What Is an Incident Response Policy?

An incident response policy defines an organization’s protocols and procedures concerning cybersecurity incidents. A highly detailed document or set of documents, the policy specifies the organization’s approach and strategy and all relevant resources, personnel, and tools.

The Importance of an Incident Response Policy

During a disruptive event, every second counts. An organization’s incident response team cannot afford to waste valuable minutes determining the chain of command or searching for several scattered process documents. They need a clearly-defined framework to guide their incident response strategy—this is precisely what an incident response policy provides.

In addition to reducing incident response time and improving communication and coordination during a disruptive event, an incident response policy also streamlines and supports regulatory compliance.

Key Components of an Incident Response Policy

An incident response policy typically encompasses the following:

Scope and purpose: What the policy is meant to accomplish, what incidents it covers, and the types of incidents it focuses on.

Chain of command: Clearly defined roles and responsibilities for all major stakeholders. This includes incident response teams, leadership, employees, and external partners and personnel.

Detection: How are cybersecurity incidents detected and reported? Who is responsible for managing and escalating such incidents?

Assessment: The processes and tools by which incidents are analyzed and classified based on their impact, risk, and severity.

Response: The processes and tools by which an organization mitigates and remediates an incident. Includes containment/eradication of threats and recovery.

Communication plan: What stakeholders need to know about a developing incident, and how will they be notified? Who is responsible for maintaining these lines of communication? More importantly, how will the organization report the incident to the public?

Testing and training: Details on how the policy will be regularly tested and revised. These tests should also double as training sessions for employees.

Post-response: What measures are in place for assessing the efficacy of the organization’s incident response process? How will the organization manage recovery and remediation in the long term?

Review: Lastly, an organization’s incident response policy should include performing a systemic review of the policy and individual plans in the interest of continuous improvement—an effective incident response strategy must change and evolve alongside the organization that implements it.

Organizations should also incorporate their industry’s standard best practices into their incident response policy.

Incident Response Policy vs. Incident Response Plan

An incident response plan is part of an incident response policy. Within the policy framework, a plan provides step-by-step guidance on how an organization should identify, assess, contain, and remediate cyber threats. Put another way, an incident response policy establishes the high-level strategy and shape of an organization’s incident response process. In contrast, an incident response plan focuses on how that process should be implemented.

Beyond this, the two terms both refer to components of an organization’s overall incident response strategy.

BlackBerry for Incident Response

Get immediate help from BlackBerry Cybersecurity Services—whether you're under cyberattack, need to contain a breach or want to develop an incident response plan. Report an incident or call us now at +1-888-808-3119.

Report an Incident

More Resources