1 · Purpose
This policy establishes the requirements for incident response policy within the CAO-400 Cybersecurity. It gives effect, in a single harmonised instrument, to the control objectives upon which recognised standards converge for this area.
2 · Scope
This policy applies to all information, systems, services, personnel and third parties within the scope of the management system.
3 · Policy statements
3.x · CAO-470 Policy Controls
The organisation shall establish, implement and maintain a coherent and effective approach to incident response, giving effect to the organisational control objectives set out below.
3.1 · CAO-471 Incident Management Planning
The organisation shall establish, implement and maintain effective Incident Management Planning, giving effect to the organisational controls set out below.
3.1.x · CAO-471 Organisational Controls
Essential taster — a preview of the Professional depth for this high-density control area.
3.2 · CAO-472 Incident Detection and Assessment
The organisation shall establish, implement and maintain effective Incident Detection and Assessment, giving effect to the organisational controls set out below.
3.2.x · CAO-472 Organisational Controls
3.3 · CAO-473 Incident Response
The organisation shall establish, implement and maintain effective Incident Response, giving effect to the organisational controls set out below.
3.3.x · CAO-473 Organisational Controls
Essential taster — a preview of the Professional depth for this high-density control area.
3.4 · CAO-474 Incident Reporting and Communication
The organisation shall establish, implement and maintain effective Incident Reporting and Communication, giving effect to the organisational controls set out below.
3.4.x · CAO-474 Organisational Controls
3.5 · CAO-475 Incident Recovery
The organisation shall establish, implement and maintain effective Incident Recovery, giving effect to the organisational controls set out below.
3.5.x · CAO-475 Organisational Controls
3.6 · CAO-476 Forensics and Learning
The organisation shall establish, implement and maintain effective Forensics and Learning, giving effect to the organisational controls set out below.
3.6.x · CAO-476 Organisational Controls
4 · Roles & responsibilities
- Governing body — approves this policy and oversees its effectiveness.
- Executive management — allocates resources and assigns control ownership.
- Control owners — implement, operate and evidence the controls in their area.
- All personnel & third parties — comply with this policy within their role.
5 · Compliance, monitoring & review
Compliance with this policy is mandatory. This policy is reviewed at least annually, or upon significant change to the threat, regulatory or technological environment. Exceptions require documented risk acceptance by the accountable owner.