The Person Who Reported It
Someone raised it. What happens to them determines whether anybody raises the next one, and most organisations do nothing at all.
Protection for those who report
Never enforced
As written
Employees who report breaches in good faith will not suffer detriment.
What happens
Stated and untested, because nothing has been reported through the named route.
Where somebody has raised something, the question of their exposure was handled by improvisation rather than by this clause.
The operative rule is: raise it with somebody you trust and hope it does not come back to you.
A colleague mentioned something. The matter is dealt with. Nobody speaks to the person who raised it again, and they draw a conclusion.
The response process in “The Person Who Reported It” needs evidence that can be checked without turning one signal into a conclusion. If see the complete product overview supports fte meaning, managers should validate the record with the person involved, preserve the correction history and distinguish an operational exception from deliberate misconduct before any consequential action.
What they are owed
That it was looked at, and that it is now closed.
For a separate benchmark relevant to “The Person Who Reported It”, consult the CERT-EU security guidance. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
Broadly what happened, which is not the detail and is more than silence.
And a check on whether they are exposed, which is the part that requires somebody to think.
Three things, two of which are a short message.
The exposure question
In a small team, the person who reported is frequently identifiable from the timing alone.
Which means somebody has to ask: can the subject work out who raised this, and if so, what happens next?
Where the answer is yes, the handling changes — the timing of conversations, what is said about how it came to light, and sometimes a direct check on the reporter afterwards.
Almost nobody asks the question, and the reporter is left to manage it themselves.
What silence teaches
That reporting achieves nothing visible.
The person who raised it tells colleagues, accurately, that they mentioned something and heard nothing back. That account circulates and it is the most effective discouragement available.
A two-line message closes it. The absence of the two lines costs the reporting route.
When the report was wrong
It happens. Somebody misread a situation and raised something that turned out to be nothing.
Tell them it was examined and closed with no finding. Do not tell them they were mistaken, do not suggest they should have checked first, and do not make it awkward.
The organisation wants the next report, and somebody who felt foolish does not make it.
The bad-faith report
Rare and real: raised to cause difficulty during a dispute.
The matter itself is handled identically. Anything about the reporter is a separate matter through the ordinary route, not folded into this one — which is the same principle the grading note applies to incidental findings.
What to record
That the reporter was informed, when, and whether an exposure check was done.
Two lines. Their absence is the first thing a later complaint about retaliation will find.
The exposure check
Can the subject work out who raised this? In a small team, usually yes from the timing alone, which changes how the conversations are sequenced and what is said about how it came to light.
Tell them it was examined and closed. Do not tell them they were mistaken and do not make it awkward. The organisation wants the next report and somebody who felt foolish does not make it.
Two lines in the record
That the reporter was informed, when, and whether an exposure check was done. Their absence is the first thing a later complaint about retaliation will find.
The exposure question nobody asks
Can the subject work out who raised this. In a small team the answer is usually yes from the timing alone, which changes how the conversations are sequenced and what is said about how the matter came to light.
Somebody has to ask it deliberately, because nothing in the process prompts it, and the reporter is otherwise left to manage an exposure the organisation created and did not mention.