Initial commit

01-policies/incident-response-policy.md

@@ -0,0 +1,65 @@
+Title: Incident Response Policy
+Document ID: [POL-INCIDENT-001]
+Version: 0.1 Draft
+Status: Draft
+Owner: CISO (Paul Jenkins)
+Approver: CEO (Paul Hague)
+Classification: Internal
+Effective date: [DD Month YYYY]
+Review date: [DD Month YYYY]
+
+# Incident Response Policy
+
+## Purpose
+
+This policy defines BlackDice's high-level requirements for preparing for, reporting, assessing, responding to, and learning from information security incidents.
+
+## Scope
+
+This policy applies to suspected or confirmed security incidents affecting in-scope people, systems, services, suppliers, information, or customers.
+
+## Objectives
+
+- ensure incidents are identified and managed consistently
+- reduce harm through timely containment and response
+- support communication, reporting, and post-incident improvement
+
+## Principles / Policy Statements
+
+Security incidents and suspected security weaknesses must be reported promptly through approved channels.
+
+Incidents must be assessed to determine severity, impact, required response, and escalation needs.
+
+Response arrangements must consider BlackDice's cloud-native services, production environments, telemetry sources, customer impact, and supplier dependencies.
+
+Roles for containment, investigation, communication, and decision-making must be defined and exercised.
+
+Material incidents must result in documented lessons learned and corrective action where appropriate.
+
+## Roles and Responsibilities
+
+- [Role] must oversee incident response arrangements.
+- Personnel must report incidents and cooperate with response activity.
+- Service and system owners must support containment and recovery for their environments.
+- Management must support escalation, communication, and review.
+
+## Compliance / Exceptions
+
+Any deviation from required incident handling expectations must be documented and approved where practicable. Emergency actions taken during incident response must be recorded retrospectively.
+
+## Monitoring and Review
+
+This policy should be reviewed through incident trends, exercises, post-incident reviews, audit, and management review.
+
+## Related Documents
+
+- Information Security Policy
+- Security Incident Handling Procedure
+- Breach Notification Procedure
+- Corrective Action Procedure
+
+## Version Control
+
+| Version | Date | Description of Change | Author |
+| --- | --- | --- | --- |
+| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |