Internal incident reporting: who to tell and what happens next
Internal incident reporting process: why every SME needs a clear path
An internal incident reporting process tells employees whom to contact when something looks wrong with email, payments, laptops, or access, and what happens in the first hour without blame. In a Swiss company with 20 to 250 staff there is rarely a 24/7 security operations centre; the path usually runs through IT, an external MSP, HR, or a named deputy. The goal is speed and consistency, not a perfect ticket system on day one. This is separate from reporting a cyberattack to BACS under the critical-infrastructure duty, which most SMEs do not have, and separate from notifying the FDPIC about a personal data breach.
If someone almost paid a fraudulent invoice, your finance team may already know the pattern from invoice fraud with a changed IBAN. Internal reporting catches the cases that never reach accounts payable, such as a clicked phishing link or a lost device.
Define one front door
One mailbox, phone extension, or chat channel for security and IT incidents. Publish it in the intranet and onboarding pack.
Name a backup
When the IT contact is on leave, a second person or your MSP ticket queue must accept reports.
Describe what to send
Screenshot, time, what was clicked or paid, and whether passwords were entered. No need for a novel.
Acknowledge quickly
Auto-reply or same-day human reply so reporters know the message was not ignored.
Log and close
Short record for repeat patterns, insurance, and training plans.
What counts as a reportable security incident internally
Use a practical list staff can remember: suspicious email or text, unexpected MFA prompts, malware alert, lost or stolen company device, shared credentials used oddly, payment instruction that feels wrong, or physical tailgating. Data protection incidents such as email to the wrong person may use the same front door but need a privacy lead in the loop for FDPIC questions later.
What should not go to the security address
Slow printers, missing software licences, or “I forgot my password” belong in normal IT support, not the incident channel. If every ticket hits the same address, people miss the real alarm. On the wiki page, write two lines: “security and fraud here” and “everyday IT there”. HR matters such as harassment stay with HR, even when the mail looked suspicious.
Roles when nobody is a full-time CISO
| Role | Typical task in reporting |
|---|---|
| Employee | Report early, preserve evidence, change password if told |
| IT or MSP | Triage, contain, reset access, check logs |
| HR | Support if harassment or insider angle |
| Management | Decide on external counsel, police, insurer |
| Privacy contact | Separate track if personal data leaked |
The first hour after a report
- Acknowledge
Auto-reply or short call: the report arrived.
- Contain
Block links, isolate accounts, take devices offline, stop payments if still possible.
- Scope
Who clicked, which mailbox, forwarding rules, which payments.
- Communicate
Tell affected people what to do now, without an alarming all-staff email.
- Log
Date, channel, actions, open points for insurance or review.
An external MSP needs a named person in the company who can stop payments or approve password resets. Without that contact, the ticket waits until someone from management is online.
A made-up example: Friday morning helpdesk
A made-up example: a 60-person services firm, no real names. On Friday, an assistant forwards a suspicious “password expiry” mail to the published security address. The MSP acknowledges within two hours, blocks the link domain, searches mail logs for other clicks, and asks three people to reset passwords. No payment was involved. The log entry feeds a 30-minute slot in the next quarterly awareness refresh. The assistant receives thanks, not a warning letter.
When police, the bank, or insurance join in
If money already left the account, contact the bank and police using your bank’s process, and keep the internal report running so IT can secure the mailbox. Suspicion without payment usually stays internal; police are optional. Cyber insurance: many policies require prompt notification; the exact deadline in your contract was not verified here. BACS: voluntary fraud reports from individuals and organisations are possible (BACS half-year report 2025/2 describes voluntary reports); the internal path is still the first step so IT can act.
What a good process deliberately does not do
It does not use phishing simulation results to rank individuals in performance reviews; Swiss practice expects prior notice and proportionality under workplace law, as an orientation not legal advice. It does not promise “no consequences” for every mistake, but it does promise that reporting is safer than hiding. It does not replace police or bank contact when money moved.
Named reports or anonymous ones
Most firms want a name to match logs. Still add one intranet line: “report anonymously rather than not at all.” A web form without a mandatory name field, or “you can also call us”, lowers the barrier. HR and line managers should not interrogate reporters; IT or the MSP triages.
Testing the path once a year
Send a fake internal test message or run a tabletop: “supplier IBAN changed, what do you do?” Measure whether people know the address and whether the backup contact works. Deloitte’s 2026 figures show regular training in 65 percent of small and 82 percent of medium firms under 250 employees (Deloitte Cyber Study 2026, external measurement); reporting culture is where training meets daily behaviour.
Should employees also report to BACS?
Individuals can use BACS public guidance for fraud. Your company’s first step is still internal so IT can act. Voluntary organisational reports to BACS are possible; mandatory cyberattack reporting applies to critical infrastructure, not most SMEs.
Who documents the incident?
IT or the MSP keeps a short log with date, affected accounts, and actions taken. HR and privacy add only their parts. One shared document is enough for insurance and internal review.
Must every suspicious email be reported?
No. Obvious spam you did not click can be deleted. Report clicks, entered passwords, opened attachments, payment demands, and anything impersonating your own company.
Escalation when the incident touches customer data
If the report might involve personal data leaving the company, add your privacy contact the same day. The FDPIC notification threshold is a likely high risk to individuals, with timing “as soon as possible”, not a fixed 72-hour EU rule. Internal security logging still runs in parallel: contain the mailbox, reset passwords, and preserve headers for IT. The privacy lead decides whether databreach.edoeb.admin.ch applies.
Communication templates that reduce panic
Prepare three short internal lines in advance: “We received your report”, “We need no further action from you today”, and “We need you to change your password via this official link”. Paste them into the intranet so managers do not improvise alarming all-staff emails. External communication to customers waits on facts.
When a formal process is overkill
A five-person office where the owner sits next to IT can start with “tell me or tell the MSP” written on one wiki page. Formalise when you pass roughly twenty staff, add a second site, or onboard people who never see the owner in person.
Training that embeds the reporting path
Live security awareness covers what to report, what not to forward, and how incidents are handled afterward. Sessions run one to two hours with follow-up, remote or on-site in Switzerland, as described on security awareness training. In the session a simple poster with the report address and one example screenshot is often enough for people to recognise. Encourage reports explicitly, even when the suspicion turns out to be nothing.
Written by
Aurum Avis Labs
Builds and ships at Aurum Avis Labs. Writes here about what we learn working with founders and SMEs in the DACH region.
Related Articles
You might also be interested in these articles
