After reviewing the kinds of technology available and the problems they attempt to solve, the organization should be able to determine the most appropriate detection policy for its networks. Reporting should cover how incidents are brought to the attention of the incident response team. The reporting process should be fast and simple. If end users are expected to report incidents, they should know how and where to report the incident at all times. Any organization that can effectively process an initial report and route it correctly to the team is a candidate for the central notification point.
Some organizations route incident reports through the help desk.
If the help desk is staffed for extended hours support, this can be an effective method of entering the first report. In other organizations, the security guard desk is tasked with receiving initial reports. Still others use a pager system so that employees can contact a member of the team directly. Regardless of where the incident is first reported, it should be reported properly. This often requires an interview with the user reporting the incident.