CRITICAL IT AND CYBER INCIDENT RESPONSE PLAN
1. PURPOSE AND OBJECTIVE
This document defines Tingdene Group’s response to a critical IT service disruption, including incidents caused by infrastructure failure or cyber security events.
The objective of this response plan is to ensure a measured, controlled, and well-governed response that:
• Protects Tingdene Group as an organisation, its people, and its data
• Manages and mitigates risk and disruption as quicky as practicably possible
• Enables restoration of critical services
• Maintains clear decision-making authority and structure of response action
• Ensures third party awareness, reporting obligations and protocol through liaison with Insurers and regulators
This document is intended to be available as a reference guide for Directors and Senior Management to outline steps of action.
This document separates governance, protocol, actions and communication from the Technical Recovery Execution Plan. The Technical Recovery Execution Plan is defined and outlined within the separate Disaster Recovery Plan (DRP).
2. SCOPE
This response plan applies to all Tingdene Group employees and companies, covering:
• Critical Technology Infrastructure outages
• Cyber Security Incidents (including suspected ransomware or data compromise)
• Loss of core business systems (authentication and unauthorised access, communication functions, financial software and operational platforms)
This document contains the authority, escalation, and communication protocols during an incident.
3. INCIDENT CLASSIFICATION
A Critical Technology or Cyber Security Incident includes any event that compromises or threatens the confidentiality, integrity or availability of systems or data (examples include but is not limited to):
• A loss of core authentication or identity process / service
• Single, multi-site or Group wide system outages
• Suspected or confirmed cyber attack (including but not limited to the obtaining, capturing, blocking or loss of company data)
• Incidents involving Insurer or regulatory compliance reporting obligations
• Any other situations which may cause ongoing business impact, financial impact or brand reputation.
4. ROLES, RESPONSIBILITIES AND AUTHORITY
Employees
• Report suspected incidents immediately to the Tech Team
Tech Team
• Executes technical actions under instruction
CRITICAL IT AND CYBER INCIDENT RESPONSE PLAN
• Supports investigation, containment, and recovery
• Preserves logs and evidence as required
Tech Team – Senior Representative
• Leads the technical response and containment activity
• Assesses incident severity and advises the CEO
• Authorises invocation of the DRP (subject to Insurer constraints)
• Acts as primary technical liaison with Insurers and third parties
CEO
• Acts as the primary coordination and communication lead during a critical incident with support from the impacted Business Unit Director
• Maintains the central update line between the Tech Team, Insurers, regulators and the Board of Directors
• Collates queries, advice, and decisions from Director support teams
• Ensures calm and consistent decision making and messaging across the business
• Authorises external communications and Insurer engagement
Third Parties
• Cyber and Technology Insurers – provide direction, approve actions and appoint specialists
• Outsourced Technology Partners – execute recovery actions under instruction
• Regulators (e.g. Information Commissioners Office) – communication and engagement as required
• Financiers (Banks) – communication and engagement as required
5. COMMUNICATION, ACTION AND ESCALATION PATHWAY
Step 1 – Incident Detected
• An incident is identified by monitoring, user reporting, or third party acknowledgement
• An incident is immediately reported to the Tech Team
Step 2 – Incident Classification
• Tech Team – Senior Representative notified as soon as reasonably practicable
• Tech Team performs immediate assessment to determine severity, impact and affected systems
Step 3 – Containment
• Tech Team, if safe to do so, contains the incident in line with the DRP
Step 4 – Escalation
• CEO notified following an initial assessment and classification as a critical incident for further review and decision making
Step 5 – Decision Making & Third Party Co-ordination
• CEO notifies Third Parties as appropriate (in liaison with Tech Team support)
• CEO informs the Board of Directors
CRITICAL IT AND CYBER INCIDENT RESPONSE PLAN
Step 6 – Recovery
• Restoration of systems and review system integrity
• Resume normal operations
• Consider post incident review and improvement as outlined under Section 8 below
Throughout the Incident Response Plan, the CEO will remain the single coordination and update point between the Tech Team, Third Parties and Board of Directors.
6. CYBER EVENT CONTROLS AND INSURER ENGAGEMENT
Where a cyber incident is suspected or confirmed:
• Immediate engagement is required with the Insurer to provide guidance on actions and process
• The Company must notify the Insurer as soon as reasonably practicable and no later than 72 hours from the point of awareness of the incident
• The Tech Team may undertake immediate containment and protective actions where necessary to:
- Prevent further compromise
- Protect systems and data
- Maintain business continuity
• The Insurer will provide guidance, coordinate response activity and may appoint specialist third-party support
• Where reasonably practicable:
- Significant system restoration, rebuild activity or external specialist engagement must be aligned with Insurer guidance
- Evidence preservation must take precedence over system restoration
• All actions must be logged and auditable
• Any significant costs incurred beyond the initial 72-hour period must be agreed with the Insurer unless otherwise authorised
7. RELATIONSHIP TO THE DRP
This plan defines governance, authority, and communication.
The DRP defines the technical recovery actions and system restoration procedures and is executed only under the governance of this document and, where applicable, Insurer direction.
8. POST-INCIDENT REVIEW AND IMPROVEMENT
Following resolution of any critical incident:
• A formal post-incident review will be conducted
• Technical, operational, and governance lessons learned will be documented
• This plan and the DRP will be updated where required
• Preventative and resilience improvements will be identified and tracked
Tingdene Group, 34-36 Bradfield Road, Finedon Road Industrial Estate, Wellingborough, Northamptonshire NN8 4HB
Tel: 01933 449090