{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:801f657afd613afa2d6a34b2a9198219da7d8f5923ef91d765537765855606a8","slug":"controls-incident-reporting-spillage-response","url":"/assets/agent_workflow-controls-incident-reporting-spillage-response-0e2dd43b.8a697e7dd016aef6.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-incident-reporting-spillage-response","description":"Standing operator workflow that runs on the existing Control item for the incident-reporting and information-spillage control (UC-IR-03; framework nist-800-53 | iso-27001 | nis2, domains incident_management_response) — one recurring workflow instance per operating cycle attaches to and enriches that Control item, never a duplicate. It consumes the prior cycle's carry-forward from the same Control: the last-sweep timestamp from the previous instance's close-and-archive record, plus the still-open corrective-action and obligation Issues linked to the Control. In scope: intake acknowledgment and triage routing across the monitored mailbox, hotline, and service portal; spillage containment/eradication and obligation assessment; and maintenance of the authorities and special-interest-group (SIG) contact register — spanning NIST 800-53 IR-6, IR-7, IR-9, and PM-15; ISO 27001 A.6.8, A.5.5, A.5.6; and NIS2 reporting duties. Named deliverables: the deduplicated intake register and acknowledgment log, the batch routing decision, the spill case with verified eradication, the obligation assessment and exposed-personnel training evidence, the refreshed authority/SIG contact register, the capability-health dashboard, the corrective-action register, and the archived operating record. Out of scope: full containment, investigation, and forensic response for genuine security events — those are handed off to the detect-to-respond workflow (via the route_to_incident_triage routing decision plus the linked intake Issues) rather than duplicated here.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-incident-reporting-spillage-response","capabilities":[],"controls":["UC-IR-03","UC-IR-11","UC-GOV-23"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:801f657afd613afa2d6a34b2a9198219da7d8f5923ef91d765537765855606a8","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-incident-reporting-spillage-response","standards":["nist-800-53","iso-27001","nis2"],"teams":["it","compliance-legal"]},"id":"wf:C23","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC23","slug":"controls-incident-reporting-spillage-response","sourceIds":["iso-27001","nist-800-53"],"sourceUrl":null,"title":"Incident Reporting Channels & Spillage Response","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:166935d9719564a73ed2200b1235851ee4b4d463b17697887db60d45efdee995","properties":{},"sourceDetailPath":"/data/v1/records/wf-c23-d6d82467.json","sourceId":"wf:C23","targetDetailPath":"/data/v1/records/uc-uc-ir-11-6234912d.json","targetId":"uc:UC-IR-11","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:58e0ff48243f302248e65d1afc93091cd050265a7637f573bad13272c3f257ba","properties":{},"sourceDetailPath":"/data/v1/records/wf-c23-d6d82467.json","sourceId":"wf:C23","targetDetailPath":"/data/v1/records/uc-uc-ir-03-477c1ef0.json","targetId":"uc:UC-IR-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c42d5b4356da9cca5f24b15a48ec0ef93e4f7d9c694d7cd2f1b078eb16663f99","properties":{},"sourceDetailPath":"/data/v1/records/wf-c23-d6d82467.json","sourceId":"wf:C23","targetDetailPath":"/data/v1/records/uc-uc-gov-23-e22e7c62.json","targetId":"uc:UC-GOV-23","type":"operates"}],"schemaVersion":1}