Free preview: Information Security Incident Response Procedure

Overview and Objectives

An effective response limits damage, restores normal operations quickly, satisfies legal and contractual notification duties, and prevents recurrence. This procedure is deliberately simple enough to follow under pressure: report fast, triage against the severity matrix, follow the response phases, write everything down.

The objectives of incident response at [Company Name] are, in priority order: protect people, contain harm to information and systems, preserve evidence, restore service, meet notification obligations, and capture lessons learned. No worker will be penalized for reporting an event in good faith, including events caused by their own mistake; concealment of an incident, by contrast, is a serious violation under the Human Resources Security Policy.

Definitions: Event, Incident, Weakness

Clear terminology prevents both panic and complacency. The [Role, e.g. Information Security Lead] decides whether an event is classified as an incident; until that decision is made, every report is treated as an event.

• Information security event: any observed occurrence that might indicate a security problem, such as a phishing email, an unexpected login alert, a malware warning, or a misdirected email. Many events turn out to be harmless.
• Information security incident: one or more events assessed as having actually compromised, or being likely to compromise, the confidentiality, integrity, or availability of company information or systems. Examples: confirmed account takeover, ransomware, theft of an unencrypted device, exposure of customer data.
• Information security weakness: a flaw that has not yet been exploited, such as an unpatched system or an overly permissive sharing link. Weaknesses must be reported through the same channel and routed to the Vulnerability and Patch Management Procedure.
• Personal data breach: an incident affecting personal data; these additionally trigger the assessment steps in the Privacy and PII Protection Policy.

Roles and Responsibilities

Reporting Channels

Anyone who suspects a security event must report it within 1 hour of discovery using one of the channels below. When in doubt, report: a false alarm costs minutes, an unreported incident can cost the company.