Incident response fails in the paperwork, not the panic
Most teams handle the technical response well. What breaks is everything that has to be true afterwards — who approved containment, what evidence was collected, which control was actually improved, and whether the residual risk was ever accepted by someone senior enough to accept it.
✗Life on spreadsheets and inboxes
- The incident log lives in one workbook, the evidence in a shared drive, and the approvals in an email thread nobody can find.
- Lessons learned get written once, filed, and never turn into a control change.
- Nobody can answer “how much risk did we actually retire?” with a number.
- The audit trail is whatever people remember, reconstructed under time pressure.
- Reporting clocks start ticking while the team is still deciding who owns the record.
✓Life on Onva Incident Command
- One record per incident carrying timeline, evidence, root cause, actions, approvals and sign-off together.
- Lessons learned are structured fields that open control improvements and risk register updates automatically.
- Inherent versus residual risk is calculated, aggregated and shown as a percentage the board understands.
- Every view, search, export and field change is written to an append-only log with its session.
- Ownership and the approval chain are set the moment the incident is declared.
Every stage of the response, already in the product
Nine screens, one continuous thread. Scroll through the workflow the way your team lives it.
The register that never loses an incident
Every recorded cyber incident in one filterable table — ID, name, severity, status, residual risk, type, declared date, review date and business unit. Saved views for Open, Under Investigation, Contained, Recovery, Closed, Critical & High Severity and My Incidents mean each role opens straight into their own queue.
Open work, isolated on one screen
The Open Incidents view strips the register back to everything that has not reached Closed, with overdue actions flagged in red on the row itself. Stand-ups run off this screen instead of a status email, because the count in the sidebar is the same number the CIO sees.
Lessons learned that actually close the loop
Each incident carries a structured post-incident record: what worked well, what didn’t, the gaps found, the actions raised and the controls changed — with a sign-off position of Pending, Partial or Complete. The report exports as a formatted pack for your audit committee in a single click.
Risk reduction you can prove, not assert
Movement from inherent to residual risk, incident by incident, with the reduction only counted where the control improvements behind it have been verified. Aggregate reduction, inherent score, residual score and the count of residual High or Critical items sit across the top as live figures.
Roles and approvals modelled on your real sign-off chain
Six role profiles with explicit permission sets — the Senior Cyber and InfoSec Specialist owns response end to end, the IT Team Lead approves technical remediation, the CIO accepts residual risk and closes, IT Support records timeline and evidence, and the Auditor gets read-only across everything including the trail.
An audit trail that cannot be quietly edited
Two append-only stores: an activity log of every sign-in, page view, search, record change, approval, export and upload; and a field-level data audit trail of every value that changed. A refused access attempt is itself recorded as a security event. Filter by user, date range, activity type or free text, then export to CSV.
Take the full tour
Six screens from the working platform. Sensitive record content has been masked for the web.
Everything a regulated incident function needs
Guided declaration
A new incident captures type, severity, affected system, business unit and owner up front, so the record is complete before triage starts.
Reporting clocks
Declared date, review date and status transitions are timestamped, giving you defensible evidence against notification timeframes.
Investigation workspace
Timeline entries, evidence attachments and root-cause analysis live on the incident, not in a separate folder.
Approval gates
Pending Approval is a real state. Containment and closure require the right role to sign, and the signature is part of the record.
Risk matrix & workflow config
Administrators tune the severity model, the risk matrix and the reference data without a code change.
Reference data
Incident types, business units, systems and root-cause categories are managed centrally so reporting stays comparable year on year.
Export centre
Board packs, lessons-learned reports, register extracts and audit logs export as CSV or formatted documents.
Light and dark
A full dark mode for the security operations team who live in the product at 2am.
Register integration
Risk register updates raised during lessons learned flow straight into the Onva Risk Management platform.
Assurance is the product, not a feature of it
Everything below is enforced by the platform. None of it depends on a person remembering to do it.
From kick-off to live in weeks, not quarters
Model
We map your severity scale, risk matrix, business units, systems and approval chain onto the platform’s reference data.
Configure
Roles are mapped to your identity provider groups. Workflow states and review periods are set to your policy.
Migrate
Historic incidents and open actions are imported so the register starts complete, with the audit trail intact from day one.
Operate
Your team runs live incidents in the product, with Onva alongside for the first cycle of lessons learned and board reporting.
Straight answers
Yes. The lifecycle includes reporting states and timestamped transitions, and the register carries the declared date, review date and business unit needed to evidence a notification decision. Reference data and workflow are configurable, so the states can be named to match your internal breach-response procedure and reporting obligations.
The hosted deployment uses Microsoft Entra ID single sign-on. Portal roles map to group membership, so joiners, movers and leavers are handled by your existing identity lifecycle rather than a separate user list inside the product.
Both stores are append-only — entries cannot be edited or deleted from the portal, a refused access attempt is itself recorded as a security event, and the data audit trail records field-level before and after values. Everything exports to CSV for an external reviewer.
Yes. Onva deploys the platform into your Azure or AWS tenancy with Australian data residency, or runs it as a managed service on your behalf. In both cases the data stays inside the region you nominate.
Risk register updates raised during a lessons-learned review flow into the Onva Risk Management platform, so an incident that exposes a control deficiency lands in the register with its evidence rather than as a note in a report.
See it running against your own incident history
We will load a sample of your past incidents into a private instance and walk your team through the register, the lessons-learned workflow and the audit trail in forty-five minutes.