BCMS-DOC-08-7 Incident Response Procedure

Incident Response Procedure

ISO22301 Toolkit Version 4R1 ŠCertiKit

Incident Response Procedure

Implementation Guidance (The header page and this section must be removed from final version of the document)

Purpose of this document The Incident Response Procedure sets out in detail how the organisation will initially react to an incident and manage it going forward. It is intended to be used at the point at which an incident has occurred.

Areas of the standard addressed This document addresses the following sections of the ISO22301 standard: 8.4 Establish and implement business continuity procedures 8.4.2 Incident response structure 8.4.3 Warning and communication

General Guidance You will need to think carefully about who should be included in the incident response structure so that the right people are available in the event of a disruptive incident. The procedures contained in this document need to be clear and concise as they will possibly be used in times of great stress to the people involved.

Try to always have a Plan B for each aspect of the procedure such as deputies for the people, an alternative command centre and access to critical documents and resources.

Review Frequency We would recommend that this document is reviewed at least annually and after every relevant exercise or test.

Toolkit Version Number ISO22301 Toolkit Version 4R1 ©CertiKit.

Document Fields This document may contain fields which need to be updated with your own information, including a field for Organization Name that is linked to the custom document property “Organization Name”.

Version 1

Page 2 of 35

[Insert date]

Incident Response Procedure

To update this field (and any others that may exist in this document): 1. Update the custom document property “Organization Name” by clicking File > Info > Properties > Advanced Properties > Custom > Organization Name 2. Press Ctrl a on the keyboard to select all text in the document (or use Select, Select All on the ribbon) 3. Press F9 on the keyboard to update all fields 4. When prompted, choose the option to just update TOC page numbers If you wish to permanently convert the fields in this document to text i.e. so that they are no longer updateable, then you will need to click into each occurrence of the field and press Ctrl Shift F9.

If you would like to make all fields in the document visible then go to File > Options > Advanced > Show document content > Field shading and set this to “Always”. This can be useful to check that you have updated all fields correctly.

Further detail on the above procedure can be found in the Toolkit Completion Instructions.

Copyright notice Except for any third-party works included in this document, as identified in this document, this document has been authored by CertiKit, and is © copyright CertiKit except as stated below.

CertiKit is a company registered in England and Wales with company number 6432088.

Licence terms This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence. If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third-party copyright included in this document.

Disclaimer Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use. Therefore please note that it is your responsibility to

Version 1

Page 3 of 35

[Insert date]

Incident Response Procedure

ensure that the content of any document you create that is based on our templates is correct and appropriate for your needs and complies with relevant laws in your country. You should take all reasonable and proper legal and other professional advice before using this document. CertiKit makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of our document templates, assumes no duty of care to any person with respect its document templates or their contents, and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.

Version 1

Page 4 of 35

[Insert date]

Incident Response Procedure

[Replace with your logo]

Incident Response Procedure

Document Ref. Version: Dated: Document Author: Document Owner:

Version 1

Page 5 of 35

BCMS-DOC-08-7 1 [Insert date]

[Insert date]

Incident Response Procedure

Revision History Version Date

Revision Author

Summary of Changes

Distribution Name

Title

Approval Name

Version 1

Position

Signature

Page 6 of 35

Date

[Insert date]

Incident Response Procedure

Contents 1

INTRODUCTION ....................................................................................................................................... 9

2

INCIDENT RESPONSE FLOWCHART ............................................................................................... 10

3

INCIDENT DETECTION AND NOTIFICATION ............................................................................... 11 3.1 3.2 3.3 3.4

INCIDENT DETECTION .......................................................................................................................... 11 INCIDENT NOTIFICATION ..................................................................................................................... 11 RECORDING THE INCIDENT DETAILS .................................................................................................... 11 CONTACTING THE INCIDENT RESPONSE TEAM LEADER ....................................................................... 12

4

ACTIVATING THE INCIDENT RESPONSE PROCEDURE ............................................................ 13

5

ASSEMBLE INCIDENT RESPONSE TEAM ....................................................................................... 14 5.1 INCIDENT RESPONSE TEAM MEMBERS ................................................................................................. 14 5.2 ROLES AND RESPONSIBILITIES ............................................................................................................. 14 5.3 INCIDENT COMMAND CENTRE ............................................................................................................. 16 5.3.1 Location ...................................................................................................................................... 16 5.3.2 Access ......................................................................................................................................... 16 5.3.3 Parking ....................................................................................................................................... 16 5.3.4 Facilities in the Command Centre .............................................................................................. 16 5.4 ALTERNATE COMMAND CENTRE ......................................................................................................... 17

6

IMPACT ASSESSMENT ......................................................................................................................... 18

7

BUSINESS CONTINUITY PLAN ACTIVATION ................................................................................ 19

8

INCIDENT MANAGEMENT, MONITORING AND COMMUNICATION ..................................... 20 8.1 COMMUNICATION PROCEDURES .......................................................................................................... 20 8.1.1 Means of Communication ........................................................................................................... 20 8.1.2 Communication Guidelines ........................................................................................................ 20 8.1.3 Internal Communication ............................................................................................................. 21 8.1.4 External Communication ............................................................................................................ 21 8.1.5 Communication with the Media .................................................................................................. 22

9

CEASING RESPONSE ACTIVITIES AND STANDING DOWN ....................................................... 24

10

DEBRIEF AND POST-INCIDENT REVIEW ....................................................................................... 25

11

APPENDIX A – INITIAL RESPONSE CONTACT SHEET ............................................................... 26

12

APPENDIX B – INCIDENT IMPACT INFORMATION LOG ........................................................... 27

13

APPENDIX C – BUSINESS ACTIVITIES AFFECTED AND PLANS ACTIVATED ...................... 28

14

APPENDIX D – BLANK ACTIVITY LOGGING FORM .................................................................... 29

15

APPENDIX E – BLANK MESSAGE LOGGING FORM .................................................................... 30

16

APPENDIX F – INTERNAL CONTACT TELEPHONE NUMBERS ................................................ 31

17

APPENDIX G – USEFUL EXTERNAL CONTACTS .......................................................................... 32

18

APPENDIX H - STANDARD INCIDENT RESPONSE TEAM MEETING AGENDA .................... 33

19

APPENDIX I – INCIDENT COMMAND CENTRE ............................................................................. 34 19.1 19.2

20

LOCATION MAP ................................................................................................................................... 34 FLOOR PLAN ........................................................................................................................................ 34

APPENDIX J – THE PHONETIC ALPHABET .................................................................................... 35

Version 1

Page 7 of 35

[Insert date]

Incident Response Procedure

List of Figures FIGURE 1 - INCIDENT RESPONSE FLOWCHART .......................................................................................................... 10

List of Tables TABLE 1 – INITIAL RESPONDERS .............................................................................................................................. 11 TABLE 2 - INCIDENT RESPONSE TEAM LEADER CONTACTS ......................................................................................... 12 TABLE 3 - INCIDENT RESPONSE TEAM MEMBERS ....................................................................................................... 14 TABLE 4 - BUSINESS CONTINUITY PLANS................................................................................................................... 19 TABLE 5 - MONITORED RISK ADVISORY SYSTEMS ....................................................................................................... 22 TABLE 6 - INCIDENT SPOKESPEOPLE ........................................................................................................................ 23

Version 1

Page 8 of 35

[Insert date]

Incident Response Procedure

1 Introduction This document is intended to be used when a disruptive incident of some kind has occurred that affects the business operations of [Organization Name].

The procedures set out in this document should be used only as guidance when responding to an incident. The exact nature of an incident and its impact cannot be predicted with any degree of certainty and so it is important that a good degree of common sense is used when deciding the actions to take.

However it is intended that the structures set out here will prove useful in allowing the correct actions to be taken more quickly and based on more accurate information.

The objectives of this incident response procedure are to: • • • • • • •

provide a concise overview of how [Organization Name] will respond to a disruptive incident affecting its business continuity set out who will respond to an incident and how our business continuity plans will be invoked describe the facilities that are in place to help with the management of the incident define how decisions will be taken with regard to our response to an incident explain how communication within the organisation and with external parties will be handled provide contact details for key people and external agencies define what will happen once the incident is resolved, and the responders are stood down

All members of staff named in this document will be given a copy which they must have available when required.

Contact details will be checked and updated at least three times a year. Changes to contact or other relevant details that occur outside of these scheduled checks should be sent to business.continuity@organisation.com as soon as possible after the change has occurred.

All personal information collected as part of the business continuity process and contained in this document will be used purely for the purposes of business continuity planning and is subject to relevant data protection legislation.

Version 1

Page 9 of 35

[Insert date]

Incident Response Procedure

2 Incident Response Flowchart The flow of the incident response procedure is shown in the diagram below.

Incident detection and notification

Activate incident response procedure?

No

Yes Assemble Incident Response Team

Incident assessment

Invoke BC plan?

Yes Incident management, monitoring and communication No

No Cease response activities?

Yes

Stand down

Debrief and postincident review

End of procedure

Figure 1 - Incident response flowchart

These steps are explained in more detail in the rest of this procedure.

Version 1

Page 10 of 35

[Insert date]

Incident Response Procedure

3 Incident Detection and Notification 3.1

Incident Detection

The incident may be initially detected in a wide variety of ways and through a number of different sources (including emergency services), depending on the nature and location of the incident. The most important factor is that the incident response procedure must be started as quickly as possible so that an effective response can be given.

3.2

Incident Notification

The following contacts will act as initial responders for a disruptive incident. Any of these contacts may be notified of an incident. They all have the authority to contact the Incident Response Team Leader at any time to ask him/her to assess whether the Incident Response Procedure should be activated.

Contact Team Leader Duty Manager HR Manager Customer Services Team Leader

Department Facilities Management Facilities Management Human Resources Customer Services

Phone number xxxx xxxxxxx

Availability 9am to 5pm Mon to Fri

xxxx xxxxxxx

Out of hours

xxxx xxxxxxx

9am to 5pm Mon to Fri

xxxx xxxxxxx

6am to 9pm Mon to Sat

Table 1 – Initial responders

3.3

Recording the Incident Details

On receiving notification of a possible disruptive incident, the person taking the call should record the details given, including: • • • • •

•

The name of the caller Caller’s contact details Date and time of the call Call taker’s name Exact description of the incident, including: o Date and time of the incident o Nature of the incident e.g. fire, flood, explosion o Location of the incident o Whether emergency services have been called (if appropriate) and if so are they in attendance? o Any injuries or loss of life if known o An estimate of the scale of the impact Any other relevant information available

Version 1

Page 11 of 35

[Insert date]

Incident Response Procedure

3.4

Contacting the Incident Response Team Leader

The initial responder to the incident should then contact the Incident Response Team Leader (or nominated deputy) using the contact details below to convey the above information.

Name

Role in Plan

Office Number

Home Number

Mobile Number

Date/Time

Outcome (Contacted/No Ans /Msg Left /Unreachable)

Team Leader Deputy 1 Deputy 2 Deputy 3 Table 2 - Incident response team leader contacts

In the event that none of the above can be contacted the initial responder has the authority to decide whether or not the Incident Response Procedure should be activated.

Version 1

Page 12 of 35

[Insert date] Powered by CertiKit

Incident Response Procedure

4 Activating the Incident Response Procedure Once notified of an incident the Team Leader must decide whether the scale and actual or potential impact of the incident justifies the activation of the Incident Response Procedure and the convening of the Incident Response Team.

Guidelines for whether a formal incident response should be initiated for any particular incident of which the Team Leader has been notified are as follows.

• • •

There is significant actual or potential danger to life OR There is significant actual or potential disruption to business operations OR Any other situation which may cause significant impact to the organisation

Guidelines for the definition of “significant” within the above criteria are as follows: • • • • • •

Loss of more than one day’s production An inability to service more than 60% of customers More than one day’s disruption to store replenishment Damage to reputation via coverage in national press More than 30 employees affected [define the level of impact that should trigger the incident response procedure]

In the event of disagreement or uncertainty about whether or not to activate an incident response the decision of the Team Leader will be final.

If it is decided not to activate the procedure then a plan should be created to allow for a lower level response to the incident within normal management channels. This may involve the invocation of a business continuity procedure at a local level.

If the incident warrants the activation of the IR procedure the Team Leader will start to assemble the IRT as described in the next section.

Version 1

Page 13 of 35

[Insert date]

Incident Response Procedure

5 Assemble Incident Response Team Once the decision has been made to activate the incident response procedure, the Team Leader (or deputy) will ensure that all role holders (or their deputies if main role holders are un-contactable) are contacted, made aware of the nature of the incident and asked to assemble at the Incident Command Centre.

The exception is the Incident Liaison who will be asked to attend the location of the incident in order to start to gather information for the impact assessment that the IRT will conduct so that an appropriate response can be determined.

5.1

Incident Response Team Members

The Incident Response Team (IRT) will consist of the following people in the roles specified and with the stated deputies.

Role Team Leader

Main role holder

Deputy

Team Facilitator Incident Liaison Business Operations Health and Safety Human Resources Communications Legal and Regulatory Table 3 - Incident response team members

Contact details for the above are listed at Appendix A of this document.

5.2

Roles and Responsibilities

The responsibilities of the roles within the incident response team are as follows: Team Leader • • • • •

Decides whether or not to initiate a response Assembles the incident response team Overall management of the incident response team Acts as interface with the board and other high-level stakeholders Final decision maker in cases of disagreement

Version 1

Page 14 of 35

[Insert date]

Incident Response Procedure

Team Facilitator • • • • • •

Supports the incident response team Co-ordinates resources within the command centre Prepares for meetings and takes record of actions and decisions Briefs team members on latest status on their return to the command centre Facilitates communication via email, fax, telephone or other methods Monitors external information feeds such as weather and news

Incident Liaison • • • •

Attends the site of the incident as quickly as possible Assesses the extent and impact of the incident Provides first-person account of the situation to the IRT Liaises with the IRT on an on-going basis to provide updates and answer any questions required for decision-making by the IRT

Business Operations • • •

Contributes to decision-making based on knowledge of business operations, products and services Briefs other members of the team on operational issues Helps to assess likely impact on customers of the organisation

Health and Safety • • • •

Assesses the risk to life and limb of the incident Ensures that legal responsibilities for health and safety are met at all times Liaises with emergency services such as police, fire and medical Considers environmental issues with respect to the incident

Human Resources • • •

Assesses and advises on HR policy and employment contract matters Represents the interests of organisation employees Advises on capability and disciplinary issues

Communications • • •

Responsible for ensuring internal communications are effective Decides the level, frequency and content of communications with external parties such as the media Defines approach to keeping affected parties informed e.g. customers, shareholders

Version 1

Page 15 of 35

[Insert date]

Incident Response Procedure

Legal and Regulatory • •

5.3

Advises on what must be done to ensure compliance with relevant laws and regulatory frameworks Assesses the actual and potential legal implications of the incident and subsequent actions Incident Command Centre

In order to accommodate the IRT, a pre-prepared location has been selected for the Incident Command Centre.

5.3.1

Location

The address of the command centre is as follows: [Give the full address of the command centre] A location map and floor plan of the command centre are shown at Appendix I of this document.

5.3.2

Access

During office hours (8am to 5.30pm Monday to Friday) the command centre is accessible via reception at the main entrance to the building. Outside of office hours the Duty Facilities Manager must be contacted on xxx xxx xxxx to provide access within one hour of it being requested.

5.3.3

Parking

Parking is available 24 hours a day, 7 days a week at the public facility directly across the street from the office building containing the command centre.

5.3.4

Facilities in the Command Centre

The following facilities are available with the command centre: • • • • • • • • • • •

Main office area Separate conference room 8 x Landline telephones 1 x Fax machine 8 x desktop computers Access to the corporate network Internet access 8 x workstations Washroom facilities Small kitchen with kettle and microwave Projector with screen

Version 1

Page 16 of 35

[Insert date]

Incident Response Procedure

• • • • • •

1 x colour printer (networked) Television Radio 8 x hard hats and high visibility vests 4 x flashlights Stationery (pads, pens, pencils, hole punch, staplers)

A variety of shops are within easy walk of the command centre should additional equipment be needed (shop hours only).

5.4

Alternate Command Centre

In the event that the incident command centre is not available for any reason a secondary facility exists at the following location: [Give the full address of the alternate command centre. Add location map, floor plan and facility list if available]

Version 1

Page 17 of 35

[Insert date]

Incident Response Procedure

6 Impact Assessment Once the IRT has been assembled at the Command Centre, a more detailed impact assessment must be carried out in order to decide the appropriate response.

The information that should have been recorded at the time of notification of the incident is as follows: • • • • • •

Date and time of the incident Nature of the incident e.g. fire, flood, explosion Location of the incident Whether emergency services have been called (if appropriate) and if so are they in attendance?

Any injuries or loss of life if known An estimate of the scale of the impact

In addition to this initial indication, further information should be available from the Incident Liaison team member of the IRT who should be at the location of the incident.

Useful further information could include: • • • • • • •

Likely duration of the incident Any obvious knock-on effects The extent of impact on infrastructure including computers, networks, equipment and accommodation The business units affected and the extent of the impact to them The effect on production or service delivery A list of those people that will not be able to assist in the recovery Initial indication of the likely cause of the incident

This information should be documented so that a clear time-based understanding of the situation as it emerges is available for current use and later review. A form template is provided for this purpose at Appendix B. A list of the business activities, products, services, teams and supporting processes that have been affected by the incident should be created together with an assessment of the extent of the impact. A template form to record this information is at Appendix C of this document.

Version 1

Page 18 of 35

[Insert date]

Incident Response Procedure

7 Business Continuity Plan Activation Once the IRT has been assembled at the command centre and as much detail as possible has been collected about the incident and its impact, a decision needs to be made about the most appropriate response.

[Organization Name] has a variety of business continuity plans that provide for actions to be taken to respond to different types of incidents.

These plans are as follows: Document Plan title reference Plan001 Loss of Access to Building A Plan002 Plan003

Plan Description

Move key business activities to alternate site Loss of main business critical IT Restore backups to warm recovery servers site Failure of Critical Supplier Increase supply from alternative suppliers [List all business continuity plans]

Table 4 - Business continuity plans

Based on the current understanding of the business activities affected by the incident, an appropriate combination of the above business continuity plans should be activated to try to mitigate the impact.

The form at Appendix C should be used to record the business continuity plans that are activated to address the specific business activities impacted by the incident.

The method of activation of each plan is detailed in the individual plan document.

Version 1

Page 19 of 35

[Insert date]

Incident Response Procedure

8 Incident Management, Monitoring and Communication Once an appropriate response to the incident has been identified and the relevant business continuity plans activated, the IRT needs to be able to manage the overall response, monitor the status of the incident and ensure effective communication is taking place at all levels.

Regular IRT meetings must be held at an appropriate frequency decided by the Team Leader. A standard agenda for these meeting is at Appendix H. The purpose of these meetings is to ensure that recovery resources are managed effectively and that key decisions are made promptly, based on adequate information. Each meeting will be minuted by the Team Facilitator.

The Incident Liaison will provide updates to the IRT to a frequency decided by the Team Leader. These updates should be co-ordinated with the IRT meetings so that the latest information is available for each meeting.

8.1

Communication Procedures

It is vital that effective communications are maintained between all parties involved in the incident response.

8.1.1

Means of Communication

The primary means of communication during an incident will be telephone, both landline and mobile. In the event of telephone communications being unavailable provision may be made for the use of radio communications, although the usable range of such equipment should be assessed.

Email should not be used unless telephone and equivalent alternatives are unavailable.

8.1.2

Communication Guidelines

The following guidelines should be followed in all communications: • • •

•

Be calm and avoid lengthy conversation Advise internal team members of the need to refer information requests to the IRT If the call is answered by someone other than the contact: ➢ Ask if the contact is available elsewhere ➢ If they cannot be contacted leave a message to contact you on a given number ➢ Do not provide details of the Incident Always document call time details, responses and actions

Version 1

Page 20 of 35

[Insert date]

Incident Response Procedure

All communications should be clearly and accurately recorded using the form at Appendix E to this document.

8.1.3

Internal Communication

Calls incoming to the command centre should use the main number which is:

+xx xxx xxx xxxx Eight lines are available for incoming calls. If there is no answer a message may be left. If the call is urgent the caller should both leave a message and call back as well as trying alternative methods of communication if available.

If leaving a message, ensure you leave: • • • • •

Your name Your number Your organisation The name of the person the message is for The message

Details of the incident should not be given when leaving a message.

8.1.4

External Communication

Depending on the incident there may be a variety of external parties that will be communicated with during the course of the response. It is important that the information released to third parties is managed so that it is timely and accurate.

Calls that are not from agencies directly involved in the incident response (such as the media) should be passed to the member of the IRT responsible for communications.

Emergency responders such as the police, fire and ambulance services will be well practised in incident handling and will have their own structured methods for communication and every effort should be made to comply with these. A listing of the phonetic alphabet used by the emergency services is at Appendix J. There may be a number of external parties who, whilst not directly involved in the incident, may be affected by it and need to be alerted to this fact. These may include: • • • •

Customers Suppliers Shareholders Regulatory bodies

Version 1

Page 21 of 35

[Insert date]

Incident Response Procedure

The Communications IRT member should make a list of such interested parties and define the message that is to be given to them. A list of some external agencies is given at Appendix G. Interested parties who have not been alerted by the IRT may call to obtain information about the incident and its effects. These calls should be recorded in the message log and passed to the Communications member of IRT. There are a number of national and regional risk advisory systems which may be able to provide information about the incident and likely developments.

The following such systems are monitored: Agency Homeland Security Environment Agency Met Office

National/ Regional National National National

Country Fire Authority

Regional

Subject

Method of communication Security threats Email alerts Flood warnings Website Severe weather Website/ email warnings Fire risk and News channels/ warnings website

Table 5 - Monitored risk advisory systems

The frequency of monitoring these systems should be increased for those that are directly relevant to the incident in hand. All relevant warnings should be logged and communicated to the IRT Team Leader.

8.1.5

Communication with the Media

In general the communication strategy with respect to the media will be to issue regular updates via top management. No members of staff should give an interview with the media unless this is pre-authorised by the IRT. The preferred interface with the media will be to issue pre-written press releases. In exceptional circumstances a press conference will be held to answer questions about the incident and its effects. It is the responsibility of the Communications IRT member to arrange the venue for these and to liaise with press that may wish to attend.

In drafting a statement for the media the following guidelines should be observed: • • • • •

Personal information should be protected at all times Stick to the facts and do not speculate about the incident or its cause Ensure legal advice is obtained prior to any statements being issued Try to pre-empt questions that may reasonably be asked Emphasise that a prepared response has been activated and that everything possible is being done

Version 1

Page 22 of 35

[Insert date]

Incident Response Procedure

The following members of staff will be appointed spokespeople for the organisation if further information is to be issued e.g. at a press conference:

Name

Role

Incident Scale

Person A

IRT Communications

Person B

Head of Corporate Communications

Person C

Chief Executive Officer

Low Medium High

Table 6 - Incident spokespeople

The most appropriate spokesperson will depend upon the scale of the incident and its effect on customers, supplier, the public and other stakeholders.

Version 1

Page 23 of 35

[Insert date]

Incident Response Procedure

9 Ceasing Response Activities and Standing Down The Team Leader will decide, based on the latest information from the Incident Liaison and other members of the team, the point at which response activities should be ceased and the IRT stood down. Note that the recovery and execution of business continuity plans may continue beyond this point but under less formal management control.

This decision will be up to the Team Leader’s judgement but should be based upon the following criteria: • • • • • •

The situation has been fully resolved or is reasonably stable The pace of change of the situation has slowed to a point where few decisions are required The appropriate response is well underway and business continuity plans are progressing to schedule Affected business activities have been resumed although perhaps at a lower level than normal The degree of risk to the business has lessened to an acceptable point Immediate legal and regulatory responsibilities have been fulfilled

If recovery from the incident is on-going the Team Leader should define the next actions to be taken. These may include: • • • • •

Less frequent meetings of the IRT e.g. weekly depending on the circumstances Informing all involved parties that the IRT is standing down Ensuring that all documentation of the incident is secured Requesting that all staff not involved in further work to return to normal duties Returning the command centre to a state where it may be used for a future incident

All actions taken as part of standing down should be recorded.

Version 1

Page 24 of 35

[Insert date]

Incident Response Procedure

10 Debrief and Post-incident Review After the IRT has been stood down the Team Leader will hold a debrief of all members ideally within 24 hours. The relevant records of the incident will be examined by the IRT to ensure that they reflect actual events and represent a complete and accurate record of the incident.

Any immediate comments or feedback from the team will be recorded.

A more formal post-incident review will be held at a time to be decided by top management according to the magnitude and nature of the incident. As input to this review the Team Leader will complete a Post Incident Report using the form Post Incident Report as a template.

Version 1

Page 25 of 35

[Insert date]

Incident Response Procedure

11 APPENDIX A – Initial Response Contact Sheet The following table should be used to record successful and unsuccessful initial contact with members of the IRT: Name

Role in Plan

Office Number

Home Number

Mobile Number

Person A

Team Leader

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Person B

Team Facilitator

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Person C

Incident Liaison Business Operations Health and Safety Human Resources

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Communications Xxx xxx xxx Legal and Regulatory Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Xxx xxx xxx

Person D Person E Person F Person G Person H

Version 1

Page 26 of 35

Date/Time

Outcome (Contacted/No Ans /Msg Left /Unreachable)

ETA (if contacted)

[Insert date]

Incident Response Procedure

12 APPENDIX B – Incident Impact Information Log Major Incident:

Date

Time

Location:

Incident Team Leader:

Impact Information Provided

By

Signature

Sheet No.:

Version 1

Page 27 of 35

[Insert date]

Incident Response Procedure

13 APPENDIX C – Business Activities Affected and Plans Activated Major Incident:

Date

Time

Location:

Business Affected

Incident Team Leader:

Activity Extent of impact

Business Continuity plan activated

Date

Time

Sheet No.:

Version 1

Page 28 of 35

[Insert date]

Incident Response Procedure

14 APPENDIX D – Blank Activity Logging Form Major Incident:

Date

Time

Location:

Action

Incident Team Leader:

By

Comments

Signature

Sheet No.:

Version 1

Page 29 of 35

[Insert date]

Incident Response Procedure

15 APPENDIX E – Blank Message Logging Form Major Incident:

Date

Time

Location:

Caller

Incident Team Leader:

Caller’s number

Message for

Message

Sheet No.:

Version 1

Page 30 of 35

[Insert date]

Incident Response Procedure

16 APPENDIX F – Internal Contact Telephone Numbers The following table shows the telephone numbers of key internal personnel: Name

Version 1

Title

Department

Role in Plan

Page 31 of 35

Telephone Number

Email address

[Insert date]

Incident Response Procedure

17 APPENDIX G – Useful External Contacts The following table shows the contact details of agencies and people who may be useful depending on the nature of the incident: Name

Version 1

Title

Organisation

Address

Page 32 of 35

Telephone Number

Email

[Insert date]

Incident Response Procedure

18 APPENDIX H - Standard Incident Response Team Meeting Agenda It is recommended that the following standard agenda be used for meetings of the Incident Response Team.

AGENDA

Attendees:

All members of Incident Response Team

Location:

Command Centre

Frequency:

Every 2 hours, on the even hour

Chair:

Team Leader

Minutes:

Team Facilitator

1. Actions from previous meeting 2. Incident status update 3. Decisions required 4. Task allocation 5. Internal communications 6. External communications 7. Standing down 8. Any other business

Version 1

Page 33 of 35

[Insert date]

Incident Response Procedure

19 APPENDIX I – Incident Command Centre 19.1 Location Map The location of the incident command centre is shown below [replace with map of your command centre].

19.2 Floor Plan The layout of the incident command centre is shown below [replace with layout of your command centre].

3800.0 mm x 2000.0 mm

Version 1

Page 34 of 35

[Insert date]

Incident Response Procedure

20 APPENDIX J – The Phonetic Alphabet In order to ensure that messages are understood correctly, the phonetic alphabet should be used when spelling out words and numbers.

Phonetic Alphabet A – Alpha

B – Bravo

C – Charlie

D – Delta

E – Echo

F – Foxtrot

G – Golf

H – Hotel

I – India

J – Juliet

K – Kilo

L – Lima

M – Mike

N – November

O – Oscar

P – Papa

Q – Quebec

R – Romeo

S – Sierra

T – Tango

U – Uniform

V – Victor

W – Whiskey

X – X-ray

Y – Yankee

Z – Zulu

0 - Zero

1 – Wun

2 – Two

3 - Tree

4 – Fower

5 – Fife

6 – Six

7 – Seven

8 - Ait

9 – Niner

Version 1

Page 35 of 35

[Insert date]