Incident Response Plan

ISO/IEC 27001:2022 A.5.26 (response planning) + A.5.27 (learning from incidents) + 27035 guidance. Pre-write the plan; execute during incident without improvisation.

Field	Value
Document ID	DOC-ISMS-020
Owner	Security lead / CISO
Tested	Tabletop YYYY-MM-DD
Next review	YYYY-MM-DD

1. Incident classification

Severity	Definition	Examples	Response time	Escalation
S1 Critical	Major CIA loss, active breach	ransomware, data exfiltration	immediate	exec + legal
S2 High	Significant impact, contained	malware detected, partial outage	1 hour	security lead
S3 Medium	Limited impact	failed attack attempt	4 hours	on-call
S4 Low	Minimal impact	policy violation	1 business day	ticket queue

2. Response phases

flowchart LR
    D[Detect] --> T[Triage] --> C[Contain] --> E[Eradicate] --> R[Recover] --> L[Lessons learned]

Phase	Actions	Owner	Timeframe
Detect	alert, report channel	monitoring/anyone	–
Triage	classify severity, assemble team	on-call	< 1h
Contain	isolate, preserve evidence	IR team	hours
Eradicate	remove cause, patch	IR + eng	days
Recover	restore, verify integrity	ops	per RTO
Learn	post-incident review	all	≤ 1 week

3. Roles & contacts

Role	Primary	Backup	Contact
Incident commander	@name	@name	phone
Technical lead	@name
Comms lead	@name
Legal counsel	@firm

4. Communication

• Internal: escalation matrix by severity
• External: regulator notification (GDPR 72h), customer notice per contract
• Template statements pre-drafted per severity

5. Evidence & forensics

• Preserve: logs, images, timeline – chain of custody
• Do NOT: wipe evidence, turn off before imaging

6. Exercises

• Tabletop: every 6 months
• Full simulation: annually
• Record: exercise report feeding improvement

7. Learning loop (A.5.27)

Every incident → root cause → corrective action in CAPA register → update this plan and controls.