system outage, a data breach, an injury, a near miss. Logging them in Wizard Application gives each one an owner, a deadline and a timeline, and builds the record you need for ISO 27001, Cyber Essentials or your insurer.
Before you start
Incidents are on the Professional and Enterprise plans.
Report an incident
-
Open Incidents
Choose Incidents in the sidebar and select Report Incident.
-
Describe what happened
Give it a clear title and describe what happened and when. List the affected systems, separated by commas, and roughly how many people are affected.
-
Set the severity
Choose the category, impact and severity. The severity sets the target time to resolve it: 4 hours for critical, 8 for high, 24 for medium and 72 for low. An incident that passes its target shows as overdue.
-
Flag security incidents
Tick Security Incident if it involves a possible or actual breach, so it is counted separately in your reports.
-
Assign it
Choose who is responsible for sorting it out and save.
Work it through
Move the incident along with the buttons on its page: Mark as Triaged, Start Investigation, then Mark as Resolved. Add an update whenever something happens. Every update, status change and reassignment goes on the timeline with who did it and when. Mark an update as internal to keep it out of external reports.
Close it properly
Before you can close an incident, record the root cause and the corrective actions you have taken to stop it happening again. Add the lessons learned while they are fresh, then select Close Incident.
Why it insists on a root cause. Auditors want to see that each incident was understood and fixed, not just closed. Recording it at the time is much easier than piecing it together months later.
Report on your incidents
Open the Incident Report and pick a date range. It shows how many incidents you had, how many are still open, the critical and security incidents, your average time to resolve and a breakdown by severity, category and status, followed by the full incident log. Print it or download it as a PDF for your auditor.
For more, see Incident Management.