Table of Contents
| Innholdsfortegnelse |
|---|
...
Incident definition
Definition: An
...
incident is an unplanned, disruptive event or failure that affects the software’s performance, functionality, security, availability, or abnormal activity. Incidents often require immediate attention to mitigate their impact.
Nature: Always unplanned and may involve a significant disruption or risk.
Example:
A critical bug in production that causes an application to crash or stop functioning.
A security breach in the software, such as a vulnerability being exploited by external parties.
Server downtime or a system outage that affects end-users.
Focus: The immediate focus of an incident is on fixing the problem (incident resolution), investigating the root cause, and implementing measures to prevent future occurrences (incident management).
Team: The Incident Response Team (IRT)
Incident Management process definition
The Process responsible for managing the life cycle of all Incidents. The primary Objective of Incident Management is to return the IT Service to Users as quickly as possible.
Incident organisation
To see the employees who hold the various roles https://cxschool.atlassian.net/wiki/spaces/GD/pages/57114637
Entity | External System Incidents | Internal System Incidents |
|---|---|---|
Incident Response Team (IRT) | IRM | SO |
| IT OPM |
|
| SAM |
|
Incident Handling Team (IHT) | Other resources needed to handle the Incident | Other resources needed to handle the Incident |
IRT - Roles and Responsibilities
...
Role
...
Description
...
Responsibility
...
Customer
...
Anyone who reports an error in any of our products, can be from Support, Business or from the customer.
...
Report incident to IT Operation Manager in writing, and by phone if critical error.
...
IT Operation Manager/IRT
...
IT Operation / IRT
...
Diagnose and classify the scope of the incident, fix and close error if possible. Notify customer when done.
...
System architect / Lead Developer
...
System architect for the affected product/system. System architect might need to involve Lead Development if needed.
...
...
OSD
...
Orient Software Development working with the affected system.
...
Incident process
...
Roles | Responsibilites |
Incident Response Manager (IRM)
| The Incident Response Manager oversees and prioritizes actions during the detection, analysis, and containment of an incident. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impact to the upper Management. Additionally, they are responsible for understanding the service level agreement (SLAs) in place with third parties, and the role third parties may play in specific response scenarios. Further responsibilities:
|
Incident Handling Team Members (IHT) | The Incident Response Manager (IRT) is supported by a team of technical staff that work directly with the affected information systems to research the time, location, and details of an incident. Team members are typically comprised of subject matter experts (SMEs), senior level IT staff, third parties, outsourced security or forensic partners. Further responsibilities:
|
Notification and Communication
Required notification and communication both internally and with third parties (customers, vendors, law enforcement, etc.) based on legal, regulatory, and contractual requirements must take place in a timely manner.
The Incident Response Manager must report the incident to the senior leadership.
The senior leadership must report any potential breaches and/or incidents involving customer data to the Security Incident Handling Team (SIHT) promptly.
The SIHT All employees who become aware of or suspect an incident must start filling in the incident form, and notify the IRT team
The IRT is responsible for appropriate notification to:
Personnel,
Affected customers and/or partners (within 48 hours, based on Service Level Agreements, based on legal or regularity compliance, whichever is shorter),
Government bodies or officials as required by applicable statutes and/or regulations.
...
The SIRT is comprised of IT management and experienced personnel. The role of the SIRT is to promptly handle an incident so that containment, investigation, and recovery can occur quickly. Where third-party services are leveraged, ensure they are engaged as necessary.
Roles and Responsibilities
Roles | Responsibilities |
Incident Response Manager (IRM)
| The Incident Response Manager oversees and prioritizes actions during the detection, analysis, and containment of an incident. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impact to the upper Management. Additionally, they are responsible for understanding the service level agreement (SLAs) in place with third parties, and the role third parties may play in specific response scenarios.
Further responsibilities:
|
Incident Response Team Members | The Incident Response Manager is supported by a team of technical staff that work directly with the affected information systems to research the time, location, and details of an incident. Team members are typically comprised of subject matter experts (SMEs), senior level IT staff, third parties, outsourced security or forensic partners.
Further responsibilities:
|
Security Incident Handling Team (SIHT) |
|
Escalation Procedure
The escalation procedure shall follow the BIL classification.
...