Incident Response Policy

Inside the document

1. Definitions and severity
2. Preparation
3. Detection and reporting
4. Assessment and escalation
5. Containment, eradication and recovery
6. Communication and notification
7. Post-incident review
8. Records

Plus document control, roles, exceptions, enforcement, review cycle and an auditor evidence checklist.

Sample clause · Containment, eradication and recoveryThe Incident Commander may authorise containment actions, including isolating systems or disabling accounts, without prior business approval where delay would increase harm.

What an auditor will check

A tested plan with named roles, incidents logged and classified, decisions and timelines recorded, notifications assessed and lessons turned into actions.