Are employees aware of how to report suspected security or data issues?

You ask an employee if they know how to report a security problem and they pause, confused, or suggest 'maybe tell the boss?' No formal reporting channel exists or is communicated. You find no written procedure, email address, or contact person designated for security reports.

You have a single point of contact—often the owner or one IT person—but it's not written down or officially told to staff. An employee might know to call or email one specific person, but new joiners are not told this during induction. There is no standardized form or process; reports are made informally by chat, email, or word-of-mouth.

You have created a simple one-page document with a security contact phone number, email, or Slack channel clearly listed, and it was shared once in an all-staff message or pinned in a common area. Most employees can name the contact, but there is no proof of understanding and no follow-up on whether reports are actually being received or acted upon. The procedure does not explain what to report or what happens next.

During induction training, all new employees learn the reporting procedure and receive written guidance (email, handbook, or poster) showing the contact details, examples of what to report (phishing, lost device, suspicious access), and what happens after they report. The IT person or owner acknowledges receipt of reports and provides basic feedback. You have a simple log or email folder showing reports have been received over the past few months.

You have a formal documented process: security reporting is part of the employee handbook, induction checklist, and refresher training happens yearly. Reports are logged with a ticket number, assigned to a responsible person, and the reporter receives confirmation of receipt within 24 hours and a brief update on resolution. You run a quarterly audit showing all staff have been trained and can describe the reporting process when asked.

Reporting is integrated into your security culture and monitored continuously: employees receive training during onboarding and refresher sessions twice yearly, multiple reporting channels exist (email, phone, anonymous hotline or form, manager escalation), all reports are tracked in a formal system with timelines and metrics, and you measure employee awareness through anonymous surveys showing 90%+ staff know how and when to report. Response times and closure rates are reviewed in quarterly management meetings, and the process is regularly tested with simulated incident reports.