Compliance | mvdm.io

Purpose

This Policy makes sure that Tidewell IT detects, handles, and learns from security incidents quickly and in the same way every time, and that it meets its duties to customers and authorities.

Scope

This Policy covers every event that threatens the confidentiality, integrity, or availability of our information, our services, or our customers' environments, and everyone who detects or handles one.

Policy statements

Definitions

A security event is an observation that may point to a problem. An incident is an event that harms, or is likely to harm, information or services.

Detection and reporting

Everyone reports a suspected event to the Service Desk at once. Monitoring alerts are handled by the on-call engineer.
Every incident is logged in the Incident register, whoever finds it.
Reports are accepted by phone, by email, and through the ticketing system, around the clock for Critical incidents.

Classification

Each incident is classified as Low, Medium, High, or Critical.
Critical is acknowledged within 30 minutes at any hour, High within 2 hours, Medium by the next working day, and Low within 5 working days.

Response and escalation

The Incident Coordinator leads the response to Critical and High incidents and keeps a running log.
The Incident Coordinator informs the Management Board of every Critical incident.
Customers affected by a High or Critical incident are told what happened, what is being done, and when the next update follows.

Personal data breaches

The Data Protection Officer assesses a suspected personal data breach within 24 hours of detection.
As controller, Tidewell IT notifies the Autoriteit Persoonsgegevens within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights.
As processor, Tidewell IT tells the affected customer without undue delay and within 24 hours.

Significant incidents under the Cbw

For a significant incident the Cbw requires an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.
The Incident Coordinator decides whether an incident is significant and starts the clock.

Evidence preservation

Evidence is preserved before systems are changed, with a record of who collected it, when, and how.
Evidence is stored in a restricted location and is kept as long as the incident record, which is 5 years.

Logging and monitoring

Security logs are kept for 12 months, with synchronised clocks, and are protected against change.

Learning

A review follows every High and Critical incident within 10 working days and raises Findings for what must improve.
Lessons are shared with the teams concerned and are added to the incident handling instructions when they change the way we work.

Roles and responsibilities

The Incident Coordinator owns this Policy and leads the response. The Service Desk receives reports and logs incidents. The Data Protection Officer assesses personal data breaches. The ISMS Manager follows up Findings. The Management Board decides on matters that reach beyond the technical response.

Exceptions

The response times are not subject to exceptions. Other deviations need a written request to the ISMS Manager that states the reason, the risk, and an end date.

Compliance and enforcement

Concealing an incident is a breach of this Policy and leads to disciplinary measures under the HR process. Response times are measured and reported to the Management Board.

Review

The Incident Coordinator reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.

Incident Response Policy