Request Trial Get Started

Incident

Expand All

Welcome to the Incident Management User Guide. Incident Management is a critical component of any organisation's risk and governance strategy. In today’s digital landscape, effective incident management is essential for protecting personal data, ensuring business continuity, and maintaining trust. Organisations must be prepared to identify, respond to, and resolve incidents such as data breaches, system outages, or security threats that could disrupt operations or compromise sensitive information.

With the growing complexity of cyber threats, incident management plays a vital role in addressing potential risks, implementing corrective actions, and safeguarding data. By ensuring a structured approach to incident resolution, organisation’s can mitigate the impact of incidents, protect critical assets, and comply with legal obligations. Failure to manage incidents effectively can result in significant penalties, making it crucial to have a proactive and secure approach to both incident management and data protection.

Access to Incident Management is included as part of 9ine’s Privacy Platform and Incident Platform licences. For further information contact [email protected].

Accessing Incident

Upon purchasing 9ine’s Privacy Platform or Incident Platform and its associated features, users can be granted access to Incident. Your organisation’s administrator(s) have the option to allocate permission via User Management, available to administrators in the header.

Granting access to this feature does not automatically provide access to all incidents. However, it allows users to log a new incident. Users must be added as the data protection, IT lead, members, notified user, attachment reviewer of the incident to gain edit access. Owners and members of any risks, issues, lessons or tasks are also granted edit access if the item is associated with the incident. Incidents can be deleted by the owner or your 9ine Platform account administrators. An incident's permissions include:^[c1]

Owner
Member
Data protection lead
IT lead
Notified user
Attachment reviewer
Screening reviewer
Approver

Warning:

When creating a new incident, the logged-in user will automatically be assigned the role of Owner, and this field cannot be changed.

There can only be a single owner, data protection lead, and IT lead of an incident but there are no limits to the number of members or notified users. Each attachment can also have one reviewer. Owners can edit and delete their assigned items, while all other roles have edit rights but cannot delete. When more than two members or notified users are added, the additional user details are combined into a single pill, which can be clicked to view further details. These pills are alphabetically ordered.

Adding and removing notified users

Adding removing notified users forms

To add a notified user, use the mention function in the “Additional Notes” featur

To add a notified user, use the mention function in the Additional Notes feature.

To begin, click the @ symbol on your keyboard and type the first name of the user you wish to mention.
A user can be mentioned at the start, in the middle, or at the end of the entered text.
To remove a user as a notified user, simply delete their name from the relevant note.
Mentioning a user sends an in-Platform notification and an email unless the user has disabled email notifications.
The email notification sends a complete copy of the text entered by the user in the 9ine Platform, to the user’s registered email address.

Understanding how to create an incident

Begin by clicking New Incident, to get started. You will then be presented with the Assess New Incident popup, which displays four fields:

Incident title
Person reporting the incident
Email address of the reportee
Telephone number of the reportee

Two of the four fields are mandatory when creating a new incident area including: incident title and person reporting the incident. On entering the required fields, you have two options:

Save & Close: Saves the information, creates the incidents, and returns you to the incident log.
Save & Add Details: Saves the information and navigates you to the Background step of the incident form.

Creating a new incident or editing an existing one

When creating a new incident or editing an existing one, you will be navigated to the form and presented with four headers, including:

Background
Investigation
Risk & Impact
Outcome & Closure

The title of the incident is consistently displayed at the top of the form, and to the right, a unique reference number is provided. This number is prefixed with INC and followed by a unique identifier (calendar year, month, date, and a unique reference number) that cannot be edited.

For new incidents, only the Background step will be enabled by default. Users must first answer the question, Will an incident assessment be completed? in the Screening Outcome section before they can proceed. This question allows organisations to conduct a preliminary assessment before deciding whether a full incident evaluation is required.

On selecting Yes, you must enter a date in the Completion required by field. Once this is done, the Save & Exit button will change to Save & Next, allowing you to navigate to the Investigation step of the incident form.

On selecting No, additional fields will appear, including an explanation text box, a Screening review required by field, a Review status dropdown (with options: Incident not required, Incident required, Awaiting review), and a Next Review Date field. The remaining steps in the form will stay greyed out, preventing further progression

On selecting Don’t Know, you must enter the Screening review required by, Review status, and Next review date fields. The remaining steps in the form will stay greyed out, preventing further progression.

In step 2, Investigation, when selecting Security & Systems or Both for the question Incident Classification, an additional step, 2a S&S Investigation, will be added to the incident form.

It is possible to link an incident to a record of processing activity through the Add Details option provided for the question Does the organisation’s record of processing include a processing activity related to this incident?

Third parties, such as data processors, will be identified during the investigation phase of the incident assessment. These third parties are often software vendors or suppliers involved in the transfer of personal data from the organisation to the third party. You have the ability to document processing responsibilities within the investigation step.

Tip:

Tooltips are available throughout the incident form to provide guidance and support, offering helpful insights and additional context for a more informed and accurate assessment.
The S&S Investigation step should be completed by the IT lead identified in step 1, Background.

In step 3, Risk & Impact, when selecting Yes, No, or Possible, sub-questions and an additional comments field will appear. Upon selecting one of these options, the type of Risk Consideration is added to the question: When there is a risk of damage, what is the likelihood of distress being experienced by the data subject? This allows you to select both Impact and Likelihood, which are multiplied to provide a risk score.

A visual representation of the risk consideration is available by clicking the Overview button.

Similar logic is applied in the Communication section of step 3, Risk Consideration.

The final step in Risk & Impact is to determine the assessment outcome by selecting a decision for Assessment Decision and Proposed Action and indicating Yes or No for the Regulatory Authority Informed option.

On navigating to step 4 Outcome & Closure you will be presented with a Summary of Activities table which is used to capture any risks, issues, lessons, and tasks created through the incident assessment process.

At the bottom of this step, you can log the closure information, which includes the Closure Date, Approved By, and Reason for Closure. Similar to the Owner field in step 1, Background, the Closure By field is automatically pre-filled with the logged-in user and is un-editable.

Selecting data subjects and the associated personal and special category data

Within each form in the 9ine Platform (Records of Processing Activity, DPIA, Proc...

Within each form in the 9ine Platform (Records of Processing Activity, DPIA, Processing Operation Assessment, and Incident Management), you can select data subjects along with their associated personal and special category data. On selecting a data subject, their details appear in a pill below the question for easy reference.

Tip:

If a data subject type is not available in the Platform’s default list, you can add it using the +Other function. Any data subjects added this way will be accessible to all users in your organisation for future use.

Each data subject appears in the popup when you click Select Personal Data or Select Special Category Data.

When a user adds any Personal Data or Special Category Data in the corresponding pop-up, a Copy To All button becomes visible. This button allows the user to copy the selected data option to all applicable entries, ensuring consistency and efficiency across the forms.

The secondary number displayed in the Answered pill represents the total number of selected data subjects. For example, if one data subject was initially selected and an additional two were chosen, the count would change from 1 to 3.

Creating an associated risk, issue, lesson, or task (Summary of Activities)

Create associated risk

In the top right-hand corner there is a +New button which provides four options:

In the top right corner there is a +New button which provides four options: New Risk, New Issue, New Lesson, and New Task.

For more detailed information on the specific logs, please refer to their individual user guides:

When creating a risk, issue, lesson, or task the details are automatically added to the Summary of Activities table.

Utilising the additional notes and attachments features

The “Additional Notes” feature allows you to maintain a single repository of info

The Additional Notes feature allows you to maintain a single repository of information related to a moduleName. You can add multiple notes at once using the Save Note function. These notes are saved without the need to click the primary Save at the bottom of the page.

When adding a new note, a record of the user's details, date, and time of entry are added, and the most recent notes will automatically appear at the top of the list. If an individual note is edited, the time and date of the note are updated.

Tip:

Individual notes can only be edited or deleted by the user who originally created the note. However, users have the option to add comments to notes created by others.

Additional formatting functionality is provided in the additional notes feature. If entering large volumes of data, click the Full Screen or Expand Popup options.