Requirement
"The organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner."[1]
Explanation
An email address and phone number should be provided to all personnel for purposes of reporting actual or suspected information security incidents.
