Incident Management Policy
Detection, response and management of security incidents
Purpose
Establish standards and procedures for the systematic management of incidents, aligned with the Information Security Management System, minimizing legal, contractual and reputational impacts.
Objectives
- Record and document all incidents consistently.
- Identify, contain and learn from incidents.
- Keep internal and external interested parties informed.
- Document and close analyses with management approval.
- Promptly notify affected customers and regulators.
- Share relevant information with third parties to strengthen cybersecurity situational awareness.
Scope
Applies to all internal incidents, from identification to post-incident review.
Key Definitions
- Incident: An event that causes a service disruption and requires a managed response.
- Crisis: A significant disruption with potential political, legal, financial or reputational impacts.
- Emergency: An unplanned event with a risk of serious harm, deaths or critical disruption of operations.
- IMT (Incident Management Team): Team that manages the incident response in its area or facility.
- BCMS: Business continuity management system.
Roles and Responsibilities
- Incident Commander: Leads the overall management of the incident.
- Incident Management Team (IMT): Coordinates tactical actions, containment, communication and recovery.
- Communications Officer: Manages internal and external communication.
- HR, Logistics, Operations and Security Coordinators: Support with staff, infrastructure, operational continuity and security.
- BCMS Representative and Risk Officer: Risk assessment and coordination of solutions.
Incident Management Process
- Notification and Assessment: Record the incident and assess its severity and potential impacts.
- IMT Activation: Notify and mobilize resources according to the incident level.
- Developing Recommendations: Identify containment and recovery actions.
- Communication: Inform internal and external stakeholders clearly and in a timely manner.
- Post-Incident Action: Declare closure, analyze causes, document lessons learned and update processes.
Incident Classification
- Level 1 (Minor): Limited local impact.
- Level 2 (Moderate): Moderate local impact, visible to the customer.
- Level 3 (Significant): Large-scale incident affecting multiple departments.
- Level 4 (Catastrophic): Critical long-term impact on the business.
Incident Response Plan (IRP)
- Defines roles, responsibilities and steps to contain, investigate and remediate incidents.
- Establishes protocols for coordination with external interested parties and the voluntary sharing of cybersecurity information.
- Covers containment, escalation, notification and structured reporting.
Documentation and Notification
- Record all phases of the incident with the approval of management and the security representative.
- Ensure prompt notification to customers, regulators and relevant third parties.
Testing and Training
- Run simulations, tabletop tests and regular exercises to keep the IRP effective.
- Include coordination with external parties (agencies, industry peers).
Continuous Improvement
- Review and update the program based on incidents, test results and training.
- Ensure alignment with best practices and the requirements of the Information Security Management System.
Monitoring and Review
- Annual review of the program and continuity plans to ensure accuracy, effectiveness and preparedness.
- Validate communication and coordination protocols with internal and external stakeholders.