An information security incident management policy template covering reporting, investigation, the risk register, evidence, personal data breaches and escalation.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on incidents:

• Information Security Incidents and Ransomware
• Backup, Business Continuity and ICT Recovery
• Data Protection and UK GDPR
• Information Security knowledge base

Logo Update Service

Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This policy is also included in the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Information Security Incident Management Policy Template

An information security incident management policy template committing to deal with information security incidents promptly and effectively, so that any risk is contained and reduced and the impact on the organisation and the risk of data loss are kept to a minimum.

The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.

What the Incident Management Policy Covers

• Awareness - all workers aware of the reporting procedure and their responsibility to report
• Reporting and investigation - incidents reported in a timely manner and properly investigated
• Risk register - new risks added and assigned to a risk owner, with unacceptable risks mitigated
• Senior management - involved in deciding response actions
• Records - all incidents recorded, their impact understood and actions taken
• Evidence - gathered, recorded and kept, with relevant staff knowing how to collect and preserve digital evidence
• External reporting - serious incidents reported by authorised individuals where required
• Personal data breaches - assessed promptly and reported to the ICO where required, within 72 hours where feasible, and to affected individuals where there is a high risk
• Recovery - returning to normal operation in a timely manner
• Escalation - incidents needing a coordinated response or with media interest escalated, with a decision on activating the business continuity plan

Checked Against Cyber Essentials

The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.

Using the Policy

Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.

Who Needs an Incident Management Policy?

Organisations working to ISO 27001, and any organisation that wants a clear policy for reporting and handling information security incidents and data breaches.

Included in the ISO 27001 Toolkit

This policy is part of the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001.

Works with the Incident and Breach Forms

Incidents can be recorded on the F-Q109 Information Security Incident form and personal data breaches on the F-Q74 Data Breach Form, new risks added to the F-IMS36 Risk Register, and continuity arrangements set out on the F-Q94 Business Continuity Plan Form.

Document Control

The footer carries the policy number and title, information classification, version and page numbers, and the approval fields record who approved the policy and when, so it can be controlled with the rest of your management system documents and listed on a document register such as the F-IMS20 Document Register.

Related Policies

• P-92 Data Breach Policy - data breaches
• P-20 Information Security Policy - information security
• P-34 Business Continuity Policy Statement - business continuity