> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/assurance/incident-follow-up.md).

# Incident Follow-Up

**Open this area:** In the CORTEX menu, select **Assurance & governance → Security incidents**.

Apply actual approved contract rules, retain external notification evidence, and independently verify corrective work.

**Who uses this:** Reviewer, Administrator\
**Open in CORTEX:** `/security/incidents`\
**In-app guide:** `/help?topic=incident-follow-up`

**Expected result:** Incident deadlines, lessons, and due reviews remain attributable after incident resolution.

## Before you start

* Select the correct workspace. Existing Security read/manage permission and complete incident handling apply; selecting an owner grants no access.
* Obtain the actual contract/clause/source revision and approved UK profile. No reporting interval or working-day interpretation is assumed.
* Assign an authorised incident owner and identify a separate contract-rule approver and corrective-action verifier.

## What to do

{% stepper %}
{% step %}

### Approve an actual rule

From Security incidents, open Contract reporting rules.

The proposal page shows workspace/Security management, actual contract/owner, and approved UK profile prerequisites. Complete its validated Contract scope, Clock and profile, and Review proposal steps.

It identifies required inputs, blocks Continue until each step is complete, and has no assumed deadline. Saving retains a complete Draft rule, not a partial empty draft.

The named owner, separate from all proposal authors, later records actual approval evidence.
{% endstep %}

{% step %}

### Open the due action

Open the incident's Reporting deadlines, lessons and corrective actions page.

Find the exact approved rule and enter the actual trigger time and applicability evidence. Saving retains the incident/rule/profile revisions and opens a due action.

Check the calculated deadline.
{% endstep %}

{% step %}

### Record an external notification

Use your approved external reporting process.

Afterwards, record actual notification time, notifying party, destination/channel, and external reference, then explicitly confirm that it occurred.

CORTEX records your evidence and sends no incident message. Corrections append a further reference and reason.
{% endstep %}

{% step %}

### Retain and verify corrective work

Record the lesson, limits, specific action, authorised owner, actual deadline, future review, and approved profile.

The named owner records completion. A separate manager who neither proposed nor completed it independently verifies actual evidence.

Record later review evidence and the next future date.
{% endstep %}

{% step %}

### Recover an uncertain change

Refresh and compare after conflicts; notes remain on the page.

Retry an uncertain response with unchanged values on the same page to reuse its operation ID.

Access loss clears private data. Ask for existing access/owner review rather than bypassing restrictions.
{% endstep %}
{% endstepper %}

## Check the result

* Does the actual contract rule cover the incident and observed trigger?
* Was notification performed outside CORTEX?
* Is verification independent?
* Are action and review deadlines still outstanding despite incident resolution?

## If you get stuck

<details>

<summary>Did CORTEX notify the recipient?</summary>

No. It records the supplied reference and actual external notification time separately from the authenticated recording time.

</details>

<details>

<summary>Does resolving the incident close its actions?</summary>

No. Outstanding obligations, completion, independent verification, and review dates remain visible.

</details>

<details>

<summary>Can a proposal author verify the corrective action?</summary>

No. Verification requires a separate security manager who neither proposed nor completed it.

</details>

## Responsibility and limits

* Rule amendments create drafts and withdrawal is terminal. Neither silently changes an existing obligation.
* Follow-up remains subject to current incident access; no lesser-permission summaries or unscoped counts are published.
* Eight obligations, eight lessons, eight notification references per obligation, and 64 follow-up decisions are supported. Capacity errors retain earlier history.
* Local hashes do not establish independent external audit custody. Actual reporting, approval, and review evidence remains the responsible person's duty.

**Reference and scope:** F23-R03 and F23-R04. Actual contract interpretation, UK profile applicability, and organisational decisions must be supplied and reviewed.

## Related workflows

* [Record and manage a defensive security incident](broken://pages/686a1f32f9bd42ca2b59d170632ad3d57be6a73e)
* [Manage accounts, grants and workspace membership](broken://pages/99c8701bc497eefb32769b668198b1f9f5fc6a93)
* [Preserve an exact revision and manage holds](broken://pages/0185ca5a2331760fb4c59665b8dde7f4d80e0fc6)