Procedure
Security Incident Response Procedure
This procedure defines the end-to-end lifecycle for managing information security incidents: from initial detection and triage through containment, eradication, recovery, regulatory notification, and post-incident review. It establishes mandatory roles, response timeframes, evidence-handling requirements, and escalation obligations that apply to all confirmed and suspected security incidents.
- Type
- Procedure
- Version
- 1.11.9
- Date
- 2026-11-01
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material threat, framework, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose and scope
- 2. Governance
- 3. Incident severity classification
- 4. Detection and triage
- 5. Containment, eradication, and recovery
- 6. Regulatory notification
- 7. Post-incident review
- 8. Evidence and documentation requirements
- 9. Incident-command execution checklist
- 10. Metrics
- 11. Framework alignment
- Licence
Frameworks it maps to
- ISO/IEC 27035-1:2023
- ISO/IEC 27035-2:2023
- ISO/IEC 27035-3:2020
- NIST SP 800-61 Rev. 3
- ISO/IEC 27001:2022
- COBIT 2019
- CSA CCM v4.1
Related documents
- Information Security Policysecurity
- Logging and Monitoring Standardsecurity
- Privileged Access Management Standardsecurity
- Privacy and Data Governance Policyprivacy
- Production Security Requirementsoperations
- Cross-Domain Incident Coordination Procedureresilience
- Emergency Authority Standardgovernance
- Monitoring Integrity and Coverage Standardsecurity
- Security Operations Centre Operating Model Standardsecurity
- Incident Escalation Matrixsecurity
- IT Service Management Frameworkoperations
Next
All Documents