ISO Mate tracks incidents from first report to closure through a controlled status workflow, with role based assignments, linked tasks and notes, a full activity timeline, and built in GDPR data breach handling. You manage every incident from the Incidents group in the sidebar.
Create an incident
- Open Incidents from the sidebar Incidents group.
- Use the Create control. A Create with AI option appears when AI create is enabled for your account.
- Complete the incident fields:
- Title: a clear summary of what happened
- Category: Data Breach, Security Incident, System Outage, Policy Violation, or Other
- Severity: Critical, High, Medium, or Low
- Description: the detail of the incident
- Detection Date: when the incident was first detected
- Save. The incident opens with status Open and is given a reference number.
Follow the status workflow
Incidents move through five statuses with controlled transitions, shown as a stepper on the incident detail page. A next action button guides the recommended move.
- Open: can move to Investigating
- Investigating: can return to Open or move to Contained
- Contained: can return to Investigating or move to Resolved
- Resolved: can return to Investigating or move to Closed
- Closed: the final state, with no further transitions
Two transitions require extra information. Moving to Investigating needs at least one assigned user, and moving to Resolved needs a resolution description and a root cause. Closing an incident is only allowed once every linked task is complete.
Assign the response team
Add people to the incident from the Team card and give each one a role.
- Reporter: the person who discovered or reported the incident
- Assignee: the person who investigates and resolves the incident, required before the status can reach Investigating
- Stakeholder: anyone who needs to stay informed
Link tasks and notes
From the incident detail page you can create a new task or link an existing one to track remediation work, and create or link notes to document findings and decisions. The incident shows whether its linked tasks are complete, which gates the move to Closed.
Review the activity timeline
Every change is captured in the incident activity timeline, with the user and a timestamp for each event. This gives you a complete audit trail from creation through to closure.
Handle GDPR data breaches
When the category is set to Data Breach, ISO Mate reveals additional GDPR fields so you can record the regulatory detail:
- Data Subjects Affected: how many individuals were involved
- Data Types Compromised: the categories of personal data involved
- Breach Discovery Date: when the breach was discovered
- High Risk to Subjects: whether the breach carries a high risk to affected individuals, which requires notifying them
- Supervisory Authority Notified: whether the data protection authority has been informed, with the notification date
- Data Subjects Notified: whether affected individuals have been informed, with the notification date
ISO Mate calculates the 72 hour GDPR notification deadline from the breach discovery date and shows a compliance status so you can see at a glance whether action is still required.
Filter, search, and export
Filter incidents by status, severity, category, assignee, or date, and search by title or reference number. Export the current view to CSV for analysis or PDF for audit documentation. The export respects the filters you have applied.
Related articles
- Using Reports and Analytics, including the incident reports dashboard
- Connecting via the MCP Server to manage incidents from AI tools
Feature
Ready to put a structured incident process in place? Start your free 14-day trial.