Security Incident Investigation

This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.

ISO 45001 treats a security incident as a work-related incident like any other once it has, or could have, resulted in harm, which is why this record sits inside the same clause as any safety investigation. What differs is the handling of evidence and personal data, which falls outside the standard entirely.

No jurisdiction regulates a 'security incident' as a named category. What applies instead is the general duty to investigate work-related harm, and separately, the rules governing personal data and evidence gathered along the way.

The form prompts for the facts. Whether the record ends up defensible depends on judgement calls it cannot make for the person completing it.

The record usually exists after the fact; findings concern whether it was completed while the evidence still could be, and whether it stayed factual.

A cold store site found a padlock cut and a pallet of high-value stock missing on a Monday morning. The discoverer, a warehouse supervisor, wrote a thorough factual description, correctly did not confront anyone since nobody was present, and secured the area. CCTV Reviewed was marked yes later that day. Footage Retained was left at no, because the reviewer watched the relevant hour on screen, confirmed a vehicle had reversed up to the yard gate overnight, and moved on to the next task assuming the recording would still be there when needed.

The system's retention cycle was four days. By the time police asked for the footage to support a crime reference, it had been overwritten twice over. The description, the crime reference and the insurer notification were all in order; the one piece of evidence that could have identified a vehicle was gone because reviewing it on screen was treated as equivalent to keeping it.

The record is the easy part once someone is on scene. What fails is the minutes before it is opened and the evidence trail that runs cold once the record is filed and forgotten.

KnowSafe

Holds the incident register against site and area, flags when a control failure has not triggered a Security Assessment review, and tracks restricted access on named records.

KnowQuality

Picks up product integrity findings and turns them into a hold record automatically, rather than leaving the link to be made by hand.

KnowTrain

Connects a confrontation finding to conflict and aggression training due dates, so the response to a lapse is retraining, not a note in a file.

Ella

Nudges CCTV export within the retention window rather than after it, and holds every write to a restricted record for explicit approval.

Scene preservation

Keeping an area untouched after discovery so evidence is not disturbed, distinct from making an area safe, which can involve moving or cleaning things.

Crime reference

The number issued by police once a report is logged, used to link this record, the insurer notification and any later correspondence to the same reported event.

Insider involvement

A finding that someone with legitimate access, rather than an external party, is suspected of causing or enabling the incident, which changes who the investigation can safely involve.

Investigation level

The depth of follow-up required, from a quick debrief through to a cross-functional root cause analysis, set by potential severity rather than actual outcome.

Product integrity affected

A finding that the incident may have compromised product, which routes the record to a hold rather than leaving contamination or tampering risk unaddressed.