66 lines
2.3 KiB
Markdown
66 lines
2.3 KiB
Markdown
Title: Incident Response Policy
|
|
Document ID: [POL-INCIDENT-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Incident Response Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's high-level requirements for preparing for, reporting, assessing, responding to, and learning from information security incidents.
|
|
|
|
## Scope
|
|
|
|
This policy applies to suspected or confirmed security incidents affecting in-scope people, systems, services, suppliers, information, or customers.
|
|
|
|
## Objectives
|
|
|
|
- ensure incidents are identified and managed consistently
|
|
- reduce harm through timely containment and response
|
|
- support communication, reporting, and post-incident improvement
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Security incidents and suspected security weaknesses must be reported promptly through approved channels.
|
|
|
|
Incidents must be assessed to determine severity, impact, required response, and escalation needs.
|
|
|
|
Response arrangements must consider BlackDice's cloud-native services, production environments, telemetry sources, customer impact, and supplier dependencies.
|
|
|
|
Roles for containment, investigation, communication, and decision-making must be defined and exercised.
|
|
|
|
Material incidents must result in documented lessons learned and corrective action where appropriate.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must oversee incident response arrangements.
|
|
- Personnel must report incidents and cooperate with response activity.
|
|
- Service and system owners must support containment and recovery for their environments.
|
|
- Management must support escalation, communication, and review.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Any deviation from required incident handling expectations must be documented and approved where practicable. Emergency actions taken during incident response must be recorded retrospectively.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed through incident trends, exercises, post-incident reviews, audit, and management review.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Security Incident Handling Procedure
|
|
- Breach Notification Procedure
|
|
- Corrective Action Procedure
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|