Insurance information security
IS-04Draft
Rehearse response and assess notifications
How Leela would run itEvent-driven · at a cybersecurity event and response exercise
Proposed stepsThe requirement
Invoke the incident plan, preserve evidence and involve security, legal and accountable executives. Determine regulator and other notification duties, including triggering facts and time limits, using the applicable rule. Record filing decisions and receipts.
- Before this work
- An approved incident plan and designated responders Event evidence and reviewed notification rules for the affected scope
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
How Leela would run it · proposed steps
- LeelaAssemble the incident timeline and preserve links to source evidence.Proposed step
- LeelaPrepare a notification assessment packet and draft communications, then track approved actions and receipts.Proposed step
- Incident commanderThe incident commander and legal reviewer decide response actions, notification duties and release of communications.Your team decides
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Incident timeline, notification assessment and exercise findingsControlled record with date, owner, source and review history
Evidence
Incident timeline, notification assessment and exercise findings
Insurance information security §3.4
1
of 1 record
The steps are the library’s proposed workflow for this obligation: a description of the work, not a run. The records are its evidence in the library.