Triage every reported incident and assign its severity the same day

Incident Response policy, §2.2, §3.2, §4.1

Whoever receives the first report of a suspected incident notifies the Compliance Officer immediately. The Compliance Officer triages it the same business day, assigns one of four severity levels from its impact, scope, and effect on business continuity, opens the incident record, and decides whether the response team is activated. Severity may be raised as facts emerge and is not lowered until containment is confirmed.

Event-driven

Each reported or suspected incident, the same business day

Log the report, classify the severity against the definitions, record the rationale, and activate the response team for any High or Critical incident.

• Incident record

  Time reported, time triaged, severity, classifier, rationale

• Team activation notice

  Message to the response team with the time sent

Compliance Officer

Leela can open the incident record from an alert or report and hold the severity question for the Compliance Officer until it is answered.

Tell Leela about your company to see whether this applies.