Incident response policy and operating plan

Incident response policy and operating plan

IR-01 — Incident response policy

[Organisation] prepares for and manages incidents affecting the confidentiality, integrity, availability, privacy or other required properties of its systems. The incident owner coordinates assessment, response, recovery and follow-up. The response protects affected people and essential functions, preserves relevant evidence and supports accountable decisions under the authority recorded for the event.

An incident may arise from malicious activity, error, supplier failure, unintended information processing or another adverse condition. The response process is activated when the reported situation meets the organisation’s recorded criteria or when uncertainty warrants coordinated assessment. Declaring an incident initiates management of the situation; it is not necessarily a conclusion that a breach or legal notification threshold has been established.

IR-02 — Prepare roles and resources

The owner maintains contacts for coordination, technical response, operations, privacy, suppliers, communications and decision authority. The record includes deputies and out-of-hours arrangements where adopted. Authority identifies who can isolate services, change access, invoke recovery, commit supplier support and approve external communication. Constraints and escalation routes are stated before an urgent event requires their use.

Preparation includes access to system descriptions, current inventories, logs, recovery instructions and relevant agreements. The owner establishes an alternative communication route for situations in which normal channels are unavailable or suspect. Exercises test contactability, authority, information availability and decision-making as well as technical actions. Findings enter corrective action.

IR-03 — Receive and assess

The recipient records the report, time, source, observed behaviour and potentially affected systems or people. The coordinator assigns an incident identifier and responsible lead. Initial assessment distinguishes facts, reports, hypotheses and unknowns. The team identifies immediate threats to essential functions or people and the information needed for the next decision.

Classification and priority use [criteria location], considering scope, consequence, continuing exposure and urgency. The lead checks supplier and connected-system implications and identifies privacy or other notification questions. Evidence of a vulnerability is linked to the vulnerability process. The incident record is updated as the scope changes; an early estimate is not retained as a final fact when contrary evidence emerges.

IR-04 — Contain and preserve

The response lead proposes containment actions with their expected benefit and effect on service, information and evidence. The authorised person records the decision, including any urgent standing authority used. Actions may change access, isolate a component, restrict processing, suspend a function or invoke an alternative operating mode according to the actual situation and approved powers.

The team preserves relevant observations, configuration, logs and artefacts with source, time and handling history. Collection considers volatility, integrity, privacy and operational impact. The record identifies actions that may alter evidence and why they were necessary. Evidence custody and specialist investigation needs follow the organisation’s applicable obligations and arrangements.

IR-05 — Investigate, remove causes and recover

The team investigates the event sequence, affected assets and conditions enabling the incident. It tests hypotheses against evidence and records unresolved questions. Remediation addresses the cause and continuing access where identified, including affected credentials, configurations, components and supplier paths. The team checks whether the issue extends to other systems sharing the same dependency or method.

Recovery uses the approved resilience and change arrangements. The owner verifies the trustworthiness of the restoration basis and the required system functions before returning to the authorised operating state. Increased observation or temporary restrictions are recorded with owners and review conditions. Service restoration and incident closure are separate decisions where investigation or stakeholder actions remain outstanding.

IR-06 — Communication and obligations

The communications owner maintains updates for the people making decisions and those affected. Each communication states what is known, what remains uncertain, actions taken and the next update arrangement. External statements are approved through the recorded authority. Supplier and customer communications follow the relevant agreements and the assessed incident scope.

The privacy or obligation owner determines applicable notification and reporting duties using the obligation register, recording jurisdiction, trigger, deadline, recipient and decision basis. This plan does not supply a universal legal notification period. Where specialist interpretation is needed, the coordinator obtains it through the designated route and tracks the decision in time to meet the applicable obligation.

IR-07 — Closure and learning

The incident authority closes the coordinated response when the recorded closure conditions are met or transfers outstanding work to named owners. The record identifies the final known scope, consequences, response timeline, decisions, recovery evidence and remaining uncertainty. A cause not established remains unknown rather than being replaced with an unsupported explanation.

The review examines detection, decisions, technical and organisational causes, communication, recovery and stakeholder consequences. Actions identify changes to requirements, architecture, training, procedures, suppliers or controls. Effectiveness checks confirm whether those changes address the underlying weakness. Incident reporting preserves the distinction between response speed, service restoration and removal of the cause.

Incident record: [IR ID; lead; declaration time; current status]
Observed situation: [Facts; sources; systems; people; uncertainty]
Priority and authority: [Criteria; coordinator; decision powers]
Timeline: [Time zone; actor; observation; action; decision; evidence]
Containment/recovery: [Options; approvals; effects; verification]
Communication/obligations: [Recipients; triggers; deadlines; notices]
Closure: [Scope; cause or unknowns; remaining work; authority]
Improvement: [Actions; owners; dates; effectiveness assessment]