Incident Response Plan

Severity Classification

Phase 1 — Detection & Triage

1. Any employee who suspects a security incident must report it to the IT Security team via the Security Hotline within 1 hour of discovery.
2. The on-call Security Analyst must acknowledge the report and create an incident ticket within 30 minutes of notification.
3. The incident must be assigned a severity level (S1–S4) within 1 hour of the ticket being opened.
4. For S1 and S2 incidents, the Incident Commander must be notified and must assume command of the response within 2 hours.
5. Initial evidence collection (logs, screenshots, network captures) must begin immediately and no affected systems may be powered off or wiped without Incident Commander approval.

Phase 2 — Containment

1. The Incident Commander must approve and document all containment actions before they are executed.
2. Affected systems must be isolated from the network within the timeframe specified by the severity SLA.
3. Compromised credentials must be disabled within 15 minutes of identification.
4. All containment actions must be logged with timestamp, actor, and rationale in the incident ticket.

Phase 3 — Eradication

1. Root cause analysis must be completed before any affected system is returned to production.
2. All malware, unauthorized access points, and vulnerabilities identified during the incident must be remediated before eradication is declared complete.
3. The CISO must sign off on eradication completion for all S1 and S2 incidents.

Phase 4 — Recovery

1. Systems must be restored from clean, verified backups; recovery from potentially compromised backups requires CISO approval.
2. All restored systems must pass a security scan before being returned to production.
3. The business unit owner must sign off on system functionality before the incident is moved to Closed status.
4. Enhanced monitoring must be maintained on recovered systems for a minimum of 30 days post-recovery.

Phase 5 — Post-Incident Review

A Post-Incident Review (PIR) must be completed within 5 business days of incident containment for all S1 and S2 incidents.

The PIR report must be distributed to the CISO, relevant department heads, and the Board Risk Committee within 3 days of completion.

All action items identified in the PIR must have an assigned owner and target completion date; progress must be reviewed monthly until closed.

Contact List

Regulatory Notification Matrix

Cross-functional notification to Regulatory Affairs is mandatory within 24 hours for any incident involving FDA-regulated device data or manufacturing systems.

2025–2026 Incident Log (Summary)