Incident option lists — cause, PI-category, harm, containment, remediation, and notification taxonomies
Last updated: July 12, 2026 by Steve
Incident Option Lists
Incident option lists are the configurable taxonomies that populate the dropdowns and multi-selects on a privacy incident — the causes, personal-information categories, harm types, containment and remediation measure types, and notification types staff choose from as they document a breach. Editing these lists here changes the vocabulary available throughout the Incidents module.
(screenshot placeholder — capture: the Incident option lists settings with the taxonomy groups listed)
Where to Find It
Open Settings from the app toolbar and choose Incident option lists in the Privacy configuration group. This group is visible only to users who hold the relevant privacy configure permission.
The Lists
| List | Where it appears | Notes |
|---|---|---|
| Cause types | The Cause type field on the Report dialog and Overview tab | Classifies what caused the incident, alongside the free-text cause narrative. |
| PI categories | Categories of personal information involved on Overview | Categories flagged sensitive display a red shield on the record. |
| Harm types | Types of harm on Overview | Records the kinds of harm the breach could cause. |
| Containment measure types | The type field on a containment measure | Classifies actions taken to stop or limit the breach. |
| Remediation measure types | The type field on a remediation measure | Classifies corrective and preventive actions. |
| Notification types | The Add notification picker on the Notifications tab | Scoped to the incident's governing legal authority; used for voluntary notices. |
How It Affects Incidents
- Cause, PI categories, and harm types are chosen on the Report dialog or the Overview tab and become part of the incident's factual record.
- Marking a PI category sensitive is what surfaces the red shield when that category is selected on an incident.
- Containment and remediation measure types populate the type dropdown on the shared measure panel opened from those tabs.
- Notification types appear when logging a voluntary notice; the list is filtered to the incident's legal authority.
Best Practice
Keep each list short and mutually distinct. Reserve the sensitive flag on PI categories for genuinely sensitive information — selecting one raises a red shield on the incident, so over-flagging dilutes the signal.