Skip to the content

Cases, incidents and notification clocks

Incidents with the clocks each law starts, and actions a second person approves.

In the consoleCases

Choose the regimes that apply
```
vaigil incident regimes eu nis2
```
With none set, a new incident starts with no obligations and no clocks.

Declare an incident

vaigil incident declare --title "Token used from an unknown country" --grade sev2 --finding ID

Start the clocks
A clock starts when somebody decides the organisation is aware, and that decision is recorded with its reason.
```
vaigil incident decide ID aware --because "..."
vaigil incident duties
```

Discharge or waive each duty

vaigil incident discharge ID "NIS2 early warning" --because "sent to the CSIRT"
vaigil incident waive ID "GDPR Article 34" --because "no personal data involved"

Work a playbook

vaigil incident playbooks
vaigil incident propose ID account-compromise
vaigil incident step ID account-compromise STEP done --because "..."

The shipped playbooks cover account compromise, phishing, malware on an endpoint, a lost device and exposed data.

Act on another platform, with a second person

vaigil action add okta-suspend-user --org example
vaigil incident act ID okta-suspend-user okta:USER --because "..."
vaigil incident act-approve ID 1

The exact request is shown before anybody approves it, and it is sent only when a second person does.

The deadlines are the published ones, counted from the decision, not legal advice. Notices to the people affected are drafted, planned and sent with vaigil notify.