...
- Detection of an incident.
- Containement Containment of the breach.
- Assessing the impact.
- Notification based on te the impact.
- Post moretm mortem review and process/policies adjustments.
...
All security incidents/data breaches, High Medium and Low, will be logged in our Planfix system for monitoring. We have created a dedicated task and pipeline to keep track of incidents as seen in the below screen shot. All IT team members, and our CTO will be notified when a data breach task is created in Planfix and will be able to follow the progress of the incident through the various stages of this pipeline which is modeled on the notifiable data breaches scheme summary diagram.
Authorities to Notify
Workflow and Procedures
Planfix is currently used to record and track Security Incidents and Data Breaches. The project is called Data Breach. User search bar to quickly find it to report a problem. IT are responsible for tracking the icident reports 24x7.
...
The image below shows an example of an incident event (test incident created while testing the flow).
Notifiable Data Breach Schema
| View file | ||||
|---|---|---|---|---|
|
Notification Template
You will need the following information to complete this template:
| Information | Description |
|---|---|
| App name | The name of your Marketplace app. |
| Nature of incident | A concise description of what the identified incident is and its potential impact in 2-3 sentences. In cases where end user data has been leaked, also provide an indication of the extent of the data exposure and type(s) of data affected. For example, this may have been an issue in your Marketplace app which meant that a specific customer's data was visible to another customer during a three-hour period. |
| Source of incident information | How you learned about the existence of this issue. For example, through notification from another party, from self-discovery, etc. |
| Investigation details | What actions you undertook as part of investigating the incident to confirm its potential scope and impact. |
| Remediation actions | What actions you are taking (or have taken) to fix the incident. |
| Information about likelihood of exploitation / real-world impact | Details of whether the incident is likely to have resulted in actual impact to customers. For example, if there was any evidence in logs that indicates unauthorized access to customer data, the number of customers affected, etc. |
| Information about steps customers need to take (if applicable) | For server apps, instructions to fix the error on the managed environment. For example, directions for downloading the latest fix version and applying to server instance. |