Handling information security and business continuity incidents

Section one: detection, identification, analysis and initial response

Step one

An incident may be identified in three possible ways:

1. If a potential incident has been identified:
   1. Ensure that your colleagues are safe
   2. Notify the quality and information security team (QIST)
   3. The QIST works with reporter and colleagues to determine nature of incident
   4. Continue to section one: step two
2. If an incident has been identified outside of business hours by IT helpdesk:
   1. IT helpdesk sends incident communication notification to senior staff
   2. Notify the quality and information security team (QIST)
   3. The QIST works with reporter and colleagues to determine nature of incident
   4. Continue to section one: step two
3. If an individual identifies an incident outside of business hours:
   1. Report it to IT helpdesk
   2. IT helpdesk sends incident communication notification to senior staff
   3. Notify quality and information security team (QIST)
   4. The QIST works with reporter and colleagues to determine nature of incident
   5. Continue to section one: step two

Step two

Is a crime in progress or is there immediate danger?

1. If true:
   1. Call 999 (incident is considered a crisis, see appendix A for definitions)
   2. Continue to section one: step three
2. If there is no crime or immediate danger:
   1. Continue to section one: step three

Step three

Could the incident have significant impact?

1. If true:
   1. QIST notifies quality information security management board (QISMB)
   2. QIST also notifies deputy senior information risk owner (SIRO)
   3. QIST assembles incident team
   4. Start incident reporting form
   5. Continue to section one: step four
2. If the incident won’t have a significant impact
   1. Continue to section one: step four

Step four

Is the incident routine, unexceptional or minimal impact?

1. If true:
   1. QIST notifies deputy SIRO
   2. Start incident reporting form
   3. Continue to section one: step five
2. If the incident is not routine, unexceptional or minimal impact:
   1. QIST notifies deputy SIRO
   2. QIST assembles incident team
   3. Start incident reporting form
   4. Continue to section one: step five

Step five

Is personal data involved?

1. If true:
   1. Add data protection officer (DPO) to incident team
   2. Continue to section one: step five a
2. If no personal data is involved:
   1. Continue to section one: step six

Step 5a

Is the incident reportable?

1. If true:
   1. Inform CEO and group general counsel
   2. Report to ICO/ data processor/ data subjects
   3. Add comms member to incident team
   4. Continue to section one: step six
2. If the incident is not reportable:
   1. Continue to section one: step six

Step six

Is crisis communication required?

1. If true:
   1. Add comms member to incident team
   2. Add HR member to incident team
   3. Maintain continuous internal/ external communications
   4. Continue to section one: step eight
2. If no crisis communication is required:
   1. Continue to section one: step seven

Step seven

Is support for colleagues needed?

1. If true:
   1. Add HR member to incident team
   2. Maintain continuous internal/ external communications
   3. Continue to section one: step eight
2. If no support for colleagues is needed:
   1. Continue to section one: step eight

Step eight

Is specialist technical support needed?

1. If true:
   1. Obtain additional support via deputy SIRO
   2. Maintain continuous internal/ external communications
   3. Continue to section two: containment
2. If no specialist technical support is needed:
   1. Continue to section two: containment

Section two: containment

Step one

Contain the incident.

Step two

Has a crime occurred or been attempted?

1. If true:
   1. Report to police/Action Fraud
   2. Continue to section two: step four
2. If no crime has occurred or been attempted:
   1. Continue to section two: step three

Step three

Is a disciplinary investigation likely?

1. If true:
   1. Continue to section two: step four
2. If no disciplinary investigation is likely:
   1. Continue to section three: recovery

Step four

Is specialist evidence handling required?

1. If true:
   1. Obtain additional support via deputy SIRO
   2. Continue to section three: recovery
2. If no specialist evidence handling is required:
   1. Continue to section three: recovery

Section three: recovery

Step one

Recover.

Step two

Root cause analysis.

Step three

Continue to section four: review.

Section four: review

Step one

Review meeting and improvement, create monthly summary for QISMB.

Maintain continuous internal/ external communications.

Appendices