Information Security Incident Response Procedure

[Insert Classification]

[Insert Company Logo Here]

Information Security
Incident Response
Procedure

© NT Business Consulting & Training

Document Classification [Insert Classification]

Document Reference ISMS-Doc-A16-2
Version 1
Dated [Insert Date]
Document Author [Insert Name]
Document Owner [Insert Name/Role]

Version 1 Page 1 of 5 [Insert Date]

 Information Security Incident Response Procedure
[Insert Classification]

Revision History

Version Date Revision Author Summary of Changes

Distribution

Name Title

Approval

Name Position Signature Date

Version 1 Page 2 of 5 [Insert Date]

 Information Security Incident Response Procedure
[Insert Classification]

Contents

1 Introduction............................................................................................................................................ 5
2 Incident Response Flowchart................................................................................................................. 6
3 Incident Detection and Analysis ............................................................................................................ 7
3.1 Impact Assessment ........................................................................................................................ 7
3.2 Incident Prioritisation .................................................................................................................... 8
4 Activating the Incident Response Procedure ........................................................................................ 9
5 Assemble Incident Response Team ..................................................................................................... 10
5.1 Incident Response Team Members ............................................................................................. 10
5.2 Roles and Responsibilities ........................................................................................................... 10
5.2.1 Team Leader ......................................................................................................................... 10
5.2.2 Team Facilitator ................................................................................................................... 11
5.2.3 Incident liaison ..................................................................................................................... 11
5.2.4 Information Technology ...................................................................................................... 11
5.2.5 Business Operations ............................................................................................................ 12
5.2.6 Facilities Management ........................................................................................................ 12
5.2.7 Health and Safety................................................................................................................. 12
5.2.8 Human Resources ................................................................................................................ 12
5.2.9 Business Continuity Planning .............................................................................................. 12
5.2.10 Communications (PR And Media Relations) ....................................................................... 13
5.2.11 Legal and Regulatory ........................................................................................................... 13
5.3 RACI Matrix .................................................................................................................................. 13
5.4 Incident Management, Monitoring and Communication .......................................................... 14
5.5 Communication Procedures ........................................................................................................ 14
5.5.1 External Communication ..................................................................................................... 15
5.5.2 Communication with The Media ......................................................................................... 15
6 Incident Containment, Eradication, Recovery and Notification ........................................................ 17
6.1 Containment ................................................................................................................................ 17
6.2 Eradication ................................................................................................................................... 18
6.3 Recovery ....................................................................................................................................... 18
6.4 Notification .................................................................................................................................. 18
7 Post-Incident Activity ........................................................................................................................... 20
8 Appendix A: Initial Response Contact Sheet ....................................................................................... 21
9 Appendix B: Useful External Contacts ................................................................................................. 22
10 Appendix C: Standard Incident Response Team Meeting Agenda ..................................................... 23

Version 1 Page 3 of 5 [Insert Date]

 Information Security Incident Response Procedure
[Insert Classification]

List of Tables

Table 1 Incident Priorities………………………………………………………………………………………………………………………….8

Table 2 Incident Response Team Members……………………………………………………………………………………………..10

Table 3 RACI Matrix………………………………………………………………………………………………………………………………..13

Table 4 Media Spokespeople………………………………………………………………………………………………………………….16

Table 5 Initial Response Contact Sheet…………………………………………………………………………………………………..21

Table 6 Useful External Contacts……………………………………………………………………………………………………………22

Version 1 Page 4 of 5 [Insert Date]

 Information Security Incident Response Procedure
[Insert Classification]

1 Introduction

This document is intended to be used when an incident of some kind has occurred that affects the
information security of [Organization Name]. It is intended to ensure a quick, effective and orderly
response to information security incidents.

The procedures set out in this document should be used only as guidance when responding to an
incident. The exact nature of an incident and its impact cannot be predicted with any degree of certainty
and so it is important that a good degree of common sense is used when deciding the actions to take.

However, it is intended that the structures set out here will prove useful in allowing the correct actions
to be taken more quickly and based on more accurate information.

The objectives of this incident response procedure are to:

• Provide a concise overview of how [Organization Name] will respond to an incident affecting its
information security

• Set out who will respond to an incident and their roles and responsibilities

• Describe the facilities that are in place to help with the management of the incident

• Define how decisions will be taken regarding our response to an incident

• Explain how communication within the organization and with external parties will be handled

• Provide contact details for key people and external agencies

• Define what will happen once the incident is resolved, and the responders are stood down

All members of staff named in this document will be given a copy which they must have available when
required.

Contact details will be checked and updated at least three times a year. Changes to contact or other
relevant details that occur outside of these scheduled checks should be sent to
information.security@organization.com as soon as possible after the change has occurred.

All personal information collected as part of the incident response procedure and contained in this
document will be used purely for the purposes of information security incident management and is
subject to relevant data protection legislation.

Version 1 Page 5 of 5 [Insert Date]