History

Purpose

This Policy makes sure that Tidewell IT detects, handles, and learns from security incidents quickly and in the same way every time, and that it meets its duties to customers and authorities.

Scope

This Policy covers every event that threatens the confidentiality, integrity, or availability of our information, our services, or our customers' environments, and everyone who detects or handles one.

Policy statements

Definitions

1. A security event is an observation that may point to a problem. An incident is an event that harms, or is likely to harm, information or services.

Detection and reporting

1. Everyone reports a suspected event to the Service Desk at once. Monitoring alerts are handled by the on-call engineer.
2. Every incident is logged in the Incident register, whoever finds it.
3. Reports are accepted by phone, by email, and through the ticketing system, around the clock for Critical incidents.

Classification

1. Each incident is classified as Low, Medium, High, or Critical.
2. Critical is acknowledged within 30 minutes at any hour, High within 2 hours, Medium by the next working day, and Low within 5 working days.

Response and escalation

1. The Incident Coordinator leads the response to Critical and High incidents and keeps a running log.
2. The Incident Coordinator informs the Management Board of every Critical incident.
3. Customers affected by a High or Critical incident are told what happened, what is being done, and when the next update follows.

Personal data breaches

1. The Data Protection Officer assesses a suspected personal data breach within 24 hours of detection.
2. As controller, Tidewell IT notifies the Autoriteit Persoonsgegevens within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights.
3. As processor, Tidewell IT tells the affected customer without undue delay and within 24 hours.

Significant incidents under the Cbw

1. For a significant incident the Cbw requires an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.
2. The Incident Coordinator decides whether an incident is significant and starts the clock.

Roles and responsibilities

The Incident Coordinator owns this Policy and leads the response. The Service Desk receives reports and logs incidents. The Data Protection Officer assesses personal data breaches. The ISMS Manager follows up Findings. The Management Board decides on matters that reach beyond the technical response.

Exceptions

The response times are not subject to exceptions. Other deviations need a written request to the ISMS Manager that states the reason, the risk, and an end date.

Compliance and enforcement

Concealing an incident is a breach of this Policy and leads to disciplinary measures under the HR process. Response times are measured and reported to the Management Board.

Related documents

• Incident Handling Procedure
• Personal Data Breach Notification Procedure
• Information Security Policy
• Personal Data Protection Policy
• Business Continuity and Disaster Recovery Policy

Review

The Incident Coordinator reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.