Skip to main content
SOP owner: IT Security — Last reviewed: [Date]

​
What counts as an incident

An incident is any event that has — or could — negatively impact the confidentiality, integrity, or availability of company systems or data. Examples:
  • Suspected data breach or unauthorized access
  • Ransomware or malware infection
  • Accidental exposure of sensitive data
  • Extended system outage
  • Physical security breach
When in doubt, treat it as an incident. It is always better to escalate unnecessarily than to miss a real event.

​
Severity levels

LevelDescriptionResponse time
P1 — CriticalActive breach, ransomware, data exfiltrationImmediate
P2 — HighSuspected breach, significant system outageWithin 1 hour
P3 — MediumIsolated issue, no confirmed data exposureWithin 4 hours
P4 — LowMinor anomaly, no immediate riskWithin 24 hours

​
Response procedure

1

Identify and report

Anyone who identifies or suspects an incident must report it immediately to:Do not attempt to investigate or resolve the incident yourself.
2

Contain

IT Security will assess the situation and take initial containment steps, which may include:
  • Isolating affected systems from the network
  • Suspending compromised accounts
  • Blocking malicious IPs or domains
3

Assess

Determine the scope and severity:
  • What systems or data were affected?
  • Is the threat still active?
  • Is there evidence of data exfiltration?
4

Notify

Based on severity and scope, notify:
  • Affected team leads and management
  • Legal and compliance (if data exposure is suspected)
  • Affected clients (if required by contract or regulation)
  • Regulatory bodies (if required by law)
5

Eradicate and recover

Remove the root cause and restore systems from clean backups or known-good states. Verify integrity before bringing systems back online.
6

Post-incident review

Within 5 business days of resolution, conduct a post-incident review to document:
  • Timeline of events
  • Root cause
  • Impact assessment
  • Actions taken
  • Preventive measures for the future

​
Communication guidelines

  • Do not discuss active incidents on public channels, social media, or with unauthorized parties
  • Internal communications about incidents should be kept to email or direct messages — not Slack channels
  • All external communications must be approved by Legal before sending
SOP owner: IT Security