History

Purpose

This Procedure sets out how we handle an information security incident from the first report to the review afterwards, so that incidents are contained quickly and every one of them teaches us something.

Scope

It applies to every event that may harm the confidentiality, integrity, or availability of our information or of our customers' information, whoever detects it.

Roles

• Reporter: anyone who notices an event.
• Service Desk: receives reports and keeps the Incident register.
• Incident Coordinator: leads the response to Critical and High incidents.
• Data Protection Officer: advises on every incident that involves personal data.
• Management Board: informed of Critical incidents at once.

Procedure

Report and log

1. Anyone who notices an event reports it to the Service Desk, or to the on-call engineer outside office hours.
2. The Service Desk logs the incident in the Incident register within 30 minutes of the report.

Triage and classify

1. The Service Desk classifies the incident as Low, Medium, High, or Critical.
2. The response time depends on the severity. Critical is acknowledged within 30 minutes at any hour, High within 2 hours, Medium by the next working day, and Low within 5 working days.
3. The Incident Coordinator leads Critical and High incidents. The Service Desk leads the others.

Decision points

1. Personal data: when personal data may be involved, the lead calls the Data Protection Officer at once, and the Personal Data Breach Notification Procedure starts.
2. Significant incident under the Cbw: when the incident has a significant effect on a service we provide, the lead starts the Cbw clock with the Incident Coordinator. The early warning is due within 24 hours, the incident notification within 72 hours, and the final report within one month.

Contain, investigate, and recover

1. The responders contain the incident so that it cannot spread, and they preserve evidence before they change anything.
2. They investigate the cause and the extent.
3. They eradicate the cause and recover the affected services. They confirm that the services work and that the cause is gone.

Communicate and close

1. The lead informs affected customers with facts, the effect, and the next update time. Customer messages are agreed with the Incident Coordinator.
2. The lead closes the incident when recovery is confirmed and the record is complete.
3. For every High and Critical incident, a review follows within 10 working days. It raises Findings for the gaps it finds.

Records

• The entry in the Incident register, with its timeline, severity, and decisions.
• The evidence collected and the customer messages sent.
• The review and its Findings. Incident records are kept for 5 years.

Related documents

• Incident Response Policy
• Personal Data Breach Notification Procedure
• Business Continuity and Disaster Recovery Policy

Review

The Incident Coordinator reviews this Procedure at least once a year and after a significant change, and after any incident that shows a step to be unclear.