Information Security Incident Policy (example)

1. Purpose. This policy sets how Acme reports, assesses and handles information security events and incidents.
2. Reporting. Every employee and contractor must report a suspected security event to the Security desk immediately and no later than one hour after noticing it, even when unsure. Reports can be made by anyone, including people outside the company, through a public reporting page.
3. Assessment. The Security Officer assesses every report within four hours and classifies it as an event or a security incident, with severity (low, medium, high, critical) and whether it is a significant incident under NIS2 or a personal data breach under GDPR.
4. Response. For a security incident, the incident lead coordinates containment and recovery and records every action with time and owner.
5. Notification. For a significant incident: an early warning to the national CSIRT within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. For a personal data breach that is likely to result in a risk: notification to the data protection authority within 72 hours. The CISO approves every external notification.
6. Lessons learned. Every incident ends with a root cause and lessons learned within ten working days. Actions are tracked until closed.
7. Evidence. All reports, assessments, notifications and lessons learned are kept for five years.
8. Training. All employees complete incident reporting training at onboarding and every year. Incident leads take a yearly exercise.