Annex A 6.8 - Information Security Event Reporting

The organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.