Day one
The induction covers what's sensitive, how it can be shared, and who to tell if something goes wrong.
Sam's journey · On the job (delivery) · Lesson 8
It got out
Before you start
In the story
The drawings got out in a day. Nobody said a word. On opening day, someone else was running the building.
Back to the story
The right way
Monday morning
The engineer tells Sam within the hour, and nobody gets shouted at for owning up. Sam follows the plan: stop it spreading, work out what went, and tell the client the same day.
Monday
The client hears it from us, first. What went wrong goes into the next induction.
Nobody said a wordA forum, a ransom note, and the client finding out from someone else.
Told within the hourStopped, assessed, and the client told the same day, by us.
Think like Sam
Do you know who to tell, and how fast, if sensitive information gets out? Does everyone on site? If it isn't in the induction, it isn't in anyone's head.
Continue Sam's journey
Story 9: Signed out, signed for
Handover is Friday. Dave has 2,000 files and a plan to send all of them.
The right way, explained
Some buildings in town need a pass. When a pass goes missing, the town needs to know that day, not when someone spots it in the paper.
If you're the project manager
Make it safe to own up. The person who reports a mistake within the hour is your best defence. The one who hides it for ten days is your worst.
In the town See it in the town: the alarm's going off at the town gate. What happens first?
Sam's view: the alarm at the town gate. Stop it, work out what's gone, tell the client. In that order, and fast.
- 1 The alarm at the town gate: drawings showing how the new centre is controlled have left the building. A pass is missing from the board.
- 2 What happens next is written down before it's needed: stop it, work out what's gone, tell the client the same day, then fix whatever let it out.
- 3 Everyone on site knows who to tell, because it was in their induction.
This is a Security Incident Response!
Who's told, how fast, and what happens next when sensitive information gets out.
For the audit What the auditor will ask
- Show me how a security incident is reported and handled.
- Has anyone used it, and what changed afterwards?
For the audit What good evidence looks like
- A security plan with an incident procedure.
- Induction records that cover it.
- An incident log with actions and lessons.
ISO 19650 When information gets out
ISO 19650-5 expects a security-minded approach on sensitive assets, including a plan for what happens when something goes wrong: how it's reported, how it's contained, and who's told.
| The plan says | In plain words |
|---|---|
| What's sensitive | So people know before they share |
| Who to tell | A name, not "IT" |
| How fast | Hours, not days |
| What happens next | Contain it, assess it, tell the client, learn from it |
Based on the ISO 19650 series: the ideas come from the standard; the plain-English wording, examples and advice are InfoTown's. ISO 19650 is © ISO and BSI. You'll hear the same language across the industry. Read more for free in the Information Management Initiative (IMI) Framework guidance from BSI and nima. For the full requirements, use the standard itself.