Log every incident and keep the records for seven years

Incident Response policy, §10

Every incident, at any severity, is recorded in the incident log with the time of detection, the severity and type, a description, the response actions and their timeline, the root cause, forensics findings where applicable, the remediation and lessons-learned items, and every regulatory and sponsor bank notification made. Incident records are retained for at least seven years and are available to the independent auditor and to the sponsor bank’s compliance reviews.

Continuous

Each incident at detection; records kept seven years from closure

Open the log entry at detection, complete each field as the incident proceeds, close it with the notifications made, and hold the record under the retention schedule.

• Incident log

  One entry per incident with every required field completed

• Retention schedule entry

  Record class, seven-year period keyed to closure, location

Compliance Officer

Leela can keep the log entry current from the incident record, flag fields left empty at closure, and prove retention on request.

Tell Leela about your company to see whether this applies.