Incident Response Policy (aka Incident Response Plan)
The Incident Response Policy specifies exactly how the organization will respond in the event of suspected security incident. This policy defines security incidents, both physical (such as the loss of a laptop) and electronic (a suspected attack or malware infection). This policy includes preparation plans, response activities for different scenarios, and forensics/recovery based on your stated goals. Incident Response Policies are required by a number of regulations and security standards.
An Incident Response Policy is clearly one of a company's most important policies, as it can reduce risk of a security incident as well as reduce data loss and speed recovery times in the event an incident were to occur. Most importantly, an Incident Response Policy outlines roles, responsibilities, and actions to take in advance, so that these decisions don't need to be made during the stress of responding to a security incident.
An Incident Response Policy developed with the EZSecurityPolicy.com application will include the following detailed sections:
1. Overview
2. Purpose
3. Scope
4. Policy
4.1. Types of Incidents
4.1.1. Electronic
4.1.2. Physical
4.2. Preparation
4.3. Confidentiality
4.4. Electronic Incidents
4.4.1. Step-by-Step Response
4.5. Physical Incidents
4.5.1. Response
4.5.1.1. If Loss Contained
4.5.1.2. If Data Loss Suspected
4.6. Notification
4.7. Managing Risk
4.7.1. Risk Assessment
4.7.2. Risk Management Program
4.8. Applicability of Other Policies
5. Enforcement
6. Definitions
7. Revision History
Available in the Silver and Gold Packages only, this is a policy that is intended to be used by technical staff and management only.
Your custom Incident Response Policy will be delivered immediately upon completion of the wizard via email, as both a PDF and an RTF file. RTF files are editable in all major processing programs, including Microsoft Word.
Our security policies were written based on a cohesive and integrated approach using security best practices stemming from the C-I-A triad of confidentiality, integrity, and availability. This approach aligns with both real-world and industry standard-based objectives, resulting in an invaluable resource for your security policy management. A Incident Response Policy developed with the EZSecurityPolicy.com wizard will provide the foundation for a realistic, practical implementation of your IT security policy program.
Please contact us if you have any questions about this policy.
EZSecurityPolicy.com has delivered thousands of IT Security Policies to companies from 5 to 50,000 employees. The management of EZSecurityPolicy.com has over 20 years of successful experience in the field of information security.