Procedure
Cross-Domain Incident Coordination Procedure
This procedure defines how an incident is coordinated across domains when more than one response stream is involved: information security, privacy, supplier, AI, operations, communications, legal, and executive. It provides the common lifecycle, the domain-ownership decision rule, the joint command structure, and the hand-off checklists that the domain-specific procedures build on.
- Type
- Procedure
- Version
- 1.1.19
- Date
- 2026-11-03
- Owner
- Resilience Owner
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Resilience
- Review frequency
- Annual and upon material incident, threat, system, supplier, AI, privacy, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Domain ownership decision rule
- Joint command structure
- Coordination lifecycle
- Hand-off checklists
- Severity rules across streams
- Joint decision log
- Cross-stream evidence handling
- Communication boundaries
- Joint post-incident review
- Joint exercises
- Metrics
- Evidence requirements
- Framework alignment
- Limitations
Frameworks it maps to
- ISO/IEC 27035-1:2023, ISO/IEC 27035-2:2023
- ISO/IEC 27001:2022 Annex A.5.24 to A.5.28
- ISO/IEC 27002:2022 5.24 to 5.28
- ISO/IEC 27035-4:2024 (Part 4: Coordination)
- ISO/IEC 27036-2:2022 7.3.3, Table 18, a) 5) ii) (incident management procedure agreed by the acquirer and the supplier)
- ISO/IEC 27701:2025 B.3.12 (PII processor breach notification provisions)
- ISO 22301:2019 §8.4
- NIST SP 800-61 Rev. 3
- China Cybersecurity Law Article 27
- China Data Security Law Article 29 (data security incidents; unofficial DigiChina English translation of the law in force 1 September 2021)
- GDPR Articles 33 to 34
- UK GDPR Articles 33 to 34 (consolidated text retrieved 29 September 2026)
- PIPL Article 57 (unofficial DigiChina English translation, last revised 7 September 2021)
- China Cybersecurity Law Articles 27 and 44 para. 2
- LGPD Article 48
- DORA Articles 17 and 19
- Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 Article 5 (time limits for DORA major-incident reports)
- NIS 2 Article 23
- CER Directive (EU) 2022/2557 of 14 December 2022 Article 15 (critical entities)
- ISO/IEC 20000-1:2018 §8.6.1
- CSA CCM v4.1 SEF-03, SEF-07, SEF-08, SEF-09
- ISO/IEC 27018:2025 A.10.1 (notification of a data breach involving PII)
- NIST AI RMF 1.0 MANAGE 4.3
- ISO/IEC 42001:2023 A.8.4 (Communication of incidents)
- ETSI TR 104 128 V1.1.1 (2025-05) clause 6.6.5
- SANS Critical AI Security Guidelines v1.4 (March 2026), Incident Response and Forensics for AI Systems
- NIST SP 800-84 (2006) Section 2 (tabletop and functional exercises)
Related documents
- Security Incident Response Proceduresecurity
- Data Protection and Privacy Breach Response Procedureprivacy
- Business Continuity and Resilience Frameworkresilience
- Security Incident Reporting and Escalation Procedureresilience
- Crisis Communication Planresilience
- Business Continuity and Crisis Management Planresilience
- Incident Escalation Matrixsecurity
- Security Ticket Reporting Schemesecurity
- Supplier Security and Privacy Assurance Standardsupply-chain
- AI Security and Risk Standardai
Next
All Documents