IT Security Incident Handling Procedure

The IT Security Incident Handling Procedure details the steps for reporting any actual or suspected IT security problem. The security incident handling procedure also addresses security issues related to the safety, confidentiality, availability and integrity of information maintained on your company’s IT system.

The IT Security Incident Handling Procedure applies to your company’s remote data terminals, desktop and portable computers, data centers, and telecommunications facilities, as well as all data, hardware and IT personnel. (10 pages, 1485 words)

IT Security Incident Handling Responsibilities:

The Incident Response Handling Team is responsible for investigating actual or suspected Information Technology incidents, resolving such incidents, and reporting on incident responses.

The Help Desk is responsible for reporting potential security incidents to the Information Technology Security Manager.

The Human Resources Manager is responsible for facilitating training of the Incident Response Team.

Information Technology Managers are responsible for reviewing the Information Technology Incident, reports, and their handling.

The Information Technology Security Manager is responsible for developing the Information Technology Incident Handling Plan, building an Incident Response Team, assigning incidents to the IRT for resolution, reporting incidents and responses to the Security Review Committee, and updating the Information Technology Incident Handling Plan, as needed.

IT Security Incident Handling Definition:

Information Technology security incident – An actual or suspected occurrence of unauthorized (intentional or unintentional) use, loss, disclosure, modification, or destruction of Information Technology hardware, software, or information.

IT Security Incident Handling Procedure Activities

• IT Incident Handling Preparation
• IT Incident Handling
• IT Incident Handling Review

IT Security Incident Handling Procedure References

• ISO/IEC 17799:2005-Information Technology-Code of Practice for Information Security Management, Clause 6.3 (Responding to Security Incidents and Malfunctions)
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)Sarbanes-Oxley Act of 2002
• National Institute of Standards and Technology (NIST) Special Publication #800-61-Computer Security Incident Handling Guide (January, 2004)
• National Institute of Standards and Technology (NIST) Special Publications #800-66-Introductory Resource Guide for Implementing the HIPAA Security Rule (March, 2005)

IT Security Incident Handling Procedure Forms

• IT Incident Report Form