Security Incident Response Policy

Version: 1.0 | Last updated: [Date] | Document owner: [Role, e.g., CISO]

1. Purpose

To define the structured process for identifying, containing, eradicating, and recovering from information security incidents, minimizing operational, financial, and reputational impact.

2. Scope

Applies to all employees, systems, data, and vendors with access to [Company Name]'s environment. Covers incidents involving confidentiality, integrity, or availability of information.

3. Severity Classification

• Critical: breach of personal/sensitive data in production, compromise of privileged credentials, or total unavailability of a critical system.
• High: compromise of a non-critical system, successful exploitation attempt without confirmed exfiltration.
• Medium/Low: blocked attack attempts, identified vulnerabilities without confirmed exploitation.

4. Response Phases (based on NIST SP 800-61)

4.1 Preparation:** maintaining playbooks per incident type, configured detection tooling, and periodic response team training.

4.2 Detection and Analysis:** any employee who identifies a potential incident must report it immediately to [channel, e.g., security@company.com / Slack #security-incidents]. The security team determines scope, severity, and whether there is a legal notification obligation.

4.3 Containment, Eradication, and Recovery:** isolation of affected systems, removal of the root cause, and restoration of operations from validated backups where applicable.

4.4 Post-Incident Activity:** lessons-learned report within [timeframe, e.g., 10 business days] after closure, with updates to controls and playbooks as needed.

5. Regulatory and Customer Notification

Incidents involving personal data must be evaluated for notification obligations to the applicable data protection authority (e.g., under GDPR, CCPA, or local law) and affected data subjects, within applicable legal deadlines. Incidents affecting contractual customer data must be communicated per contractual notification clauses (see Vendor Management Policy).

6. Roles and Responsibilities

• Response Lead ([Role]): coordinates the entire response and is the single decision point during the incident.
• Technical Team: executes containment, eradication, and recovery.
• Legal/Compliance: assesses regulatory and contractual notification obligations.
• Communications/HR: manages internal and external communication, when applicable.

7. Testing and Simulations

This policy and its associated playbooks must be tested through tabletop exercises at least once a year.

8. Policy Review

Mandatory review after any Critical or High incident, and at least annually.