Where the incident arrives first

The first hint of a security incident is rarely an alert. It is a ticket. "My computer has been so slow since this morning." "I can no longer get into my mailbox." "There was an odd email, I clicked on it." Reports like these arrive at the service desk every day, and most are harmless. But that is exactly where it is decided whether the one that is not harmless is recognized in time for what it is.

The clock starts at detection, not at the alert

Reporting deadlines like the 24 hours under NIS2 run from knowledge of the significant incident. In practice, however, most time is lost not between knowledge and report but before: between the first ticket and the moment someone recognizes the pattern. Three tickets about locked accounts within an hour are a pattern. If they sit in a separate helpdesk tool that shares nothing with the security process, nobody sees a pattern, just three isolated cases.

Handovers between worlds cost the time that is missing later

In many organizations, service desk and security are two worlds with two tools: the ticket lives in the helpdesk, the incident in the ISMS, and between them sits a manual handover, often by email. Every one of these handovers costs context and time. In an emergency both are missing twice over, because recovery also depends on information buried in the ticket history.

A service desk on the same platform

The ITSM module in isidaten is a complete service desk under ITIL 4: tickets with categories, SLA definitions with response and resolution times, problems, changes, releases, a knowledge base and a self-service portal with a service catalog. Tickets also arrive by email. The difference is the foundation: all of it runs on the same platform as incidents, NIS2 reporting and emergency management. A major incident links the affected BCM recovery plans directly, instead of someone searching for them in another system. A suspicious ticket becomes a security incident without information having to switch platforms.

More is shown on the ITSM module page. How the reporting chain continues after detection is covered by NIS2 reporting, and why recovery is a sequence was covered here recently.