# Incident management > Record every security and privacy incident, even a minor one, in the Security Incident Register that Québec’s Law 25 requires. - URL: https://nextit.tech/docs/incident-management/ - Language: English - Other language: https://nextit.tech/fr/docs/gestion-des-incidents/ - Publisher: NextIT (https://nextit.tech/) --- # Incident management Record every security and privacy incident, even a minor one, in the Security Incident Register that Québec’s Law 25 requires. Log, review and resolve incidents ## Key capabilities - Incident register with a review workflow - Corrective actions assigned and tracked - Complete audit trail ## Learn more [Open the feature page Log, review and resolve incidents](https://nextit.tech/features/incident-management/) [Ask your AI assistant Use this feature from ChatGPT, Claude or any MCP client.](https://nextit.tech/docs/connect-your-ai-assistant/) ## Handle incidents with a clear, auditable process Record security and privacy incidents, route them through a review workflow, assign corrective actions and keep a complete audit trail from first report to resolution. Incident management In review Review workflow Enabled Corrective actions Tracked Audit trail Complete Incident under review In review Corrective action assigned Open ## Security Incident Register ### What this module is for The Security Incident Register holds every security and privacy incident in your company, from the first report to the final review. Québec’s Law 25 (the privacy law) requires an incident register whatever the severity. Record each incident, even one that seems minor. ### Before you start - Select the `Security Incident Register` card on the dashboard, or select `Report incident` in the Security incidents panel. - Every role can read incidents. Users and Admins record and work on them. Only an Admin can delete an incident. - Gather the facts first: who reported the incident, when it happened and what you saw. ### Report an incident 1. 1 Enter the reporter, timing and description On `Reporter, timing, description`, enter who reported the incident, when it happened and what happened. Select `Next`. 2. 2 Answer the simple questions On `Simple questions`, answer the short questions. Select `Next`. 3. 3 Check the result On `What we worked out`, read the result. Select `Back` to change an answer, then finish the report. ### Find and assign incidents Search the list, or filter it by status and severity. The statuses are: - `Open` - `Under Investigation` - `Contained` - `In Review` - `Closed` - `Reported` Select `Open and assign to me` to take an incident. Change its status on the incident page. ### Work on an incident Open an incident to see its parts: - Events: the log of what happened on the incident. - Comments: every role can add a comment. - Checklist: the response steps. Users and Admins tick each step when it is done. - Evidence: files and links that support the incident. Accepted file types are png, jpg, jpeg, webp, pdf, txt, csv, mp3 and m4a. Users and Admins add evidence, and every role can view and download it. - Corrective actions: the actions that fix the problem. Users and Admins add, edit and delete them. - Severity: Users and Admins can override the severity. Incident page Example Status In Review Assigned to You Corrective actions 2 open Post-incident review Awaiting review Example values only. ### Write the post-incident review After you handle an incident, write its post-incident review. Select `Post-incident` in the Security incidents panel to see the review queue, labelled `Awaiting review`. 1. 1 Write the review Name the root cause. Answer the privacy-impact question and give the reason for your answer. The answer and the reason are both required. 2. 2 Send it for approval Save the review, then send it for approval. 3. 3 Wait for the decision An Admin approves the review or asks for a revision. Every role can see the revisions and the review queue. A review is complete only when it names a root cause, records the privacy-impact answer and gives the reason. ### Draft a breach communication Users and Admins can draft a breach communication for an incident. Check the text, then send the breach email. Law 25 requires prompt notice when an incident presents a risk of serious injury. Notify the Commission d’accès à l’information du Québec (CAI) and the people concerned. **Careful:** This page is product documentation, not legal advice. Ask your legal counsel which notification duties apply to your company. ### Open actions, History log and reports - `Open actions`: the corrective actions that are still open. - `History log`: the event log of all incidents. Select the export option to download it as a CSV file. - Incident report: open an incident, choose a language, then create its report as a PDF. ## Tips - Record each incident as soon as someone reports it. - Check the `Awaiting review` queue every week, so reviews do not wait. - If you connect an AI assistant, it can open or resolve an incident for you. It asks for your approval first. ## Related - [Domain security scan](https://nextit.tech/docs/domain-security-scan/) - [Data subject requests](https://nextit.tech/docs/data-subject-requests/) - [Software and costs](https://nextit.tech/docs/software-cost/) Free posture report ### Is your business exposed? Find out in 5 minutes. Enter your domain. Confirm ownership by email, then get your free security posture & compliance report. [Book a strategic meeting](https://nextit.tech/book-a-demo/) - No card required - Hosted in Canada