Summary
In short
- A security incident investigation is a record used in KnowSafe that records theft, break in, unauthorised access, tampering or threat. It is built against ISO 45001 cl.10.2 and forms part of the Lone Working and Security programme.
- Raised as soon as the situation is safe. Completed by whoever discovered it.
- The template holds 48 fields across 5 sections.
- Scoring is open cases, where low is good.
- ISO 45001 is occupational health and safety management systems. The international standard for managing worker health and safety. Certifiable, and the backbone of most of this library.
- It connects to the rest of the library: links RCA, Security assessment.
What it is
What it is
What is a security incident investigation?
A security incident investigation is a record used in KnowSafe that records theft, break in, unauthorised access, tampering or threat. It is built against ISO 45001 cl.10.2 and forms part of the Lone Working and Security programme.
When is a security incident investigation completed?
A security incident investigation is completed at the moment the event happens, rather than reconstructed afterwards. Raised as soon as the situation is safe.
When to use it
When to use it, and when not to
This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.
Use it for
- The event or activity this record covers has occurred, or is about to
- The workspace is being set up, or the register needs an entry added or retired
- You are running the Lone Working and Security programme and this is one of its steps
- A linked record needs this one to exist: links rca, security assessment
Not for
- Security Risk Assessment, which assesses the site against theft, unauthorised access, sabotage and product tampering.
- Violence and Aggression Assessment, which assesses roles exposed to aggression from the public, hauliers or colleagues, and the controls in place.
- Lone Working Risk Assessment, which assesses tasks done alone, out of hours or out of sight, and how the person would raise an alarm.
- Anything outside KnowSafe, which belongs in the workspace that owns that process
Standards
What it is built against
ISO 45001Occupational health and safety management systems
The international standard for managing worker health and safety. Certifiable, and the backbone of most of this library.
ISOInternational Organization for Standardization
A voluntary international standard. Widely adopted, often required by customers, and certifiable where a management system standard.
FAQ
Frequently asked questions
What is the security incident investigation template based on?+
It is built against ISO 45001 cl.10.2. ISO 45001 is occupational health and safety management systems. The international standard for managing worker health and safety. Certifiable, and the backbone of most of this library. ISO is international Organization for Standardization. A voluntary international standard. Widely adopted, often required by customers, and certifiable where a management system standard.
What sections does the security incident investigation contain?+
There are 5 sections: header, what happened, immediate response, evidence, cause and prevention. Together they hold 48 fields, 30 of which are required.
How many security incident investigation records should we have?+
This is a singleton. One record per workspace, set up once and maintained, rather than one per event. Other templates refer back to it.
Which programme does the security incident investigation belong to?+
It is part of Lone Working and Security. Tested lone working arrangements and a security position covering theft, access and food defense.
How is a security incident investigation scored?+
Scoring is open cases. Low is good. Scores exist to make the form tell you something, not to produce a percentage for its own sake.
Can the security incident investigation template be changed?+
Yes. Every field, option, score and conditional rule is editable, and the links to other templates come with it. Most teams install it as it is, run it for a cycle, then adjust.
The agents
What the agents do with it
The form is the easy part. Keeping it current, routing it to the right owner and holding the evidence together is the work that actually slips.
Holds the security incident investigation library against your registers, routes each record to its owner, and keeps the evidence trail together.
Coordinates the crew, rolls completion and exceptions into one view, and holds every write for your approval before it touches a record.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Sources
Sources
- ISO 45001 — Occupational health and safety management systems
- ISO — International Organization for Standardization