Incident management
Register incidents, follow up actions and keep track of reporting deadlines.
An incident is something that has actually happened: someone clicked a phishing link, a laptop was lost, an e-mail account was taken over or a service is down. A finding is a weakness Värn has observed – an incident is an event you handle. Under Incidents you keep ownership, actions and reporting evidence in one place.
Register an incident
Choose New incident and fill in:
- Title and a short description of what you know and what is still unclear
- Type of incident – for example phishing, malware, unauthorised access or a lost device
- Severity – the same scale as for findings
- Detected – when you became aware of the incident. Reporting deadlines are counted from this point.
- Owner – the person who coordinates the work
You can also create an incident straight from a finding or a notification with Create incident. The details are then filled in for you and the finding is linked to the incident.
Never write passwords in an incident
Descriptions and notes are visible to everyone in the organisation. Name the affected account, but never passwords or other secrets.
Statuses
| Status | Meaning |
|---|---|
| Open | The incident is registered but work has not started. |
| Investigating | You are finding out what happened and how big it is. |
| Contained | The damage has been stopped from spreading, for example by locking an account. |
| Resolved | The cause is fixed and the business is running normally. |
| Closed | Follow-up and reporting are complete. |
Every status change, edited detail, note and linked finding is saved in the incident's timeline with the time and who made the change. The timeline cannot be edited afterwards.
Reporting to authorities
On every incident Värn shows indicative deadlines based on two assessments you make yourselves:
- Is personal data involved? Under the GDPR, a personal data breach must normally be reported to the Swedish Authority for Privacy Protection (IMY) without undue delay and, where feasible, within 72 hours of becoming aware of it.
- Is it a significant incident under NIS2? Organisations covered by the Swedish Cybersecurity Act must report significant incidents in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after the incident notification.
Once you have reported, record it under Register report, with the authority, the time and any case number. Värn never sends anything to authorities itself.
Guidance, not legal advice
The deadlines are there to make sure nothing is forgotten. Whether your organisation is covered by the Cybersecurity Act, and whether an incident is significant, is your own assessment. Check the current reporting route with your supervisory authority.
Incident report input
Incident report input gathers everything recorded about the incident – summary, assessment, deadlines, reporting, linked findings and timeline – in a print-friendly view. Use it when filling in an authority's form or when management needs an overview. Print it or save it as a PDF from your browser.
Who can do what?
- Members, administrators and owners can register and manage incidents.
- Viewers can see incidents but not change anything.
- Administrators and owners can delete an incident, for example a duplicate, and remove a report that was logged by mistake. This is recorded in the audit log.
When an incident is registered, owners, administrators and the incident owner get a notification in Värn, according to each person's notification settings.