Development of a Cybersecurity Incident Reporting and Management System

Development of a Cybersecurity Incident Reporting and Management System
Abstract
Cybersecurity incident reporting and management remain fundamental challenges for organizations worldwide, with human factors often determining whether incidents are reported promptly and accurately. Despite advanced technical controls, many organizations struggle to encourage meaningful incident reporting, leading to delayed detection and response. This project presents the design and implementation of a Cybersecurity Incident Reporting and Management System that addresses both technical and human dimensions of incident handling. The system is built on a Flask/PostgreSQL stack and implements the NIST SP 800-61 Revision 3 incident response lifecycle—Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity—integrated with the six functions of the NIST Cybersecurity Framework 2.0 . A role-based access control (RBAC) model supports four roles—Administrator, SOC Manager, Security Analyst, and Auditor—with SQL GRANT/REVOKE-equivalent permissions enforced at the middleware layer . The system incorporates automated severity scoring based on asset criticality, data sensitivity, and threat indicators, following Microsoft Sentinel's multi-factor risk assessment approach . A non-punitive reporting culture is supported through anonymous reporting channels, feedback loops to reporters, and blameless incident investigation workflows aligned with safety science principles . The system provides real-time dashboards, audit logging, and integration hooks for SIEM and threat intelligence platforms.
Keywords: Incident Reporting; Incident Management; NIST SP 800-61; RBAC; SOC Operations; Non-Punitive Reporting
Chapter 1: Introduction
1.1 Research Background
Cybersecurity incident reporting and management represent critical capabilities for modern organizations, yet effective implementation remains elusive. The human ability to recognize and report incidents remains central to effective cybersecurity, but despite advanced technical controls, many organizations still struggle to encourage meaningful incident reporting from employees . Reporting systems in cybersecurity are less mature than in safety-critical domains such as aviation and healthcare, where decades of research have established principles for psychological safety, non-punitive responses, and strong feedback loops .
The operational complexity of incident management has increased substantially. NIST SP 800-61 Revision 3, published in April 2025, represents a significant restructuring from its 2012 predecessor, shifting focus from detection and handling guidelines to recommendations for incorporating incident response throughout an organization's cybersecurity risk management activities . The new lifecycle model integrates incident response across all six functions of the NIST Cybersecurity Framework 2.0—Govern, Identify, Protect, Detect, Respond, and Recover—with continuous improvement and governance as core requirements .
Meanwhile, ISO/IEC 27035-1:2023 provides a complementary international standard for information security incident management, defining key activities including planning and preparation, detection and reporting, assessment and decision, response and recovery, and continual improvement . The standard emphasizes that for any organization seeking a robust cybersecurity program, a structured and planned approach is essential for recording incidents consistently and using appropriate standards for classification and sharing so that indicators can be extracted from aggregated data over time .
1.2 Problem Statement
Current cybersecurity incident reporting and management practices face several critical challenges:
Reporting Deficits: Employees often do not report incidents due to fear of blame, uncertainty about what constitutes an incident, or lack of accessible reporting channels. Without psychological safety, employees may conceal mistakes, fail to challenge poor behavior, or withhold information that could improve security .
Manual Process Inefficiency: Traditional incident tracking relies on spreadsheets or email threads, resulting in information loss, difficulty in tracking status, and insufficient audit capabilities. Automated triage and severity scoring can significantly reduce analyst workload .
Access Control Complexity: Incident data often contains sensitive information requiring granular access controls. Different SOC roles—analysts, managers, auditors—need different permission levels, yet manual enforcement is error-prone and inconsistent .
Fragmented Standards: Organizations must align with multiple frameworks including NIST SP 800-61, ISO/IEC 27035, and sector-specific regulations. Without unified event recording, compliance reporting becomes burdensome and inconsistent .
Learning Closure Gaps: Post-incident activity is often neglected, with organizations failing to convert incidents into preparation improvements. Continuous improvement must become embedded in the incident response lifecycle rather than treated as a terminal phase .
1.3 Research Objectives
This project aims to design and implement a Cybersecurity Incident Reporting and Management System with the following objectives:
1. Implement the NIST SP 800-61 Rev 3 incident response lifecycle with integration into NIST CSF 2.0 functions, providing a structured, repeatable process for incident handling .
2. Provide a role-based access control model supporting Administrator, SOC Manager, Security Analyst, and Auditor roles with SQL GRANT/REVOKE-equivalent permissions .
3. Implement automated severity scoring based on asset criticality, data sensitivity, and threat intelligence indicators .
4. Support non-punitive reporting through anonymous channels, feedback loops to reporters, and blameless investigation workflows .
5. Deliver comprehensive audit logging, real-time dashboards, and integration capabilities for SIEM and threat intelligence platforms.
1.4 Thesis Structure
This thesis comprises five chapters. Chapter 1 introduces research background and objectives; Chapter 2 reviews incident management frameworks, access control models, and behavioral factors in reporting; Chapter 3 presents system design; Chapter 4 describes implementation details; Chapter 5 concludes and discusses future work.
Chapter 2: Literature Review
2.1 Incident Management Frameworks
NIST SP 800-61 Revision 3 represents the authoritative U.S. framework for incident response. Published in April 2025, it performed a full rewrite of previous content to improve clarity and usability while removing outdated material . The revised lifecycle model restructures preparation activities under Govern, Identify, and Protect functions as foundational, while incident-specific activities fall under Detect, Respond, and Recover. A "Lessons Learned" section emphasizes continuous improvement tied to the Identify function . NIST emphasizes that incident response should be integrated as part of broader cybersecurity risk management activities, with flexibility for organizations of different sizes and technology dependencies .
ISO/IEC 27035-1:2023 provides the international standard for information security incident management. It presents basic concepts, principles, and processes with key activities providing a structured approach to preparing for, detecting, reporting, assessing, and responding to incidents, and applying lessons learned . The standard is applicable to all organizations regardless of type, size, or nature, with guidance adjustable according to organizational context . ISO/IEC 27035-2:2024 supplements this with specific guidelines for planning and preparation, including incident management policy, Incident Management Team establishment, and awareness training .