Does your organization have a documented process for manually creating and assigning tickets in your ticketing system when technical staff discover potential security incidents or indicators of compromise?

This question assesses whether your organization has formalized the process of tracking and responding to potential security incidents through your ticketing system. When technical staff discover suspicious activities or indicators of compromise, having a standardized process ensures these observations are properly documented, assigned to appropriate personnel, and tracked to resolution rather than being overlooked or handled inconsistently. Evidence could include a documented procedure for security incident ticketing, screenshots of ticket templates specifically designed for security incidents, or examples of redacted security incident tickets showing the workflow from creation to resolution.