How to Create an Issue and Complete the Intake Process
Summary
This article explains how to create a new Issue and complete the Intake process. Intake is the initial step in documenting risk Issues so they can be prioritized, triaged, and addressed for risk and compliance purposes. This guide outlines the required and optional fields, and includes a sample completed Issue.
What is the Intake Process?
The Intake process is used to enter individual risk Issues into the Issue Register. Intake is typically used when:
- An audit or assessment identifies Issues
- A one-off or ad hoc Issue is discovered during daily operations
Steps to Create an Issue
To create a new Issue and complete the Intake process:
- Navigate to the Issue Register.
- Click Create New Issue.
- Complete the required fields listed below.
- Optionally complete the additional fields for added context.
- Click Save to submit the Issue record.
Required Fields
These six fields must be completed during Intake:
Field | Description |
| Title | A short, clear name for the Issue |
| Description | A detailed explanation of what the Issue is and why it matters |
| Reported By | The individual, group, or organization that reported the Issue |
| Reported On | The date the Issue was reported (MM/DD/YYYY format) |
| Source | The origin of the Issue (e.g., "2022 HIPAA Risk Assessment", "Phishing Test") |
| Owner | The person currently responsible for triaging or resolving the Issue* |
*Note: The Owner is typically the person responsible for shepherding the Issue through triage. This may change later in the process.
Optional Fields
These fields are not required, but can provide additional clarity:
Field | Use Case |
| Severity | Initial severity assessment |
| Resolution Criteria | Requirements or recommendations needed to consider the Issue resolved |
| Notes | References to standards, regulations, or any other useful information |
Example: Issue record at INTAKE process.
Title: Firewall Critical Vulnerabilities
Status: CREATED
Reported by: HealthGuard
Reported on: 5/6/22
Source: 2022 HIPAA Risk Assessment
Description: Internet firewalls have multiple remotely exploitable vulnerabilities.
Owner: Jim Jones
Notes:
Subcategory: ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders
Informative References
CIS CSC 4
COBIT 5 APO10.01, APO10.04, APO12.04, APO12.05, APO13.02, BAI01.03, BAI02.03, BAI04.02
ISA 62443-2-1:2009 4.3.4.2
ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2
NIST SP 800-53 Rev. 4 SA-9, SA-12, PM-9