ISO 27001 Built for Annex A incident management · A.5.24 – A.5.28
InfoSec247 takes a security incident from the first phone call through to a closed, audited record — with root cause analysis, corrective actions and a branded report your auditor will accept. No more spreadsheets and shared inboxes.
Corrective & preventive actions 2 of 3
The problem
Most teams already respond well. What breaks down is the record: who decided what, when, on what basis — and whether the corrective actions ever landed. That gap is what turns a well-handled incident into an audit finding.
The platform
Six capabilities that do the heavy lifting. Everything else in the product exists to support them.
A structured form that asks the right questions the first time. Priority is derived automatically from impact × urgency, and every incident gets a unique reference the moment it’s raised.
Every note, status change and assignment recorded newest-first with local timestamps. Back-date an entry to when the event actually happened, not when someone got round to typing it.
CAPA as first-class items with an owner, a target date and a visible overdue flag. Closing one without evidence of completion prompts a challenge, because “done” needs proof.
A structured RCA per incident with a review workflow — submit to a named reviewer, who approves or sends it back with changes. Export as PDF or Markdown when it’s signed off.
Upload files or reference evidence held in Drive or SharePoint as a described link. Archive rather than delete, review the archive, then destroy permanently when retention allows.
Monthly summary, ISO 27001 compliance, management pack, per-incident and RCA reports. Every one carries your logo, company name and document classification.
The feature set
The complete capability list, grouped by the part of the job it supports. Nothing here is on a roadmap — it’s all in the product today.
The core record. Everything an incident needs to be defensible months later.
Structured form covering type, category, impact, urgency, timing and affected assets.
Priority derived from impact × urgency, so it can’t be quietly downgraded.
Human-readable identifiers such as INC-2026-004 for citing in reports.
Open, in progress, investigation, resolved and closed, each stamped as it happens.
Assign a responder and add stakeholders who need visibility; both are notified.
Restrict a sensitive case to the reporter, assignee and named stakeholders only.
Log the recovery point, flag whether the objective was met, and explain it when it wasn’t.
RTOs set per priority, with met-or-breached shown against the actual recovery.
Confirmed breach, notification required, DPO informed and ICO informed, with dates.
Link affected assets, then see every incident that touched a given asset.
Associate an incident with a client, a contact and the specific site affected.
Only an admin, the reporter or the ISM/CISO can delete — and it’s a soft delete.
Turning an incident into lasting change — and proving it happened.
Status-grouped view of every corrective and preventive action across all incidents.
Days remaining against the target date, with a clear overdue indicator.
Attach uploads or links proving an action was done; closing without any prompts a challenge.
A root cause analysis per incident with predefined cause categories.
Submit to a named reviewer who approves or returns it with requested changes.
Tables, headings and formatting, with source view, so AI drafts can be properly edited.
Reviewers see what’s waiting on them across every incident in one list.
Download a branded PDF or copy the whole analysis as Markdown.
Assignees are told in-app and by email when an action lands with them.
AI that does specific, checkable work — metered in credits so the cost never surprises you.
Ask about your own incidents or about best practice. Replies stream as they’re written.
Ground answers in a specific standard such as ISO 27001, uploaded by your administrator.
Generates a first draft from the incident and its evidence, for you to refine.
Summarise an uploaded document or image without opening every file by hand.
Digital PDFs read directly; scanned documents handled with OCR.
Transcribe a recorded call or interview; the result arrives live when it finishes.
Summaries and transcripts become input to root cause generation, not dead ends.
See remaining balance, plus usage by feature and by user. Admin
Documents that leave the building, so they carry your identity and classification.
A full professional write-up with evidence images in an appendix.
The regular management pack, generated rather than assembled by hand.
Framed for the audit conversation rather than internal triage.
Logo, company name and classification on every single document.
Confidential, Internal, Public, Private or your own wording.
Take the underlying incident data out for your own analysis.
Incidents opened by month, plus breakdowns by status, priority and type.
Governance controls for the person who owns the management system.
Company admin, incident manager, incident responder and read-only.
Record who holds CISO, Information Security Manager and DPO.
Invite, change role, suspend, remove and reset passwords.
Who changed what, when, from where — visible to administrators.
Upload your logo and set the company name used across reports.
A bell with unread counts, mark-one-read and mark-all-read.
Creation, assignment, status change, comments and action assignment.
Changes appear for everyone viewing an incident, no refresh needed.
A proper high-contrast dark theme for people working through the night.
Clear trial data and start clean when you go live. Admin
How it runs, and how it connects to everything else you operate.
A separate /api/v1 surface for automated systems.
A machine-readable contract your integrators can code against.
Create tokens in your account; shown once, then stored only as a hash.
Lock a credential to GET requests and to specific source addresses.
Each organisation’s incident data lives in its own database.
Sign in or register with Google, alongside email and password.
Records are withdrawn, not destroyed, and can be restored.
Card payment, invoices and plan changes through a secure portal.
Runs on AWS in the Ireland/UK region on managed infrastructure.
Coming next: Excel export with embedded evidence links, framework selection for Cyber Essentials, SOC 2 and ISO 42001, plus Slack and Google Drive integrations. Items marked Add-on are optional paid extras.
How it works
Raise the incident in under a minute. Impact and urgency set the priority; the reference number and timeline start immediately.
Managers are notified the moment it’s logged.
Assign a responder, add stakeholders, attach evidence and keep notes against the timeline as you go.
Everyone watching sees updates live.
Record the recovery point against your RPO, then complete the root cause analysis and send it for review.
AI drafts it from the evidence if you’d like.
Corrective actions get owners and dates. Close them with proof, then generate the branded report.
The audit pack is a download, not a project.
Built-in AI
The tedious part of incident management is the documentation. That’s exactly where AI earns its place — drafting, summarising and transcribing, while the judgement stays with your team.
“Which incidents this quarter involved a confirmed data breach, and were any reported late?” — answered from your own records, with saved conversation history.
Summarise images and documents, extract text from scanned PDFs, and transcribe recorded calls — then feed all of it into the root cause analysis automatically.
Every AI call is metered in credits with a visible balance. Administrators see consumption broken down by feature and by user.
Northgate Financial Ltd Information Security
Reporting
Reports are generated from the live record, so they can’t drift from what actually happened. Every document carries your logo, your company name and its classification — enforced, not optional.
For developers
A logically separate, token-authenticated API for automated systems — never your login credentials. Create a credential in your account, scope it, and integrate against a published OpenAPI contract.
# Raise an incident from your monitoring stack
curl -X POST https://api.infosec247.co.uk/api/v1/incidents \
-H "Authorization: Bearer $INFOSEC247_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"title": "Edge router saturation",
"type": "availability",
"impact": "high",
"urgency": "high",
"incidentStart": "2026-08-13T00:03:00Z",
"assetNames": ["edge-router-01"]
}'
# → 201 Created
# { "referenceNumber": "INC-2026-004", ... }Security & trust
You’re about to put your most sensitive incident records into it, so here is how it’s built.
Every organisation’s incident data lives in its own database, not a shared table with a filter.
The database is never publicly reachable. Application servers run inside a private network with controlled egress.
Soft deletes throughout, so a mistake is recoverable and the audit history stays intact.
Managed AWS infrastructure in the Ireland region, with a fixed outbound address for your allowlists.
Pricing
Log as many incidents as you need on every plan — you should never hesitate to record something because of the bill. All prices exclude VAT.
Everything you need to run incident management by the book.
For an individual incident manager.
£20 / month
For a small team handling incidents together.
£85 / month
For larger organisations with a dedicated function.
£160 / month
Everything in Standard, plus the full AI toolkit and a monthly credit allowance.
For an individual incident manager.
£30 / month
1,000 AI credits / month
For a small team handling incidents together.
£130 / month
5,000 AI credits / month
For larger organisations with a dedicated function.
£245 / month
10,000 AI credits / month
For enterprises and managed service providers who need more than 10 seats, client and multi-site management, or a bespoke arrangement. Available on Standard or Advanced AI.
Custom pricing
Contact us14-day free trial on every plan. No credit card to start. Need more seats than a plan allows, or a charity rate? Get in touch →
Questions
InfoSec247 was created because no other software handles incidents properly.
It’s built around what auditors ask for: a dated record of each incident, who handled it, the evidence considered, a documented root cause, and corrective actions closed out with proof.
The ISO 27001 compliance report pulls that together in one document. We’d be straight with you though — no tool certifies you. It produces the evidence; your management system and your auditor do the rest.
You can raise your first incident within a few minutes of signing up. Sensible defaults are already in place for categories, priorities and roles.
Setting up branding, recovery time objectives and security appointments is worth half an hour before you go live. There’s a reset option to clear trial data once you’re ready for the real thing.
No. AI features call a managed model to answer your request and return the result. Your incidents are not used as training data.
The AI add-ons are also entirely optional — leave them switched off and no incident content is sent to a model at all.
Your data stays put. Access is restricted until you pick a plan, and everything is exactly as you left it when you subscribe.
Need longer to get a decision through procurement? Ask us and we’ll extend the trial.
Yes. Export incidents as CSV, generate PDF reports for any incident or period, and read everything programmatically through the API.
Excel export with embedded evidence links is on the roadmap.
Never. Incidents are unlimited on every plan, including the trial. Pricing is based on how many people need an account.
Charging per incident would discourage recording the small ones — which are exactly the ones that reveal a pattern.
Start a 14-day trial and log a real incident today. No card, no sales call, no obligation — and your data is still there if you subscribe later.