Global Steel Exports Limited
This
Policy Title:
Data Breach Incident Response Plan
Policy No:
005
Version
Effective date:
26/03/2018
Replaces
Owner:
Data Protection Officer
1.01
plan has been produced to provide a coordinated and best practice to a data security breach which can happen for a number of reasons, including but not limited to:
Loss or theft of data or equipment on which data is stored Inappropriate access controls allowing unauthorised use Equipment failure Human error Unforeseen circumstances such as fire or flood Cyber attack Social Engineering offences where information is obtained by deceiving the organisation who holds it
Scope of the Incident Response Plan This document identifies numbered tasks that are the order of steps that need to be taken in the event of an incident. The plan consists of four key elements: Containment & Recovery Assessment of ongoing risk Notification of breach Evaluation and response Containment & Recovery 1. 2. 3. 4. 5.
All incidents or suspected incidents must be reported immediately to the Incident Manager The Incident Manager may decide to convene the Incident Response Management Team dependant on the impact and scale of the incident An initial breach evaluation, containment and recovery plan needs to be put into action quickly based on the following: What is the scale and extent of the breach? Are some systems operating normally? Do we need to take steps to limit or constrain the breach? What resources are required to limit the damage and recover quickly? What is the best way to recover from the breach taking into account:
a.) Risks b.) Impact c.) Timescales d.) Business damage i. Reputational ii. Commercial iii. Legal a
Assessing the Risks Pa ge 1|3 March 2018 GSE004_Backup Policy v1
Global Steel Exports Limited 6. What are all the types of data that have been breached by the incident (PCI, P11, Special Category, Business Sensitive,
Policy Title:
Data Breach Incident Response Plan
Policy No:
005
Version
Effective date:
26/03/2018
Replaces
Owner:
Data Protection Officer
1.01
etc)? 7. Assess the potential impact and/or damage to the freedom of rights of the individuals who have had personal data breached, if applicable. 8. Who needs to be informed internally and externally? a b c d e f g
a.) Those responsible internally for the specific data that has been breached b.) The Board of Directors c.) The individuals themselves if there is likely to be an impact on them d.) The Regulator (ICO) e.) The Police f.) Insurers g.) Bank and/or Credit Card companies
9. What are the ongoing risks taking into account: a b c d
a.) Freedoms, rights, impact or damage to individuals b.) Business Risks c.) Business Impact d.) Business damage – Reputational, Commercial or Legal
Notification of Breach Where the breach includes personal data relating to a large number of individuals and/or there is likely to be an impact on those individuals, the ICO must be informed. 10. Notifications of a breach will include: a. b. c. d. e. f. g. h.
How and when the breach occurred What data was involved The level of risk and potential impact that the breach may introduce The actions we have taken already to mitigate the risks and impact Any ongoing risks that are posed by the breach Give clear and specific advice and recommendations for individuals or organisations on any actions they need to take to protect themselves following the breach Describe any other help we are going to provide to help them protect themselves Details of how the individuals or organisations can contact you or other ways to get further information and/or updates on the breach
Pa ge 2|3 March 2018 GSE004_Backup Policy v1
Global Steel Exports Limited Evaluation & Response 11.
Policy Title:
Data Breach Incident Response Plan
Policy No:
005
Version
Effective date:
26/03/2018
Replaces
Owner:
Data Protection Officer
A
1.01
post incident evaluation of how the breach occurred, how it could have been avoided, how it was managed and any lessons learnt must be carried out and documented for each breach incident. The output from the evaluation must be used to update the Breach Management Plan appropriately.
Data Breach Incident Response Management Team
Name
Role
Contact Number
Chris Gill
Incident Manager (IM)
07525838638
Nick Umney
Services & Solutions Director
07788393000
Mark Smith
Data Protection Officer (DPO)
07980697499
Pa ge 3|3 March 2018 GSE004_Backup Policy v1