Chapter 2 - Implement an Incident Response Process
Effective incident response starts with thorough preparation. This includes establishing clear roles and responsibilities, and ensuring that the necessary tools are in place to support the response process.
How to define roles and responsibilities
All Employees:
Report suspected or confirmed security incidents to the IT Service Desk immediately upon discovery.
Cooperate with the Incident Response Team during the investigation and resolution of security incidents.
IT Service Desk:
Receive and document reports of suspected or confirmed security incidents.
Notify the Incident Response Team of all reported incidents.
Incident Response Team:
Assess the severity and impact of reported incidents and determine the appropriate response actions.
Coordinate the containment, investigation, and resolution of incidents, including the collection and preservation of evidence.
Communicate with affected stakeholders throughout the incident response process.
Document all incident response activities and decisions.
Information Security Officer:
Oversee the incident response process and ensure compliance with relevant laws, regulations, and contractual requirements.
Provide guidance and support to the Incident Response Team as needed.
Report significant incidents to executive management and the Board of Directors.